[Pkg-uml-pkgs] Bug#837579: user-mode-linux: FTBFS with bindnow and PIE enabled

[Ritesh Raj Sarraf]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Control: tag -1 +help


Hello Balint,


On Mon, 2016-09-12 at 16:42 +0200, Balint Reczey wrote:
> During a rebuild of all packages in sid, your package failed to build on
> amd64 with patched GCC and dpkg.
> 
> The rebuild tested if packages are ready for a transition
> enabling PIE and bindnow for amd64.
> 

I have tried enabling hardening flags before but that never helped. And I did
not look very deep into it.

hardening=+all also modifies LDFLAGS which breaks the UML kernel build.

So today, I tried with just the below, but lintian still complains.

rrs at chutzpah:~/Community/Packaging/user-mode-linux (master)$ git diff
diff --git a/debian/rules b/debian/rules
index e29da82..802eb1e 100755
- --- a/debian/rules
+++ b/debian/rules
@@ -15,6 +15,10 @@ tmpmodules:=$(debian)/uml-modules
 DEB_HOST_ARCH?=$(shell dpkg-architecture -qDEB_HOST_ARCH)
 #SUBARCH?=$(shell uname -m)
 
+export DEB_BUILD_MAINT_OPTIONS = hardening=+pie,+bindnow
+#DPKG_EXPORT_BUILDFLAGS = 1
+#include /usr/share/dpkg/buildflags.mk
+
 ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
 KBUILDVARS := CFLAGS_KERNEL=-O1
 endif


If you have any suggestions on working around it, please do share on this bug
report.


> For more information about the changes to sid's dpkg and GCC please
> visit:
>  https://wiki.debian.org/Hardening/PIEByDefaultTransition
> 
> Relevant part (hopefully):
> ...
>   LD      init/built-in.o
> /usr/bin/ld: arch/um/drivers/built-in.o: relocation R_X86_64_32 against
> `.rodata.str1.1' can not be used when making a shared object; recompile
> with -fPIC
> /usr/bin/ld: final link failed: Nonrepresentable section on output
> ...

I've tagged this bug report as "help".

BTW, do you know if the regular linux images of Debian are Hardening enabled ?


- -- 
Ritesh Raj Sarraf | http://people.debian.org/~rrs
Debian - The Universal Operating System
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJX1vFuAAoJEKY6WKPy4XVphCkP/1XrTHg8wGTrBiDoKOXbS+rn
5DcS7J8g6fFYWIsViyA6I2MyMSXUaCtoxQHqHBe86gqqL2duPO+inAf2m8aFkuEn
XkkPe+8zOwDKaN3aEIkxfG2erphN7O0Q/efv15bParyMCaC315mASAMxzM2kC/hj
830SmEUfRtzvCTXzdo8NKiF5wY6c4rPrJyQNs9EE5vZk8L+ucrTtlsXzV2pUaJfq
v2Sj72GmRG28p4VkfQzpmwdMgQT3tYcAfsi49Up0fVgwohhyXgaOgDrJKeYQgPwc
vet5QjP+2LL0hZVovMbSrGc22mTap89TZzbQHPd3YMNPDp0GySQNO7Z+E7JZ+bOc
DjD/0u634yfKuUNOmBtlkjhBzSVuI2a7vRzlw7ouS6a7efGUju9lc9j3bDdqghQg
BCzTgtWBRnV8CX+l+61vofXZiDKdkJYaCGxJpnstQ+qgMwjblNGGHWku7gMXNy5M
dqpBF70AdXiMCD8mdeNHKex2X+DMGkAYhMerBopwy6QZoZ6g7Dm6eMr2T1WisZp4
UJToid7pOXG3n2TJ6QUVlg0ChQa7sw+cR/7C9cqHic27qj75Efajbqp25X2t5Mt/
gkfaJqN2e/M9CWhOskzImI4XkcKNAquzcO9Ue//UUJZKGOJWjj5tEAQ8ECllY8rC
uuZ+OTm0y7pO40d8ErSm
=8ufT
-----END PGP SIGNATURE-----