ee817adf44
Resolves: bz#1442983 bz#1474745 bz#1503244 bz#1505363 bz#1509102 Signed-off-by: Milind Changire <mchangir@redhat.com>
71 lines
2.6 KiB
Diff
71 lines
2.6 KiB
Diff
From ada27d07526acb0ef09f37de7f364fa3dcea0b36 Mon Sep 17 00:00:00 2001
|
|
From: Atin Mukherjee <amukherj@redhat.com>
|
|
Date: Wed, 3 Jun 2015 11:09:21 +0530
|
|
Subject: [PATCH 11/74] build: introduce security hardening flags in gluster
|
|
|
|
This patch introduces two of the security hardening compiler flags RELRO & PIE
|
|
in gluster codebase. Using _hardened_build as 1 doesn't guarantee the existance
|
|
of these flags in the compilation as different versions of RHEL have different
|
|
redhat-rpm-config macro. So the idea is to export these flags at spec file
|
|
level.
|
|
|
|
Label: DOWNSTREAM ONLY
|
|
|
|
Change-Id: I0a1a56d0a8f54f110d306ba5e55e39b1b073dc84
|
|
Signed-off-by: Atin Mukherjee <amukherj@redhat.com>
|
|
Reviewed-on: https://code.engineering.redhat.com/gerrit/49780
|
|
Reviewed-by: Balamurugan Arumugam <barumuga@redhat.com>
|
|
Tested-by: Balamurugan Arumugam <barumuga@redhat.com>
|
|
Reviewed-on: https://code.engineering.redhat.com/gerrit/60137
|
|
Tested-by: Milind Changire <mchangir@redhat.com>
|
|
---
|
|
glusterfs.spec.in | 25 +++++++++++++++++++++++--
|
|
1 file changed, 23 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/glusterfs.spec.in b/glusterfs.spec.in
|
|
index dbdb818..458b8bc 100644
|
|
--- a/glusterfs.spec.in
|
|
+++ b/glusterfs.spec.in
|
|
@@ -709,6 +709,24 @@ GlusterFS Events
|
|
CFLAGS=-DUSE_INSECURE_OPENSSL
|
|
export CFLAGS
|
|
%endif
|
|
+# In RHEL7 few hardening flags are available by default, however the RELRO
|
|
+# default behaviour is partial, convert to full
|
|
+%if ( 0%{?rhel} && 0%{?rhel} >= 7 )
|
|
+LDFLAGS="$RPM_LD_FLAGS -Wl,-z,relro,-z,now"
|
|
+export LDFLAGS
|
|
+%else
|
|
+%if ( 0%{?rhel} && 0%{?rhel} == 6 )
|
|
+CFLAGS="$RPM_OPT_FLAGS -fPIE -DPIE"
|
|
+LDFLAGS="$RPM_LD_FLAGS -pie -Wl,-z,relro,-z,now"
|
|
+%else
|
|
+#It appears that with gcc-4.1.2 in RHEL5 there is an issue using both -fPIC and
|
|
+ # -fPIE that makes -z relro not work; -fPIE seems to undo what -fPIC does
|
|
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
|
|
+LDFLAGS="$RPM_LD_FLAGS -Wl,-z,relro,-z,now"
|
|
+%endif
|
|
+export CFLAGS
|
|
+export LDFLAGS
|
|
+%endif
|
|
|
|
./autogen.sh && %configure \
|
|
%{?_with_cmocka} \
|
|
@@ -2110,8 +2128,11 @@ end
|
|
* Fri Jun 12 2015 Aravinda VK <avishwan@redhat.com>
|
|
- Added rsync as dependency to georeplication rpm (#1231205)
|
|
|
|
-* Tue Jun 02 2015 Aravinda VK <avishwan@redhat.com>
|
|
-- Added post hook for volume delete as part of glusterfind (#1225465)
|
|
+* Thu Jun 11 2015 Atin Mukherjee <amukherj@redhat.com>
|
|
+- Security hardening flags inclusion (#1200815)
|
|
+
|
|
+* Thu Jun 11 2015 Aravinda VK <avishwan@redhat.com>
|
|
+- Added post hook for volume delete as part of glusterfind (#1225551)
|
|
|
|
* Wed May 27 2015 Aravinda VK <avishwan@redhat.com>
|
|
- Added stop-all-gluster-processes.sh in glusterfs-server section (#1204641)
|
|
--
|
|
1.8.3.1
|
|
|