Re: RFC: Add --enable-static-pie to build static executables as PIE

["H.J. Lu" <hjl dot tools at gmail dot com>]

On Tue, Jul 18, 2017 at 6:21 AM, Adhemerval Zanella
<adhemerval.zanella@linaro.org> wrote:
>
>
> On 18/07/2017 10:14, Carlos O'Donell wrote:
>> On 07/18/2017 09:10 AM, H.J. Lu wrote:
>>> On Tue, Jul 18, 2017 at 6:08 AM, Carlos O'Donell <carlos@redhat.com> wrote:
>>>> On 07/18/2017 08:30 AM, H.J. Lu wrote:
>>>>>> - What practical benefit do you get with a "static PIE"?
>>>>>
>>>>> A static PIE can be loaded at random address without
>>>>> dynamic linker.
>>>>
>>>> This is just a restating of what it does, Alan asked what practical
>>>> benefit it would have. What use cases do you see? Do you see us
>>>> completely replacing non-PIE static binaries with PIE static binaries
>>>> and then randomizing their load address to improve security?
>>>>
>>>
>>> Yes.  That is the main use of PIE, isn't it?
>>
>> Yes, distributions use PIE for security hardening.
>>
>> Do you forsee any other uses?
>>
>> What problems would we face in adopting PIE static binaries at the
>> distribution level?
>>
>> How much bigger/slower are the code sequences for PIE static
>> binaries? I assume it is just the normal difference between non-PIC
>> vs. PIC?
>>
>
> Also, do you know which is the status of current ports regarding binutils
> support for static pie?
>
> For GLIBC, do you know which kind of port modifications would be required
> to adapt it to support it?

Static PIE is nothing new.  ld.so is a static PIE.  You need a linker with

 --no-dynamic-linker         Produce an executable with no program
interpreter header

Binutils 2.28 and above should be OK.   I fixed an x86-64 static PIE bug
for binutils 2.29.   I can't be certain for all ports.

-- 
H.J.