- up to s20121114

[packages/iputils.git] / iputils-bindnow.patch

Since these binaries are going to be setuid root, we want 
don't want to allow lazy bindings, otherwise we allow some 
information leakage.

http://bugs.gentoo.org/77526

--- iputils-s20121106/Makefile.orig	2012-11-11 19:29:39.752768719 +0100
+++ iputils-s20121106/Makefile	2012-11-11 19:32:42.666094377 +0100
@@ -55,7 +55,7 @@
 
 # arping
 arping: arping.o
-	$(LINK.o) $^ $(LIB_SYSFS) $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@
+	$(LINK.o) $^ $(LIB_SYSFS) $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@ -Wl,-z,now -Wl,-z,relro
 
 # clockdiff
 clockdiff: clockdiff.o
@@ -63,9 +63,9 @@
 
 # ping / ping6
 ping: ping.o ping_common.o
-	$(LINK.o) $^ $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@
+	$(LINK.o) $^ $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@ -Wl,-z,now -Wl,-z,relro
 ping6: ping6.o ping_common.o
-	$(LINK.o) $^ -lresolv -lcrypto $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@
+	$(LINK.o) $^ -lresolv -lcrypto $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@ -Wl,-z,now -Wl,-z,relro
 ping6.o: ping_common.h in6_flowlabel.h
 ping.o ping_common.o: ping_common.h
 
 # rarpd
@@ -80,7 +80,7 @@
 
 # traceroute6
 traceroute6: traceroute6.o
-	$(LINK.o) $^ $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@
+	$(LINK.o) $^ $(LIB_CAP) $(LIB_IDN) $(LDLIBS) -o $@ -Wl,-z,now -Wl,-z,relro
 
 # tftpd
 tftpd: tftpd.o tftpsubs.o