Bug 1548679

(In reply to Florian Weimer from comment #0)
> In nfs-utils-1:2.3.1-5.fc28, the RPM spec file overrides CFLAGS:
> 
> %ifarch s390 s390x sparcv9 sparc64
> PIE="-fPIE"
> %else
> PIE="-fpie"
> %endif
> export PIE
> …
> CFLAGS="`echo $RPM_OPT_FLAGS $ARCH_OPT_FLAGS $PIE -D_FILE_OFFSET_BITS=64`"
> 
> (But -D_FILE_OFFSET_BITS=64 really needs to stay.)
> 
> And LDFLAGS injection does not work:
> 
> libtool: link: gcc -Wall -Wextra -Wstrict-prototypes -pipe
> -D_LARGEFILE64_SOURCE -O2 -g -pipe -Wall -Werror=format-security
> -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions
> -fstack-protector-strong -grecord-gcc-switches
> -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
> -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic
> -fasynchronous-unwind-tables -fstack-clash-protection -mcet -fcf-protection
> -fpie -D_FILE_OFFSET_BITS=64 -pie -o nfsdcltrack nfsdcltrack.o sqlite.o 
> ../../support/nfs/.libs/libnfs.a -lsqlite3 -lcap -lresolv
> 
> -Wl,-z,relro and -specs=/usr/lib/rpm/redhat/redhat-hardened-ld are missing.
> 
> See
> https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/
> buildflags.md for information on RPM macros and environment variables
> provided by the build environment.

Can you give me an example of what you are looking... redhat-rpm-config
page is not very straightforward... IMHO...

You should use %{set_build_flags} to set the CFLAGS/LDFLAGS environment variables, and fix the package build process to pass it down to the relevant places (linker invocations), ideally without making any changes to the flags.

Unfortunately, the latter part totally depends on the package build system.  Figuring out where CFLAGS/LDFLAGS are dropped is the hard part.

You can use “checksec --file nfsdcltrack” to verify that it was (likely) linked correctly.  It should say “Full RELRO” and “PIE enabled”.

I've looked around at other packages and I can't
find any other packages using those flags

I'm not against using it I just want to make sure I'm
do the right thing... would happen to know what packages
use those flags? tia..

(In reply to Steve Dickson from comment #3)
> I've looked around at other packages and I can't
> find any other packages using those flags

Try bash?  *Everything* is expected to use the same flags, only the way of injecting them differs because build systems vary.

(In reply to Florian Weimer from comment #4)
> (In reply to Steve Dickson from comment #3)
> > I've looked around at other packages and I can't
> > find any other packages using those flags
> 
> Try bash?  *Everything* is expected to use the same flags, only the way of
> injecting them differs because build systems vary.
bash does not use it either... 

So you are looking for something like this?


diff --git a/nfs-utils.spec b/nfs-utils.spec
index 5843e1d..aa87c03 100644
--- a/nfs-utils.spec
+++ b/nfs-utils.spec
@@ -115,13 +115,10 @@ export PIE
 
 sh -x autogen.sh
 
-CFLAGS="`echo $RPM_OPT_FLAGS $ARCH_OPT_FLAGS $PIE -D_FILE_OFFSET_BITS=64`"
-
 %define _statdpath /var/lib/nfs/statd
 %configure \
-    CFLAGS="$CFLAGS" \
-    CPPFLAGS="$DEFINES" \
-    LDFLAGS="-pie" \
+    CFLAGS="%{build_cflags} $PIE" \
+    LDFLAGS="%{build_ldflags} -pie" \
     --enable-mountconfig \
     --enable-ipv6 \
        --with-statdpath=%{_statdpath} \

I notice -pie was not being set so I set it... 
and it appears the "D_FILE_OFFSET_BITS=64" 
is no longer needed... I hope... 

I just hoping I'm not fixing something that's not broken! ;-)

(In reply to Steve Dickson from comment #5)
> -CFLAGS="`echo $RPM_OPT_FLAGS $ARCH_OPT_FLAGS $PIE -D_FILE_OFFSET_BITS=64`"
> -
>  %define _statdpath /var/lib/nfs/statd
>  %configure \
> -    CFLAGS="$CFLAGS" \
> -    CPPFLAGS="$DEFINES" \
> -    LDFLAGS="-pie" \
> +    CFLAGS="%{build_cflags} $PIE" \
> +    LDFLAGS="%{build_ldflags} -pie" \
>      --enable-mountconfig \
>      --enable-ipv6 \
>         --with-statdpath=%{_statdpath} \

You should drop $PIE and -pie, redhat-rpm-config will take care of that.  -pie will break shared objects (if you have any).

In fact, you don't even need to specify CFLAGS and LDFLAGS because the %configure macro takes care of that.

But the original problem appears to be that libtool is not running correctly and is dropping flags.  Changing the RPM spec file isn't going to fix that.

I asked for guidance here:

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/7BRVA3N6C7GCWLY6LT72MPNSIHXBMBQ2/

> I notice -pie was not being set so I set it... 
> and it appears the "D_FILE_OFFSET_BITS=64" 
> is no longer needed... I hope... 

-DD_FILE_OFFSET_BITS=64 could still be needed on 32-bit architectures if the makefiles do not supply it themselves.

nfs-utils-2.3.1-6.rc1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3d22839756

nfs-utils-2.3.1-6.rc1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3d22839756

nfs-utils-2.3.1-7.rc1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-5f49d4050a

nfs-utils-2.3.1-7.rc1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-5f49d4050a

nfs-utils-2.3.1-7.rc1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.