* [gentoo-user] Am I in trouble now?
@ 2017-12-03 18:56 tuxic
2017-12-03 20:22 ` Marc Joliet
0 siblings, 1 reply; 4+ messages in thread
From: tuxic @ 2017-12-03 18:56 UTC (permalink / raw
To: Gentoo
Hi,
From the news I did everything to switch to the 17th profile EXCEPT
emerge -e @world.
One application which was recompiled was gcc-7.20.
From my undertsand/point of view gcc now has to have the PIE-feature
gcc-bin/7.2.0>l
total 6676
lrwxrwxrwx 1 root root 23 2017-12-02 16:36 c++ -> x86_64-pc-linux-gnu-c++
lrwxrwxrwx 1 root root 23 2017-12-02 16:36 cpp -> x86_64-pc-linux-gnu-cpp
lrwxrwxrwx 1 root root 23 2017-12-02 16:36 g++ -> x86_64-pc-linux-gnu-g++
lrwxrwxrwx 1 root root 23 2017-12-02 16:36 gcc -> x86_64-pc-linux-gnu-gcc
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 gcc-ar
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 gcc-nm
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 gcc-ranlib
lrwxrwxrwx 1 root root 24 2017-12-02 16:36 gcov -> x86_64-pc-linux-gnu-gcov
-rwxr-xr-x 1 root root 495400 2017-12-02 16:36 gcov-dump
-rwxr-xr-x 1 root root 515944 2017-12-02 16:36 gcov-tool
lrwxrwxrwx 1 root root 28 2017-12-02 16:36 gfortran -> x86_64-pc-linux-gnu-gfortran
-rwxr-xr-x 2 root root 1002192 2017-12-02 16:36 x86_64-pc-linux-gnu-c++
-rwxr-xr-x 1 root root 998096 2017-12-02 16:36 x86_64-pc-linux-gnu-cpp
-rwxr-xr-x 2 root root 1002192 2017-12-02 16:36 x86_64-pc-linux-gnu-g++
-rwxr-xr-x 1 root root 998096 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc
lrwxrwxrwx 1 root root 23 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-7.2.0 -> x86_64-pc-linux-gnu-gcc
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-ar
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-nm
-rwxr-xr-x 2 root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-ranlib
-rwxr-xr-x 1 root root 639312 2017-12-02 16:36 x86_64-pc-linux-gnu-gcov
-rwxr-xr-x 1 root root 1002192 2017-12-02 16:36 x86_64-pc-linux-gnu-gfortran
solfire:gcc-bin/7.2.0>checksec --file x86_64-pc-linux-gnu-c++
RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE
Partial RELRO Canary found NX enabled No PIE No RPATH No RUNPATH Yes 8 21 x86_64-pc-linux-gnu-c++
So...No PIE it says.
/root #>eselect profile show
Current /etc/portage/make.profile symlink:
default/linux/amd64/17.0/no-multilib
Before I start the rebuild of 2000++ packages ...
Is this all correct up to this point?
Cheers
Meino
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [gentoo-user] Am I in trouble now?
2017-12-03 18:56 [gentoo-user] Am I in trouble now? tuxic
@ 2017-12-03 20:22 ` Marc Joliet
2017-12-04 11:58 ` Marc Joliet
0 siblings, 1 reply; 4+ messages in thread
From: Marc Joliet @ 2017-12-03 20:22 UTC (permalink / raw
To: Gentoo
[-- Attachment #1: Type: text/plain, Size: 3634 bytes --]
Am Sonntag, 3. Dezember 2017, 19:56:19 CET schrieb tuxic@posteo.de:
> Hi,
>
> From the news I did everything to switch to the 17th profile EXCEPT
> emerge -e @world.
>
> One application which was recompiled was gcc-7.20.
