adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Building ZNC with PIE/PIC #945

New Issue
Closed
opened 2026-10-05 04:54:28 +02:00 by adam · 15 comments
adam commented 2026-10-05 04:54:28 +02:00
Owner
Copy link
Copy source

I couldn't find this documented anywhere but I'd like to harden by ZNC build and thus enable PIC/PIE, is there a nice way to do this or I have to manually edit (c)makefiles?

I couldn't find this documented anywhere but I'd like to harden by ZNC build and thus enable PIC/PIE, is there a nice way to do this or I have to manually edit (c)makefiles? <!-- github-sync-id:619502544 -->
adam closed this issue 2026-10-05 04:54:28 +02:00
adam commented 2026-10-05 04:54:29 +02:00
Author
Owner
Copy link
Copy source

According to a quick Google search, passing -DPOSITION_INDEPENDENT_CODE=ON to cmake should do the trick.

 cmake --help-variable CMAKE_POSITION_INDEPENDENT_CODE
CMAKE_POSITION_INDEPENDENT_CODE
-------------------------------

Default value for ``POSITION_INDEPENDENT_CODE`` of targets.

This variable is used to initialize the
``POSITION_INDEPENDENT_CODE`` property on all the targets.
See that target property for additional information.  If set, it's
value is also used by the ``try_compile()`` command.
According to a quick Google search, passing `-DPOSITION_INDEPENDENT_CODE=ON` to `cmake` should do the trick. ``` cmake --help-variable CMAKE_POSITION_INDEPENDENT_CODE CMAKE_POSITION_INDEPENDENT_CODE ------------------------------- Default value for ``POSITION_INDEPENDENT_CODE`` of targets. This variable is used to initialize the ``POSITION_INDEPENDENT_CODE`` property on all the targets. See that target property for additional information. If set, it's value is also used by the ``try_compile()`` command. ``` <!-- github-comment-id:629666896 -->
adam commented 2026-10-05 04:54:30 +02:00
Author
Owner
Copy link
Copy source

You can also set CXXFLAGS/LDFLAGS environment variables to something like -pie -fPIC (I don't remember which of them is passed where)

You can also set `CXXFLAGS`/`LDFLAGS` environment variables to something like `-pie -fPIC` (I don't remember which of them is passed where) <!-- github-comment-id:629667243 -->
adam commented 2026-10-05 04:54:31 +02:00
Author
Owner
Copy link
Copy source

You can also set CXXFLAGS/LDFLAGS environment variables to something like -pie -fPIC (I don't remember which of them is passed where)

This causes modules to be built with PIE which causes issues, or executables with PIC, which also causes issues.

-DPOSITION_INDEPENDENT_CODE=ON

I'll try this.

> You can also set CXXFLAGS/LDFLAGS environment variables to something like -pie -fPIC (I don't remember which of them is passed where) This causes modules to be built with PIE which causes issues, or executables with PIC, which also causes issues. > -DPOSITION_INDEPENDENT_CODE=ON I'll try this. <!-- github-comment-id:629667483 -->
adam commented 2026-10-05 04:54:31 +02:00
Author
Owner
Copy link
Copy source

-DPOSITION_INDEPENDENT_CODE=ON

"Manually-specified variables were not used for this project."

I suspect this is something ZNC has to specifically support.

> -DPOSITION_INDEPENDENT_CODE=ON "Manually-specified variables were not used for this project." I suspect this is something ZNC has to specifically support. <!-- github-comment-id:629668195 -->
adam commented 2026-10-05 04:54:32 +02:00
Author
Owner
Copy link
Copy source

This causes modules to be built with PIE which causes issues, or executables with PIC, which also causes issues.

Can you be more specific?

> This causes modules to be built with PIE which causes issues, or executables with PIC, which also causes issues. Can you be more specific? <!-- github-comment-id:629689054 -->
adam commented 2026-10-05 04:54:33 +02:00
Author
Owner
Copy link
Copy source

Can you be more specific?

When built with:

CFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,z,now" CXXFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,-z,now" LDFLAGS="-pie -z,noexecstack -z,noexecheap -z,relro -z,now" cmake .. -DCMAKE_CXX_COMPILER="g++-8" -DCMAKE_C_COMPILER="gcc-8"

It errors out like this:

[ .. ] Checking for list of available modules...
[ !! ] failed
[ ** ] No modules found. Perhaps you didn't install ZNC properly?
[ ** ] Read https://wiki.znc.in/Installation for instructions.
[ ?? ] Do you really want to run ZNC without any modules? (yes/no) [no]: yes
[ .. ] Opening config [/usr/local/share/znc/.znc/configs/znc.conf]...
[ ** ] Found old config from ZNC 1.7.1. Saving a backup of it.
[ .. ] Creating a config backup...
[ !! ] File exists
[ .. ] Loading global module [certauth]...
[ !! ] Could not find ZNCModuleEntry in module certauth
[ ** ] Unrecoverable config error.

Without -pie and -fPIE it compiles and runs nicely.

