dpkg-buildflags should explicitly pass -fno-PIE and -no-pie if DEB_BUILD_{MAINT_,}OPTIONS=hardening=-pie is set
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| dpkg (Debian) |
Fix Released
|
Unknown
|
||
| dpkg (Ubuntu) |
Undecided
|
Unassigned |
Bug Description
now with the default to pie, dpkg-buildflags should explicitly pass -fno-PIE and -no-pie if DEB_BUILD_
Matthias Klose (doko) wrote : | #1 |
Steve Langasek (vorlon) wrote : | #2 |
This should rather be DEB_BUILD_
Launchpad Janitor (janitor) wrote : | #3 |
Status changed to 'Confirmed' because the bug affects multiple users.
Changed in dpkg (Ubuntu): | |
status: | New → Confirmed |
it seems to be not working for virtualbox
DEB_BUILD_
/usr/bin/
kBuild: Compiling RuntimeR0 - /build/
g++ -c -O2 -nostdinc -g -pipe -Werror -pedantic -Wshadow -Wshadow -Wall -Wextra -Wno-missing-
/build/
summary: |
dpkg-buildflags should explicitly pass -fno-PIE and -no-pie if - DEB_BUILD_HARDENING_PIE=0 is set + DEB_BUILD_{MAINT_,}OPTIONS=hardening=-pie is set |
Changed in dpkg (Debian): | |
status: | Unknown → New |
dino99 (9d9) wrote : | #5 |
Debian answer & possible solution:
https:/
its an Ubuntu problem, and Debian will probably change nothing to their dkms version.
dino99 (9d9) wrote : | #6 |
Some more comment:
the ubuntu kenel team have teached the compiler to take care of that issue directly; so it seems 'dkms' task opened here can be dropped too now.
* Cannot use CONFIG_
supported by compiler (LP: #1574982)
- SAUCE: (no-up) disable -pie when gcc has it enabled by default
dino99 (9d9) wrote : | #7 |
but a solution is still needed in case of vanilla kernel installation
Changed in dpkg (Debian): | |
status: | New → Fix Released |
dino99 (9d9) wrote : | #8 |
Looks like an old problem now fixed; Maybe closing that report then.
more a wontfix, but workarounds are already in place.
Changed in dpkg (Ubuntu): | |
status: | Confirmed → Fix Released |
same for DEB_BUILD_ HARDENING_ BINDNOW= 0