>
> From my undertsand/point of view gcc now has to have the PIE-feature
>
> gcc-bin/7.2.0>l
> total 6676
> lrwxrwxrwx 1 root root 23 2017-12-02 16:36 c++ ->
> x86_64-pc-linux-gnu-c++ lrwxrwxrwx 1 root root 23 2017-12-02 16:36 cpp
> -> x86_64-pc-linux-gnu-cpp lrwxrwxrwx 1 root root 23 2017-12-02 16:36
> g++ -> x86_64-pc-linux-gnu-g++ lrwxrwxrwx 1 root root 23 2017-12-02
> 16:36 gcc -> x86_64-pc-linux-gnu-gcc -rwxr-xr-x 2 root root 26896
> 2017-12-02 16:36 gcc-ar
> -rwxr-xr-x 2 root root 26896 2017-12-02 16:36 gcc-nm
> -rwxr-xr-x 2 root root 26896 2017-12-02 16:36 gcc-ranlib
> lrwxrwxrwx 1 root root 24 2017-12-02 16:36 gcov ->
> x86_64-pc-linux-gnu-gcov -rwxr-xr-x 1 root root 495400 2017-12-02 16:36
> gcov-dump
> -rwxr-xr-x 1 root root 515944 2017-12-02 16:36 gcov-tool
> lrwxrwxrwx 1 root root 28 2017-12-02 16:36 gfortran ->
> x86_64-pc-linux-gnu-gfortran -rwxr-xr-x 2 root root 1002192 2017-12-02
> 16:36 x86_64-pc-linux-gnu-c++ -rwxr-xr-x 1 root root 998096 2017-12-02
> 16:36 x86_64-pc-linux-gnu-cpp -rwxr-xr-x 2 root root 1002192 2017-12-02
> 16:36 x86_64-pc-linux-gnu-g++ -rwxr-xr-x 1 root root 998096 2017-12-02
> 16:36 x86_64-pc-linux-gnu-gcc lrwxrwxrwx 1 root root 23 2017-12-02
> 16:36 x86_64-pc-linux-gnu-gcc-7.2.0 -> x86_64-pc-linux-gnu-gcc -rwxr-xr-x 2
> root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-ar -rwxr-xr-x 2
> root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-nm -rwxr-xr-x 2
> root root 26896 2017-12-02 16:36 x86_64-pc-linux-gnu-gcc-ranlib
> -rwxr-xr-x 1 root root 639312 2017-12-02 16:36 x86_64-pc-linux-gnu-gcov
> -rwxr-xr-x 1 root root 1002192 2017-12-02 16:36
> x86_64-pc-linux-gnu-gfortran
>
>
> solfire:gcc-bin/7.2.0>checksec --file x86_64-pc-linux-gnu-c++
> RELRO STACK CANARY NX PIE RPATH
> RUNPATH FORTIFY Fortified Fortifiable FILE Partial RELRO Canary found
> NX enabled No PIE No RPATH No RUNPATH
> Yes 8 21 x86_64-pc-linux-gnu-c++
>
>
>
> So...No PIE it says.
>
> /root #>eselect profile show
> Current /etc/portage/make.profile symlink:
> default/linux/amd64/17.0/no-multilib
>
> Before I start the rebuild of 2000++ packages ...
> Is this all correct up to this point?
Keep in mind that the news item literally says:
"2) Where supported, GCC will now build position-independent
executables (PIE) by default."
Note the "Where supported" bit. I don't know if that means "CPUs that this
works with" or "profiles that support this", but it looks like the "pie" USE
flag is forced globally in the profile and not deactivated in any of its sub-
profiles, so I'm tending to the former.
Of course, that doesn't mean that things are correct on your end, though. On
one of my computers, checksec does say "PIE enabled". Maybe you should try
compiling something else and verifying it. After all, there's probably a
reason why the "emerge -e @world" bit doesn't exclude any of the packages
previously rebuilt. I'll try to verify that on my desktop, though, which is
the one out of three computers I haven't migrated yet -- both my home server
and laptop have completed their "emerge -e @world" already (thankfully almost,
but not entirely, without problems).
> Cheers
> Meino
HTH
--
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [gentoo-user] Am I in trouble now?
2017-12-03 20:22 ` Marc Joliet
@ 2017-12-04 11:58 ` Marc Joliet
2017-12-04 14:40 ` David Haller
0 siblings, 1 reply; 4+ messages in thread
From: Marc Joliet @ 2017-12-04 11:58 UTC (permalink / raw
To: gentoo-user
[-- Attachment #1: Type: text/plain, Size: 960 bytes --]
Am Sonntag, 3. Dezember 2017, 21:22:23 CET schrieb Marc Joliet:
> Of course, that doesn't mean that things are correct on your end, though.
