Problem: An attacker could intercept calls to shared library functions Fix By: Add -Wl,-z,now to final link command line Waive If: No shared libraries used Example: FAIL: bind-now test because not linked with -Wl,-z,now
This test checks that lazy binding is not enabled in the binary. Lazy binding can be used to delay resolving the links between an application and any shared libraries that it uses:
https://www.airs.com/blog/archives/41
Using lazy binding provides a faster start-up for an application since this resolving process is not performed until a function call is made to a specific library. But it is also a security vulnerability since an attacker could replace the binding with a link to their own code. Hence for security purposes immediate binding rather than lazy binding should be used.
The type of binding is selected via a linker command line option, and on a compiler command line the secure version usually looks like -Wl,-z,now. The lazy binding option is -Wl,-z,lazy although some linkers are configured to use lazy binding by default, in which case just the absence of the -Wl,-z,now option is enough to trigger this test.
Whilst important, this test can be ignored if the binary does not use any shared libraries.
Note - this test is automatically disabled if the --profile=el7 option is used.
The test can be disabled via the --skip-bind-now option and re-enabled by the --test-bind-now option.