Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 955458 - racoon2 package should be built with PIE flags
Summary: racoon2 package should be built with PIE flags
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: racoon2
Version: 19
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Pavel Šimerda (pavlix)
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 914426
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-23 05:31 UTC by Dhiru Kholia
Modified: 2014-04-02 09:25 UTC (History)
3 users (show)

Fixed In Version: racoon2-20100526a-28.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-04-02 09:25:57 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
this should enable PIE (deleted)
2013-05-15 13:21 UTC, Dhiru Kholia
no flags Details
this should fix the build (deleted)
2013-05-15 13:22 UTC, Dhiru Kholia
no flags Details | Diff

Description Dhiru Kholia 2013-04-23 05:31:48 UTC
Description of problem:

http://fedoraproject.org/wiki/Packaging:Guidelines#PIE says that "you MUST
enable the PIE compiler flags if your package is long running ...".

However, currently racoon2 is not being built with PIE flags. This is a
clear violation of the packaging guidelines.

This issue (in its wider scope) is being discussed at,

https://fedorahosted.org/fesco/ticket/1104

https://lists.fedoraproject.org/pipermail/devel/2013-March/180827.html

Version-Release number of selected component (if applicable):

racoon2-20100526a-18.fc18.x86_64.rpm

How reproducible:

You can use following programs to check if a package is hardened:

http://people.redhat.com/sgrubb/files/rpm-chksec

OR

https://github.com/kholia/checksec

Steps to Reproduce:

Get scanner.py from https://github.com/kholia/checksec

$ ./scanner.py racoon2-20100526a-18.fc18.x86_64.rpm
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-iked,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-spmd,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
racoon2,racoon2-20100526a-18.fc18.x86_64.rpm,/usr/sbin/racoon2-spmdctl,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip

Comment 1 Dhiru Kholia 2013-05-15 13:21:33 UTC
Created attachment 748293 [details]
this should enable PIE

Comment 2 Dhiru Kholia 2013-05-15 13:22:05 UTC
Created attachment 748294 [details]
this should fix the build

Comment 3 Dhiru Kholia 2013-05-15 13:23:12 UTC
Pavel,

The attached patches should fix the build (which is currently failing) and enable PIE.

Please test them. Thanks!

Comment 4 Dhiru Kholia 2013-06-03 06:09:33 UTC
Hi,

Is there any progress on this?

Does the attached modified .spec file works?

Comment 5 Pavel Šimerda (pavlix) 2014-01-07 13:54:53 UTC
This should wait until racoon2 actually builds on recent Fedora systems, see bug #914426.

Comment 6 Pavel Šimerda (pavlix) 2014-02-17 17:22:00 UTC
Hardened build won't work for me without further tweaking:

gcc -o spmd -g -Wall -DSPMD_DEBUG -I../lib  -DHAVE_CONFIG_H -DRACOON2_CONFIG_DIR=\"/etc/racoon2\" main.o dns.o udp.o query.o task.o signal.o shell.o utils.o cache.o spmd_pfkey.o fqdn_query.o -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -L../lib -lcrypto -lracoon -lcrypto 
/bin/ld: spmdctl.o: relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC
spmdctl.o: could not read symbols: Bad value
/bin/ld: main.o: relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC
main.o: could not read symbols: Bad value
c

Suggestions welcome.

Comment 7 Pavel Šimerda (pavlix) 2014-02-19 08:26:37 UTC
Works for me now, fixed in rawhide.

Comment 8 Fedora Update System 2014-03-07 11:02:05 UTC
racoon2-20100526a-27.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/racoon2-20100526a-27.fc19

Comment 9 Fedora Update System 2014-03-08 03:36:33 UTC
Package racoon2-20100526a-27.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing racoon2-20100526a-27.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-3616/racoon2-20100526a-27.fc19
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2014-03-15 15:12:16 UTC
Package racoon2-20100526a-28.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing racoon2-20100526a-28.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-3616/racoon2-20100526a-28.fc19
then log in and leave karma (feedback).

Comment 12 Fedora Update System 2014-04-02 09:25:57 UTC
racoon2-20100526a-28.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.