Re: [Qemu-devel] [PATCH v7 1.0] configure: build position independent executables on x86 hosts

[Anthony Liguori <anthony@codemonkey.ws>]

On 11/15/2011 05:25 AM, Peter Maydell wrote:
> On 15 November 2011 09:34, Avi Kivity<avi@redhat.com>  wrote:
>> Change the default on x86 hosts to building PIE (position independent
>> executables); instead of restricting the option to user-only targets,
>> apply it to all targets.
>>
>> In addition, set the relocation sections to read-only (relro) when available;
>> this reduces the attack surface by disallowing changes to relocation tables
>> at runtime.
>>
>> While PIE reduces performance and relro increases load time, it greatly
>> improves security, with the potential to reduce a code execution vulnerability
>> to a self denial of service.
>>
>> Non-x86 are not changed, as they require TCG changes.
>>
>> Signed-off-by: Avi Kivity<avi@redhat.com>
>
> Reviewed-by: Peter Maydell<peter.maydell@linaro.org>
>
> ...as far as the technical content of the patch is concerned.
> I'm still rather dubious about the merits of putting this patch
> in this late in the release cycle.

How about we limit this to be enabled by default on x86 Linux hosts?

That would make me a lot more comfortable for 1.0 since I expect we can test 
that exhaustively.

Regards,

Anthony Liguori

>
> -- PMM
>
>