On Tue, Oct 01, 2013 at 11:59:33AM +0200, "Tóth Attila" wrote: > You made me curious, so I took a look at on this. > > The eclass has a single function stating: "Set up CFLAGS for a debug > build" in its description. Although it is not conditional for debug > builds, so gets applied all the time, being called from the eclass' > src_configure function. The filter flags statements are conditional and > applied only in case of a static-libs build. > Appending lazy binding is also conditional for Xorg and drivers. > > According to the Hardened/Toolchains wiki, one can find this section: > "The following packages have issues with BIND_NOW at the time of writing, > and it has to be relaxed somewhat for them: > X - some drivers consist of several libraries which are co-dependent, > and the modules frequently have references to modules that they load. > transcode - relies on lazy binding to be able to load its modules; the > issues are similar to the X issues." > > The function does not check whether the build happens on a hardened system > or not. > > If you are using a hardened toolchain, relro and now is specified by > default. I guess lazy takes precedence if present. Unless it would have no > effect. I'm not sure what you mean by adding relro and now to the filters. > Since these would be applied anyways by gcc specs. I'm also not sure what > happens if both lazy and relro+now are appended at the same time. > > If I would try to test Xorg and its drivers with relro+now, I would > comment out the append lazy line. I can give that a try if it is > reasonable, but the statement in the wiki seems pretty clear. I don't know > when those experiences described came from. > I've got an answer from Zorry via irc yesterday: It seems like full RELRO used to break some graphics drivers. There seems to be no real recent testing though. From my experience I can tell that intel seems to work fine for me (Zorry explicitely stated that radeon tend to break). I've had no time to create a hardened environment on my only nvidia machine to test nouveau and nvidia (the proprietary one). Since I have no radeon I've got no chance to test that at all (the failure happens on loading the driver, not build time sadly).
Bug #339984 is a relatively old tracker bug that doesn't reflect the current state. WKR Hinnerk
signature.asc
Description: Digital signature
