#4 Use full relro linking flags
Closed 2 months ago by mschorm. Opened 2 months ago by hhorak.

file modified
+6 -1

@@ -1,6 +1,6 @@ 

  Name:           galera

  Version:        25.3.25

- Release:        3%{?dist}

+ Release:        4%{?dist}

  Summary:        Synchronous multi-master wsrep provider (replication engine)

  

  License:        GPLv2

@@ -41,6 +41,7 @@ 

  CPPFLAGS="%{optflags}"

  CPPFLAGS=`echo $CPPFLAGS| sed -e "s|-Wp,-D_GLIBCXX_ASSERTIONS||g" `

  export CPPFLAGS

+ export LDFLAGS="$LDFLAGS -pie -Wl,-z,relro -Wl,-z,now"

  

  scons-3 %{?_smp_mflags} strict_build_flags=0

  

@@ -88,6 +89,10 @@ 

  

  

  %changelog

+ * Tue Jul 16 2019 Honza Horak <hhorak@redhat.com> - 25.3.25-4

+ - Use full relro linking flags

+   Resolves: #1624113

+ 

  * Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 25.3.25-3

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

  

It looks like setting the LDFLAGS to enable full RELRO solves the annocheck issues for me as well, at least on x86_64 I don't see any more issues when running the following command in mock:

annocheck -v --skip-cf-protection --skip-glibcxx-assertions --skip-glibcxx-assertions \
--skip-stack-realign --section-size=.gnu.build.attributes --ignore-gaps /builddir/build/RPMS/galera-25.3.23-5.el8.x86_64.rpm \
--debug-rpm=/builddir/build/RPMS/galera-debuginfo-25.3.23-5.el8.x86_64.rpm /builddir/build/RPMS/galera-25.3.23-5.el8.x86_64.rpm

Resolves: #1624113

I just found and applied a better solution.

Pull-Request has been closed by mschorm

2 months ago