Ryan Hill <[email protected]> wrote: > >> > * -Wl,-z,relro >> > Enabled by default since binutils 2.18 >> >> This gives its real impact on secutiry only when combined with >> >> * -Wl,-z,now >> >> The latter is not enabled by default AFAIK. > > That's a bit misleading. Immediate binding does allow the GOT to be made > readonly but relro does a lot more than that.
It is somewhat pointless if not everything is readonly: In analogy, "relro" without "now" is a bit like making all your files readonly but leaving write-permissions on the directories. It only helps against too poorly designed exploits of corresponding bugs. > In any case this is a firm no. > The increase in loading times for apps that link lots of libraries is > significant (if it wasn't, we wouldn't need lazy loading :p). You get the same delay for lazy linking, only not necessarily everything immediately when the application starts up. And even then it is only faster (at startup) if only very few symbols are needed near the beginning. Quite the opposite, total time of loading huge projects like kde or libreoffice can even be faster with "now", since you do not need administration overhead for keeping track of resolving. I did not realize a measurable difference for kde and libreoffice even on my slow machines - random things like location on harddisk apparently had a much bigger impact on startup. Please really try before you fix your opinion. >> * -Wl,-z,noexecstack > > Well, portage will already tell you if your package installed any > binaries with executable stacks For some it did warn - otherwise I would not have found the bug. But for some it did not. However, I cannot recall which packages these were, and I did not examine why. Anyway, since this probably only concerns certain gcc versions with -flto, I guess that we need not discuss much about this flag. >> However, isn't it time to use "gnu" now for all users? [...] > > Sure, but the sysv hash is teeny and backward compatibility is > always nice if it's next to free. But it is not completely free, and the majority of users will never have any need for it - in factõ I do not know any use-case, but of course I do not know all ancient software sitting around somewhere. Those few who need it can add the option without difficulties.
