From 711eae642cd318065f14b9f1fd94f0eb4b3b08fc Mon Sep 17 00:00:00 2001 From: Jia He Date: Thu, 9 Jan 2020 17:26:40 +0800 Subject: [PATCH] scripts: Set --enable-pie on aarch64 arch PIE (position-independent executables) does good to security. For some historical reason(compliation failure), it was disabled. But it can be supported now on aarch64. Fixes #926 Signed-off-by: Jia He --- scripts/configure-hypervisor.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/scripts/configure-hypervisor.sh b/scripts/configure-hypervisor.sh index 056602f615..1d61b10015 100755 --- a/scripts/configure-hypervisor.sh +++ b/scripts/configure-hypervisor.sh @@ -404,6 +404,11 @@ generate_qemu_options() { qemu_options+=(arch:"--target-list=${arch}-softmmu") fi + # aarch64 need to explictly set --enable-pie + if [ "${arch}" = "aarch64" ]; then + qemu_options+=(arch:"--enable-pie") + fi + _qemu_cflags="" # compile with high level of optimisation @@ -427,7 +432,7 @@ generate_qemu_options() { # and take advantage of ASLR, making ROP attacks much harder to perform. # (https://wiki.debian.org/Hardening) case "$arch" in - aarch64) _qemu_cflags+=" -fPIC" ;; + aarch64) _qemu_cflags+=" -fPIE" ;; x86_64) _qemu_cflags+=" -fPIE" ;; ppc64le) _qemu_cflags+=" -fPIE" ;; s390x) _qemu_cflags+=" -fPIE" ;; @@ -444,7 +449,7 @@ generate_qemu_options() { # and take advantage of ASLR, making ROP attacks much harder to perform. # (https://wiki.debian.org/Hardening) case "$arch" in - aarch64) ;; + aarch64) [ -z "${static}" ] && _qemu_ldflags+=" -pie" ;; x86_64) [ -z "${static}" ] && _qemu_ldflags+=" -pie" ;; ppc64le) [ -z "${static}" ] && _qemu_ldflags+=" -pie" ;; s390x) [ -z "${static}" ] && _qemu_ldflags+=" -pie" ;;