I have two systems using the radeon driver and I'm getting really curious. I have to see it for myself how it fails to load with full relro. At least on my laptop. There have been improvements regarding Xorg during the last few years. It's no longer necessary to switch of some PaX options for Xorg. So there might be some improvements regarding relro+now as well. I don't know if the advent of the golden linker made its mark regarding the way Xorg gets linked. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057
2013.Október 1.(K) 16:35 időpontban Hinnerk van Bruinehsen ezt írta: > On Tue, Oct 01, 2013 at 11:59:33AM +0200, "Tóth Attila" wrote: >> You made me curious, so I took a look at on this. >> >> The eclass has a single function stating: "Set up CFLAGS for a debug >> build" in its description. Although it is not conditional for debug >> builds, so gets applied all the time, being called from the eclass' >> src_configure function. The filter flags statements are conditional and >> applied only in case of a static-libs build. >> Appending lazy binding is also conditional for Xorg and drivers. >> >> According to the Hardened/Toolchains wiki, one can find this section: >> "The following packages have issues with BIND_NOW at the time of >> writing, >> and it has to be relaxed somewhat for them: >> X - some drivers consist of several libraries which are >> co-dependent, >> and the modules frequently have references to modules that they load. >> transcode - relies on lazy binding to be able to load its modules; >> the >> issues are similar to the X issues." >> >> The function does not check whether the build happens on a hardened >> system >> or not. >> >> If you are using a hardened toolchain, relro and now is specified by >> default. I guess lazy takes precedence if present. Unless it would have >> no >> effect. I'm not sure what you mean by adding relro and now to the >> filters. >> Since these would be applied anyways by gcc specs. I'm also not sure >> what >> happens if both lazy and relro+now are appended at the same time. >> >> If I would try to test Xorg and its drivers with relro+now, I would >> comment out the append lazy line. I can give that a try if it is >> reasonable, but the statement in the wiki seems pretty clear. I don't >> know >> when those experiences described came from. >> > I've got an answer from Zorry via irc yesterday: > It seems like full RELRO used to break some graphics drivers. There seems > to be > no real recent testing though. > From my experience I can tell that intel seems to work fine for me (Zorry > explicitely stated that radeon tend to break). > I've had no time to create a hardened environment on my only nvidia > machine to > test nouveau and nvidia (the proprietary one). > Since I have no radeon I've got no chance to test that at all (the failure > happens on loading the driver, not build time sadly). > > Bug #339984 is a relatively old tracker bug that doesn't reflect the > current > state. > > WKR > Hinnerk >