> Can you be more specific? When built with: ``` CFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,z,now" CXXFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,-z,now" LDFLAGS="-pie -z,noexecstack -z,noexecheap -z,relro -z,now" cmake .. -DCMAKE_CXX_COMPILER="g++-8" -DCMAKE_C_COMPILER="gcc-8" ``` It errors out like this: ``` [ .. ] Checking for list of available modules... [ !! ] failed [ ** ] No modules found. Perhaps you didn't install ZNC properly? [ ** ] Read https://wiki.znc.in/Installation for instructions. [ ?? ] Do you really want to run ZNC without any modules? (yes/no) [no]: yes [ .. ] Opening config [/usr/local/share/znc/.znc/configs/znc.conf]... [ ** ] Found old config from ZNC 1.7.1. Saving a backup of it. [ .. ] Creating a config backup... [ !! ] File exists [ .. ] Loading global module [certauth]... [ !! ] Could not find ZNCModuleEntry in module certauth [ ** ] Unrecoverable config error. ``` Without `-pie` and `-fPIE` it compiles and runs nicely. <!-- github-comment-id:629705964 -->
adam commented 2026-10-05 04:54:33 +02:00
Author
Owner
Copy link
Copy source
$ rm -rf *
$ export CXXFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,-z,now" LDFLAGS="-pie -z,noexecstack -z,noexecheap -z,relro -z,now"
$ cmake .. -DCMAKE_INSTALL_PREFIX=/tmp/znc
...
$ make -j20 install && /tmp/znc/bin/znc -D
...
[ .. ] Loading user module [alias]...                                                                                                                                                                                                                                             
[ ** ] Staying open for debugging [pid: 2054]                                                                                                                                                                                                                                     
[ ** ] ZNC 1.9.x-git-16-3bd7c899 - https://znc.in

The only warning I see is this:

/usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,noexecstack игнорируется                                                                                                                                                              
/usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,noexecheap игнорируется                                                                                                                                                               
/usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,relro игнорируется                                                                                                                                                                    
/usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,now игнорируется                                                                                                                                                                      
/usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z noexecheap игнорируется
``` $ rm -rf * $ export CXXFLAGS="-O3 -fstack-protector-all -fPIE -D_FORTIFY_SOURCE=2 -fstack-clash-protection -mtune=native -march=native -Wl,-z,noexecstack,-z,noexecheap,-z,relro,-z,now" LDFLAGS="-pie -z,noexecstack -z,noexecheap -z,relro -z,now" $ cmake .. -DCMAKE_INSTALL_PREFIX=/tmp/znc ... $ make -j20 install && /tmp/znc/bin/znc -D ... [ .. ] Loading user module [alias]... [ ** ] Staying open for debugging [pid: 2054] [ ** ] ZNC 1.9.x-git-16-3bd7c899 - https://znc.in ``` The only warning I see is this: ``` /usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,noexecstack игнорируется /usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,noexecheap игнорируется /usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,relro игнорируется /usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z ,now игнорируется /usr/lib/gcc/x86_64-pc-linux-gnu/9.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: warning: -z noexecheap игнорируется ``` <!-- github-comment-id:629856337 -->
adam commented 2026-10-05 04:54:34 +02:00
Author
Owner
Copy link
Copy source
$ file /tmp/znc/bin/znc
/tmp/znc/bin/znc: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped
``` $ file /tmp/znc/bin/znc /tmp/znc/bin/znc: ELF 64-bit LSB pie executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, with debug_info, not stripped ``` <!-- github-comment-id:629856518 -->
adam commented 2026-10-05 04:54:35 +02:00
Author
Owner
Copy link
Copy source

Even -DPOSITION_INDEPENDENT_CODE=ON is enough to produce that result.

Even `-DPOSITION_INDEPENDENT_CODE=ON` is enough to produce that result. <!-- github-comment-id:629858168 -->
adam commented 2026-10-05 04:54:36 +02:00
Author
Owner
Copy link
Copy source

export CXXFLAGS=

What about CFLAGS?

Even -DPOSITION_INDEPENDENT_CODE=ON is enough to produce that result.

If cmake says it wasn't used I don't see how that's possible.

> export CXXFLAGS= What about CFLAGS? > Even -DPOSITION_INDEPENDENT_CODE=ON is enough to produce that result. If cmake says it wasn't used I don't see how that's possible. <!-- github-comment-id:629864227 -->
adam commented 2026-10-05 04:54:36 +02:00
Author
Owner
Copy link
Copy source

Oh, and I have to mention, the entire build folder had to be removed, otherwise the changes in C(XX)FLAGS did not apply properly.

Oh, and I have to mention, the entire build folder had to be removed, otherwise the changes in C(XX)FLAGS did not apply properly. <!-- github-comment-id:629864353 -->
adam commented 2026-10-05 04:54:37 +02:00
Author
Owner
Copy link
Copy source

What cmake version?

What cmake version? <!-- github-comment-id:629866241 -->
adam commented 2026-10-05 04:54:37 +02:00
Author
Owner
Copy link
Copy source

What about CFLAGS?

ZNC doesn't use C

> What about CFLAGS? ZNC doesn't use C <!-- github-comment-id:629866263 -->
adam commented 2026-10-05 04:54:38 +02:00
Author
Owner
Copy link
Copy source

What cmake version?

cmake version 3.10.2

> What cmake version? `cmake version 3.10.2` <!-- github-comment-id:629866749 -->
adam commented 2026-10-05 04:54:39 +02:00
Author
Owner
Copy link
Copy source

https://cmake.org/cmake/help/latest/policy/CMP0083.html

CMake 3.13 and lower did not add these link flags when POSITION_INDEPENDENT_CODE is set.

https://cmake.org/cmake/help/latest/policy/CMP0083.html > CMake 3.13 and lower did not add these link flags when POSITION_INDEPENDENT_CODE is set. <!-- github-comment-id:629867968 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#945