How to Compile Static Executables w/ PIE + SSP + BIND_NOW?

How to Compile Static Executables w/ PIE + SSP + BIND_NOW?

[Musl Questions]

[-- Attachment #1: Type: text/plain, Size: 676 bytes --]

Arch Linux. Example app: mksh. 

CC=musl-gcc
CFLAGS+=' -static'
export CC CFLAGS 
sh Build.sh -r -c lto

Using typical build flags:

CFLAGS="-march=amdfam15 -O2 -pipe -fstack-protector-all -fPIE"
LDFLAGS="-Wl,-z,now -Wl,-z,relro"

Does produce a static executable but without PIE or SSP. Have tried various options to no avail:

CFLAGS+=' -static -pie'

..with.. 

CFLAGS="-O2 -fstack-protector-strong"
LDFLAGS="-Wl,-z,now -Wl,-z,relro"
...and...

CFLAGS+=' -shared -pie -static'

..with.. 

CFLAGS="-O2 -fstack-protector-all"
LDFLAGS="-Wl,-z,now -Wl,-z,relro"
...and many other combos without success. How to create a static exe built against musl with PIE + SSP + BIND_NOW?

[-- Attachment #2: Type: text/html, Size: 1169 bytes --]

Re: How to Compile Static Executables w/ PIE + SSP + BIND_NOW?

[Rich Felker]

On Fri, Sep 09, 2016 at 03:49:16AM +0000, Musl Questions wrote:
> Arch Linux. Example app: mksh. 
> 
> CC=musl-gcc
> CFLAGS+=' -static'
> export CC CFLAGS 
> sh Build.sh -r -c lto

Generally -static belongs in LDFLAGS not CFLAGS, but mksh seems to
have an unusual build process so it's hard to be sure what it expects
without reading the source.

> Using typical build flags:
> 
> CFLAGS="-march=amdfam15 -O2 -pipe -fstack-protector-all -fPIE"
> LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> 
> Does produce a static executable but without PIE or SSP. Have tried
> various options to no avail:
> 
> CFLAGS+=' -static -pie'
> 
> ...with.. 
> 
> CFLAGS="-O2 -fstack-protector-strong"
> LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> ....and...
> 
> CFLAGS+=' -shared -pie -static'
> 
> ...with.. 
> 
> CFLAGS="-O2 -fstack-protector-all"
> LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> ....and many other combos without success. How to create a static
> exe built against musl with PIE + SSP + BIND_NOW?

SSP and the other issues are separate, so let's start with SSP. It
does not need any special link options and should work as long as you
compile with the right flags.

As for static pie, GCC does not support it upstream yet. If you have a
new enough binutils (2.26 or later, I think) it should have the option
which is needed to make static pie work, which is --no-dynamic-linker.
You can try adding to LDFLAGS:

	-pie -static-libgcc -Wl,-static -Wl,--no-dynamic-linker

I haven't tested this lately but I think it should work.

Alternatively you could use a dedicated musl-targeting toolchain with
the static pie support patches applied; musl-cross-make can produce
one for you.

Rich