Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 955458

Summary: racoon2 package should be built with PIE flags
Product: [Fedora] Fedora Reporter: Dhiru Kholia <dkholia>
Component: racoon2Assignee: Pavel Šimerda (pavlix) <psimerda>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 19CC: bressers, dhiru, psimerda
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: racoon2-20100526a-28.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-02 09:25:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 914426    
Bug Blocks:    
Attachments:
Description Flags
this should enable PIE
none
this should fix the build none

Description Dhiru Kholia 2013-04-23 05:31:48 UTC
Description of problem:

http://fedoraproject.org/wiki/Packaging:Guidelines#PIE says that "you MUST
enable the PIE compiler flags if your package is long running ...".

However, currently racoon2 is not being built with PIE flags. This is a
clear violation of the packaging guidelines.

This issue (in its wider scope) is being discussed at,

https://fedorahosted.org/fesco/ticket/1104

https://lists.fedoraproject.org/pipermail/devel/2013-March/180827.html

Version-Release number of selected component (if applicable):

racoon2-20100526a-18.fc18.x86_64.rpm

How reproducible:

You can use following programs to check if a package is hardened:

http://people.redhat.com/sgrubb/files/rpm-chksec

OR

https://github.com/kholia/checksec

Steps to Reproduce:

Get scanner.py from https://github.com/kholia/checksec

$ ./scanner.py racoon2-20100526a-18.fc18.x86_64.rpm
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-iked,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-spmd,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-spmdctl,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip

Comment 1 Dhiru Kholia 2013-05-15 13:21:33 UTC
Created attachment 748293 [details]
this should enable PIE

Comment 2 Dhiru Kholia 2013-05-15 13:22:05 UTC
Created attachment 748294 [details]
this should fix the build

Comment 3 Dhiru Kholia 2013-05-15 13:23:12 UTC
Pavel,

The attached patches should fix the build (which is currently failing) and enable PIE.

Please test them. Thanks!

Comment 4 Dhiru Kholia 2013-06-03 06:09:33 UTC
Hi,

Is there any progress on this?

Does the attached modified .spec file works?

Comment 5 Pavel Šimerda (pavlix) 2014-01-07 13:54:53 UTC
This should wait until racoon2 actually builds on recent Fedora systems, see bug #914426.

Comment 6 Pavel Šimerda (pavlix) 2014-02-17 17:22:00 UTC
Hardened build won't work for me without further tweaking:

gcc -o spmd -g -Wall -DSPMD_DEBUG -I../lib  -DHAVE_CONFIG_H -DRACOON2_CONFIG_DIR=\"/etc/racoon2\" main.o dns.o udp.o query.o task.o signal.o shell.o utils.o cache.o spmd_pfkey.o fqdn_query.o -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -L../lib -lcrypto -lracoon -lcrypto 
/bin/ld: spmdctl.o: relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC
spmdctl.o: could not read symbols: Bad value
/bin/ld: main.o: relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC
main.o: could not read symbols: Bad value
c

Suggestions welcome.

Comment 7 Pavel Šimerda (pavlix) 2014-02-19 08:26:37 UTC
Works for me now, fixed in rawhide.

Comment 8 Fedora Update System 2014-03-07 11:02:05 UTC
racoon2-20100526a-27.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/racoon2-20100526a-27.fc19

Comment 9 Fedora Update System 2014-03-08 03:36:33 UTC
Package racoon2-20100526a-27.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing racoon2-20100526a-27.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-3616/racoon2-20100526a-27.fc19
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-03-15 15:12:16 UTC
Package racoon2-20100526a-28.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing racoon2-20100526a-28.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-3616/racoon2-20100526a-28.fc19
then log in and leave karma (feedback).

Comment 12 Fedora Update System 2014-04-02 09:25:57 UTC
racoon2-20100526a-28.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.