On Sun, Apr 14, 2013 at 2:02 PM, Jérémie Courrèges-Anglas <[email protected]> wrote: > Philip Guenther <[email protected]> writes: ... >> As for -z now: yeah, it works on OpenBSD; what problem are they trying >> to solve by using it? > > -z now seems to be useful when used together with -z relro, IIUC, > allowing the global offset table to be marked read-only. If there is > anything like that on OpenBSD, I'd like to use it for this port, else > I'll just disable upstream hardening flags.
On OpenBSD, the GOT is marked read-only except when a lazy relocation is actually being resolved and updated. -znow eliminates the mprotect(RW)/relocate/mprotect(RO) dance by paying the cost of doing all relocations at load-time. For a single-threaded program, it's hard to argue that there's any security benefit to eliminating that as only ld.so is running in that window. Philip Guenther
