So how it can be verified, that the compiled ELF has RELRO and NOW? 1. RELRO can be verified by calling readelf with the -l option and look for RELRO. If it's there, the ELF was compiled with RELRO 2. NOW can be verified by calling readelf with the -d option and look for BIND_NOW If the ELF has both, it's full RELRO. If it has only RELRO, but no BIND_NOW, it's lazy.
If I comment out the append flag row in the xorg eclass, the resulting ELF will be full relro. Without explicitly specifying relro and now. That's probably because of the hardened toolchain. I will give a try to the radeon driver soon. Now it's only Xorg and most of the drivers compiled with full relro, except for the video card driver. -- dr Tóth Attila, Radiológus, 06-20-825-8057 Attila Toth MD, Radiologist, +36-20-825-8057 2013.Október 1.(K) 22:26 időpontban Hinnerk van Bruinehsen ezt írta: > On Tue, Oct 01, 2013 at 10:34:07PM +0300, Alex Efros wrote: >> Hi! >> >> On Tue, Oct 01, 2013 at 09:21:00PM +0200, Hinnerk van Bruinehsen wrote: >> > If you want to try, you could try the xorg-2.eclass from here: >> > >> > https://github.com/N8Fear/hvb-overlay/blob/master/eclass/xorg-2.eclass >> > >> > either by temporarily overwriting the one from the portage tree or >> otherwise by >> >> Overwriting one from the portage is ok, I think. What next - rebuild >> x11-base/xorg-server-1.14.3 and restart Xorg to check is it works ok? >> >> -- >> WBR, Alex. > > That should do it - and on the next sync everything should be back to > normal. > Btw: seems like building the driver (xf86-video-intel in my case) seems to > break X (no screens found). > I think it still would be an improvement nonetheless if xorg-server could > be > build with full relro. > The question is if it's the same for other drivers (building the drivers > break > X, building the server itself with full relro works). > > One other more or less losely related thing: x86-input-synaptics works > with > full relro for me. > >
