Changeset 530771a

Timestamp:

09/10/2022 10:30:11 PM (20 months ago)

Author:

Thomas Trepl (Moody) <thomas@…>

Branches:

multilib

Children:

c49c1fb

Parents:

3c20ad9 (diff), 8d3b254 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Automatic merge of trunk into multilib

Files:

• chapter05/gcc-pass1.xml (modified) (1 diff)
• chapter08/gcc.xml (modified) (2 diffs)

chapter05/gcc-pass1.xml

@@ -169 +169 @@
 
       <varlistentry>
+      <term><parameter>--enable-default-pie and
+      --enable-default-ssp</parameter></term>
+        <listitem>
+          <para>Those switches allow GCC to compile programs with
+          some hardening security features (more information on those in
+          the <xref linkend="pie-ssp-info"/> in chapter 8). They are not
+          strictly needed at this stage, since the compiler will only produce
+          temporary executables. But it is cleaner to have the temporary
+          packages be as close as possible to the final ones.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term><parameter>--disable-shared</parameter></term>
         <listitem>

chapter08/gcc.xml

@@ -125 +125 @@
     </variablelist>
 
+    <note id="pie-ssp-info" xreflabel="note on PIE and SSP">
+      <para>
+        PIE (position independent executable) is a technique to produce
+        binary programs that can be loaded anywhere in memory. Together
+        with a feature named ASLR (Address Space Layout Randomization),
+        this allows programs to never have the same memory layout,
+        thus defeating attacks based on reproducible memory patterns.
+      </para>
+      <para>
+        SSP (Stack Smashing Protection) is a technique to ensure
+        that the parameter stack is not corrupted. Stack corruption can
+        for example alter the return address of a subroutine,
+        which would allow transferring control to an attacker program instead
+        of the original one.
+      </para>
+    </note>
+
     <para>Compile the package:</para>
 
@@ -157 +174 @@
     url="&test-results;"/> and
     <ulink url="https://gcc.gnu.org/ml/gcc-testresults/"/>.</para>
+
+    <para>In gcc, eleven tests, in the i386 test suite are known to FAIL.
+    It's because the test files do not account for the
+    <parameter>--enable-default-pie</parameter> option.</para>
 
     <para>In g++, four tests related to PR100400 are known to be reported