gcc/fixincludes/Makefile.in
Marek Polacek b6cb10af12 configure: Implement --enable-host-pie
[ This is my third attempt to add this configure option.  The first
version was approved but it came too late in the development cycle.
The second version was also approved, but I had to revert it:
<https://gcc.gnu.org/pipermail/gcc-patches/2022-November/607082.html>.
I've fixed the problem (by moving $(PICFLAG) from INTERNAL_CFLAGS to
ALL_COMPILERFLAGS).  Another change is that since r13-4536 I no longer
need to touch Makefile.def, so this patch is simplified. ]

This patch implements the --enable-host-pie configure option which
makes the compiler executables PIE.  This can be used to enhance
protection against ROP attacks, and can be viewed as part of a wider
trend to harden binaries.

It is similar to the option --enable-host-shared, except that --e-h-s
won't add -shared to the linker flags whereas --e-h-p will add -pie.
It is different from --enable-default-pie because that option just
adds an implicit -fPIE/-pie when the compiler is invoked, but the
compiler itself isn't PIE.

Since r12-5768-gfe7c3ecf, PCH works well with PIE, so there are no PCH
regressions.

When building the compiler, the build process may use various in-tree
libraries; these need to be built with -fPIE so that it's possible to
use them when building a PIE.  For instance, when --with-included-gettext
is in effect, intl object files must be compiled with -fPIE.  Similarly,
when building in-tree gmp, isl, mpfr and mpc, they must be compiled with
-fPIE.

With this patch and --enable-host-pie used to configure gcc:

$ file gcc/cc1{,plus,obj,gm2} gcc/f951 gcc/lto1 gcc/cpp gcc/go1 gcc/rust1 gcc/gnat1
gcc/cc1:     ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=98e22cde129d304aa6f33e61b1c39e144aeb135e, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/cc1plus: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=859d1ea37e43dfe50c18fd4e3dd9a34bb1db8f77, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/cc1obj:  ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1964f8ecee6163182bc26134e2ac1f324816e434, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/cc1gm2:  ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=a396672c7ff913d21855829202e7b02ecf42ff4c, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/f951:    ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=59c523db893186547ac75c7a71f48be0a461c06b, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/lto1:    ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=084a7b77df7be2d63c2d4c655b5bbc3fcdb6038d, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/cpp:     ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=3503bf8390d219a10d6653b8560aa21158132168, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/go1:     ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=988cc673af4fba5dcb482f4b34957b99050a68c5, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/rust1:   ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b6a5d3d514446c4dcdee0707f086ab9b274a8a3c, for GNU/Linux 3.2.0, with debug_info, not stripped
gcc/gnat1:   ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bb11ccdc2c366fe3fe0980476bcd8ca19b67f9dc, for GNU/Linux 3.2.0, with debug_info, not stripped

I plan to add an option to link with -Wl,-z,now.

Bootstrapped on x86_64-pc-linux-gnu with --with-included-gettext
--enable-host-pie as well as without --enable-host-pie.  Also tested
on a Debian system where the system gcc was configured with
--enable-default-pie.

Co-Authored by: Iain Sandoe  <iain@sandoe.co.uk>

ChangeLog:

	* configure.ac (--enable-host-pie): New check.  Set PICFLAG after this
	check.
	* configure: Regenerate.

c++tools/ChangeLog:

	* Makefile.in: Rename PIEFLAG to PICFLAG.  Set LD_PICFLAG.  Use it.
	Use pic/libiberty.a if PICFLAG is set.
	* configure.ac (--enable-default-pie): Set PICFLAG instead of PIEFLAG.
	(--enable-host-pie): New check.
	* configure: Regenerate.

fixincludes/ChangeLog:

	* Makefile.in: Set and use PICFLAG and LD_PICFLAG.  Use the "pic"
	build of libiberty if PICFLAG is set.
	* configure.ac:
	* configure: Regenerate.

gcc/ChangeLog:

	* Makefile.in: Set LD_PICFLAG.  Use it.  Set enable_host_pie.
	Remove NO_PIE_CFLAGS and NO_PIE_FLAG.  Pass LD_PICFLAG to
	ALL_LINKERFLAGS.  Use the "pic" build of libiberty if --enable-host-pie.
	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG and LD_PICFLAG after this
	check.
	* configure: Regenerate.
	* doc/install.texi: Document --enable-host-pie.

gcc/ada/ChangeLog:

	* gcc-interface/Make-lang.in (ALL_ADAFLAGS): Remove NO_PIE_CFLAGS.  Add
	PICFLAG.  Use PICFLAG when building ada/b_gnat1.o and ada/b_gnatb.o.
	* gcc-interface/Makefile.in: Use pic/libiberty.a if PICFLAG is set.
	Remove NO_PIE_FLAG.