> On one of my computers, checksec does say "PIE enabled". Maybe you should
> try compiling something else and verifying it. After all, there's probably
> a reason why the "emerge -e @world" bit doesn't exclude any of the packages
> previously rebuilt. I'll try to verify that on my desktop, though
Just to follow up on this, I've now done everything except the "emerge -e
@world" step on my desktop, which shows "No PIE" for /usr/bin/x86_64-pc-linux-
gnu-g++, but "PIE enabled" for /usr/x86_64-pc-linux-gnu/binutils-bin/2.29.1/ld
(part of binutils, which was rebuilt *after* gcc). So try checking that if
you want to be sure (and haven't done your own verification in the meantime).
HTH
--
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [gentoo-user] Am I in trouble now?
2017-12-04 11:58 ` Marc Joliet
@ 2017-12-04 14:40 ` David Haller
0 siblings, 0 replies; 4+ messages in thread
From: David Haller @ 2017-12-04 14:40 UTC (permalink / raw
To: gentoo-user
Hello,
On Mon, 04 Dec 2017, Marc Joliet wrote:
>Am Sonntag, 3. Dezember 2017, 21:22:23 CET schrieb Marc Joliet:
>> Of course, that doesn't mean that things are correct on your end, though.
>> On one of my computers, checksec does say "PIE enabled". Maybe you should
>> try compiling something else and verifying it. After all, there's probably
>> a reason why the "emerge -e @world" bit doesn't exclude any of the packages
>> previously rebuilt. I'll try to verify that on my desktop, though
>
>Just to follow up on this, I've now done everything except the "emerge -e
>@world" step on my desktop, which shows "No PIE" for /usr/bin/x86_64-pc-linux-
>gnu-g++, but "PIE enabled" for /usr/x86_64-pc-linux-gnu/binutils-bin/2.29.1/ld
>(part of binutils, which was rebuilt *after* gcc). So try checking that if
>you want to be sure (and haven't done your own verification in the meantime).
Don't worry. I find plenty of _explicit_ '-fno-pie -fno-PIE' in the
sys-devel/gcc build-stuff and build logs.
Using my "check-pie" "extracted from checksec" script[1]:
# check-pie /usr/bin/*gcc* /usr/bin/*g++* 2>/dev/null
/usr/bin/gcc PIE
/usr/bin/gcc-6.4.0 no pie
/usr/bin/gcc-7.2.0 no pie
/usr/bin/gcc-ar PIE
/usr/bin/gcc-nm PIE
/usr/bin/gcc-ranlib PIE
/usr/bin/gccgo no pie
/usr/bin/x86_64-pc-linux-gnu-gcc PIE
/usr/bin/x86_64-pc-linux-gnu-gcc-6.4.0 no pie
/usr/bin/x86_64-pc-linux-gnu-gcc-7.2.0 no pie
/usr/bin/x86_64-pc-linux-gnu-gcc-ar PIE
/usr/bin/x86_64-pc-linux-gnu-gcc-nm PIE
/usr/bin/x86_64-pc-linux-gnu-gcc-ranlib PIE
/usr/bin/x86_64-pc-linux-gnu-gccgo no pie
/usr/bin/g++ PIE
/usr/bin/g++-6.4.0 no pie
/usr/bin/g++-7.2.0 no pie
/usr/bin/x86_64-pc-linux-gnu-g++ PIE
/usr/bin/x86_64-pc-linux-gnu-g++-6.4.0 no pie
/usr/bin/x86_64-pc-linux-gnu-g++-7.2.0 no pie
[the 2>/dev/null filters out the "not an executable" stuff]
I see a pattern there ;)
I've rebuilt 7.2.0 after the profile change and the "pie" useflag was
set. I guess gcc/g++ does some magic internal (assembler?) stuff while
compiling that makes it unsuitable to be compiled as a PI Executable.
I eselected 7.2.0, as I'm recompiling @world anyways ;) Let's see how
that'll work out. Currently I'm at 353/710 of an '--emptytree
@system'... I think I'll recompile the rest (of @world |¯| @system as
I go along during regular updates, @world would've been something like
939 IIRC, but probably all the biggies. Oh, and I explicitly excluded
icedtea for now. Or I'll "check-pie"/"checksec" and follow that.
HTH,
-dnh
[1] see a thread or two previous to this
--
Eine Wognatur wird nicht gesiggt, sondern gewoggt.
[Axel Woelke in dag°, 31.3.2000]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-12-04 14:42 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-12-03 18:56 [gentoo-user] Am I in trouble now? tuxic
2017-12-03 20:22 ` Marc Joliet
2017-12-04 11:58 ` Marc Joliet
2017-12-04 14:40 ` David Haller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox