From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:37664) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RQN9w-0001Uc-RC for qemu-devel@nongnu.org; Tue, 15 Nov 2011 12:51:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RQN9s-0000rs-PS for qemu-devel@nongnu.org; Tue, 15 Nov 2011 12:51:00 -0500 Received: from mx1.redhat.com ([209.132.183.28]:20211) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RQN9s-0000rf-Gw for qemu-devel@nongnu.org; Tue, 15 Nov 2011 12:50:56 -0500 Message-ID: <4EC2A67A.6040604@redhat.com> Date: Tue, 15 Nov 2011 19:50:50 +0200 From: Avi Kivity MIME-Version: 1.0 References: <1321349691-19099-1-git-send-email-avi@redhat.com> <4EC27DEE.1020206@redhat.com> In-Reply-To: <4EC27DEE.1020206@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v7 1.0] configure: build position independent executables on x86 hosts List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Blue Swirl , Peter Maydell , Paul Moore , qemu-devel@nongnu.org On 11/15/2011 04:57 PM, Anthony Liguori wrote: > On 11/15/2011 05:25 AM, Peter Maydell wrote: >> On 15 November 2011 09:34, Avi Kivity wrote: >>> Change the default on x86 hosts to building PIE (position independent >>> executables); instead of restricting the option to user-only targets, >>> apply it to all targets. >>> >>> In addition, set the relocation sections to read-only (relro) when >>> available; >>> this reduces the attack surface by disallowing changes to relocation >>> tables >>> at runtime. >>> >>> While PIE reduces performance and relro increases load time, it greatly >>> improves security, with the potential to reduce a code execution >>> vulnerability >>> to a self denial of service. >>> >>> Non-x86 are not changed, as they require TCG changes. >>> >>> Signed-off-by: Avi Kivity >> >> Reviewed-by: Peter Maydell >> >> ...as far as the technical content of the patch is concerned. >> I'm still rather dubious about the merits of putting this patch >> in this late in the release cycle. > > How about we limit this to be enabled by default on x86 Linux hosts? > > That would make me a lot more comfortable for 1.0 since I expect we > can test that exhaustively. It certainly suits me. v8 coming up. -- error compiling committee.c: too many arguments to function