gcc/m2/ChangeLog:

	* Make-lang.in: New var, GM2_PICFLAGS.  Use it.

gcc/d/ChangeLog:

	* Make-lang.in: Remove NO_PIE_CFLAGS.

intl/ChangeLog:

	* Makefile.in: Use @PICFLAG@ in COMPILE as well.
	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG after this check.
	* configure: Regenerate.

libcody/ChangeLog:

	* Makefile.in: Pass LD_PICFLAG to LDFLAGS.
	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG and LD_PICFLAG after this
	check.
	* configure: Regenerate.

libcpp/ChangeLog:

	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG after this check.
	* configure: Regenerate.

libdecnumber/ChangeLog:

	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG after this check.
	* configure: Regenerate.

libiberty/ChangeLog:

	* configure.ac: Also set shared when enable_host_pie.
	* configure: Regenerate.

zlib/ChangeLog:

	* configure.ac (--enable-host-shared): Don't set PICFLAG here.
	(--enable-host-pie): New check.  Set PICFLAG after this check.
	* configure: Regenerate.
2023-06-15 16:51:27 -04:00

208 lines
5.7 KiB
Makefile
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Makefile for fixincludes.
#
# Copyright (C) 1998, 1999, 2000, 2001, 2003, 2004, 2009, 2010, 2012
# Free Software Foundation, Inc.
#This file is part of fixincludes.
#fixincludes is free software; you can redistribute it and/or modify
#it under the terms of the GNU General Public License as published by
#the Free Software Foundation; either version 3, or (at your option)
#any later version.
#fixincludes is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#GNU General Public License for more details.
#You should have received a copy of the GNU General Public License
#along with fixincludes; see the file COPYING3. If not see
#<http://www.gnu.org/licenses/>.
SHELL=@SHELL@
# Some versions of `touch' (such as the version on Solaris 2.8)
# do not correctly set the timestamp due to buggy versions of `utime'
# in the kernel. So, we use `echo' instead.
STAMP = echo timestamp >
CC = @CC@
CFLAGS = @CFLAGS@
WARN_CFLAGS = @WARN_CFLAGS@ @WARN_PEDANTIC@ @WERROR@
LDFLAGS = @LDFLAGS@
INCLUDES = -I. -I$(srcdir) -I../include -I$(srcdir)/../include
FIXINC_CFLAGS = -DHAVE_CONFIG_H $(INCLUDES)
# Directory where sources are, from where we are.
srcdir = @srcdir@
VPATH = $(srcdir)
# Directory in which to put the directories used by the compiler.
libdir = @libdir@
# Directory in which GCC puts its executables.
libexecdir = @libexecdir@
# End of variables for you to override.
# The target that we're configured for.
target = @target@
target_noncanonical:=@target_noncanonical@
# The version of GCC in this tree
gcc_version := $(shell @get_gcc_base_ver@ $(srcdir)/../gcc/BASE-VER)
# Directory in which the compiler finds libraries etc.
libsubdir = $(libdir)/gcc/$(target_noncanonical)/$(gcc_version)
# Directory in which the compiler finds executables
libexecsubdir = $(libexecdir)/gcc/$(target_noncanonical)/$(gcc_version)
# Where our executable files go
itoolsdir = $(libexecsubdir)/install-tools
# Where our data files go
itoolsdatadir = $(libsubdir)/install-tools
# Locate mkinstalldirs.
mkinstalldirs=$(SHELL) $(srcdir)/../mkinstalldirs
AUTOCONF = autoconf
AUTOHEADER = autoheader
ACLOCAL = aclocal
ACLOCAL_AMFLAGS = -I .. -I ../config
default : all
# Now figure out from those variables how to compile and link.
.c.o:
$(CC) -c $(CFLAGS) $(PICFLAG) $(WARN_CFLAGS) $(CPPFLAGS) $(FIXINC_CFLAGS) $<
# The only suffixes we want for implicit rules are .c and .o.
.SUFFIXES:
.SUFFIXES: .c .o
#
## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
##
## Makefile for constructing the "best" include fixer we can
##
## # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
ifeq ($(PICFLAG),)
LIBIBERTY=../libiberty/libiberty.a
else
LIBIBERTY=../libiberty/pic/libiberty.a
endif
ALLOBJ = fixincl.o fixtests.o fixfixes.o server.o procopen.o \
fixlib.o fixopts.o
TESTOBJ = fixincl.o fixlib.o fixtests.o fixopts.o
FIXOBJ = fixfixes.o fixlib.o fixopts.o
HDR = server.h fixlib.h
FI = fixincl@EXEEXT@
AF = applyfix@EXEEXT@
all : @TARGET@ fixinc.sh mkheaders
gen : $(srcdir)/fixincl.x
oneprocess : full-stamp
twoprocess : test-stamp $(AF)
full-stamp : $(ALLOBJ) $(LIBIBERTY)
$(CC) $(CFLAGS) $(PICFLAG) $(LDFLAGS) $(LD_PICFLAG) -o $(FI) $(ALLOBJ) $(LIBIBERTY)
$(STAMP) $@
test-stamp : $(TESTOBJ) $(LIBIBERTY)
$(CC) $(CFLAGS) $(PICFLAG) $(LDFLAGS) $(LD_PICFLAG) -o $(FI) $(TESTOBJ) $(LIBIBERTY)
$(STAMP) $@
$(AF): $(FIXOBJ) $(LIBIBERTY)
$(CC) $(CFLAGS) $(PICFLAG) $(LDFLAGS) $(LD_PICFLAG) -o $@ $(FIXOBJ) $(LIBIBERTY)
$(ALLOBJ) : $(HDR)
fixincl.o : fixincl.c $(srcdir)/fixincl.x
fixtests.o : fixtests.c
fixfixes.o : fixfixes.c $(srcdir)/fixincl.x
server.o : server.c
procopen.o : procopen.c
fixlib.o : fixlib.c
fixinc.sh : fixinc.in mkfixinc.sh Makefile
srcdir="$(srcdir)" $(SHELL) $(srcdir)/mkfixinc.sh $(target)
$(srcdir)/fixincl.x: @MAINT@ fixincl.tpl inclhack.def
cd $(srcdir) ; $(SHELL) ./genfixes
mostlyclean :
rm -f *.o *-stamp $(AF) $(FI) *~ fixinc.sh
clean: mostlyclean
rm -f mkheaders mkheaders.almost
distclean: clean
rm -f Makefile config.h config.log config.status stamp-h
maintainer-clean: distclean
rm -f $(srcdir)/fixincl.x
distclean : clean
Makefile: $(srcdir)/Makefile.in config.status
$(SHELL) ./config.status Makefile
mkheaders.almost: $(srcdir)/mkheaders.in config.status
CONFIG_FILES=mkheaders.almost:mkheaders.in \
CONFIG_HEADERS= ./config.status
mkheaders: mkheaders.almost $(srcdir)/../gcc/BASE-VER
sed -e 's/@gcc_version@/$(gcc_version)/' < $< > $@T
mv -f $@T $@
config.h: stamp-h
stamp-h: $(srcdir)/config.h.in config.status
$(SHELL) ./config.status config.h
config.status: $(srcdir)/configure
$(SHELL) ./config.status --recheck
$(srcdir)/configure: @MAINT@ $(srcdir)/configure.ac $(srcdir)/aclocal.m4
cd $(srcdir) && $(AUTOCONF)
$(srcdir)/config.h.in: @MAINT@ $(srcdir)/configure.ac
cd $(srcdir) && $(AUTOHEADER)
$(srcdir)/aclocal.m4: @MAINT@ $(srcdir)/configure.ac
cd $(srcdir) && $(ACLOCAL) $(ACLOCAL_AMFLAGS)
check : all
autogen -T $(srcdir)/check.tpl $(srcdir)/inclhack.def
$(SHELL) ./check.sh $(srcdir)/tests/base
@rm -f ./check.sh
install : all
-rm -rf $(DESTDIR)$(itoolsdir)
$(mkinstalldirs) $(DESTDIR)$(itoolsdir)
$(mkinstalldirs) $(DESTDIR)$(itoolsdatadir)/include
$(INSTALL_DATA) $(srcdir)/README-fixinc \
$(DESTDIR)$(itoolsdatadir)/include/README
$(INSTALL_SCRIPT) fixinc.sh $(DESTDIR)$(itoolsdir)/fixinc.sh
$(INSTALL_PROGRAM) $(FI) $(DESTDIR)$(itoolsdir)/$(FI)
$(INSTALL_SCRIPT) mkheaders $(DESTDIR)$(itoolsdir)/mkheaders
install-strip: install
test -z '$(STRIP)' || $(STRIP) $(DESTDIR)$(itoolsdir)/$(FI)
.PHONY: all check install install-strip
.PHONY: dvi pdf info html install-pdf install-info install-html
dvi :
pdf :
info :
html :
install-pdf :
install-info :
install-html :
installcheck :