From cd1a9e448cc2df8048bf00c83f68298c52111595 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Thu, 19 Mar 2015 11:36:06 -0400
Subject: [PATCH] Hardening changes: default to _hardened_build 0, link
 executables as -z now

  and PIE.  _hardened_build now only affects -z now for shared libraries.
---
 macros                 |  9 ++-------
 redhat-cc1             |  2 ++
 redhat-hardened-cc1    |  2 --
 redhat-hardened-ld     |  4 ++--
 redhat-ld              |  5 +++++
 redhat-rpm-config.spec | 13 +++++++++----
 6 files changed, 20 insertions(+), 15 deletions(-)
 create mode 100644 redhat-cc1
 delete mode 100644 redhat-hardened-cc1
 create mode 100644 redhat-ld

diff --git a/macros b/macros
index a197916..75b3800 100644
--- a/macros
+++ b/macros
@@ -123,18 +123,13 @@
 # Use XZ compression for binary payloads
 %_binary_payload w2.xzdio
 
-%_hardening_cflags	-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
 # we don't escape symbols '~', '"', etc. so be careful when changing this
 %_hardening_ldflags	-specs=/usr/lib/rpm/redhat/redhat-hardened-ld
 
-# Harden packages by default for Fedora 23:
-# https://fedorahosted.org/fesco/ticket/1384 (accepted on 2014-02-11)
-%_hardened_build	1
-%_hardened_cflags	%{?_hardened_build:%{_hardening_cflags}}
 %_hardened_ldflags	%{?_hardened_build:%{_hardening_ldflags}}
 
-%__global_cflags	-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches %{_hardened_cflags}
-%__global_ldflags	-Wl,-z,relro %{_hardened_ldflags}
+%__global_cflags	-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-cc1
+%__global_ldflags	-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-ld %{_hardened_ldflags}
 
 #==============================================================================
 # ---- Generic auto req/prov filtering macros
diff --git a/redhat-cc1 b/redhat-cc1
new file mode 100644
index 0000000..47b4792
--- /dev/null
+++ b/redhat-cc1
@@ -0,0 +1,2 @@
+*cc1_options:
++ %{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}
diff --git a/redhat-hardened-cc1 b/redhat-hardened-cc1
deleted file mode 100644
index 47b4792..0000000
--- a/redhat-hardened-cc1
+++ /dev/null
@@ -1,2 +0,0 @@
-*cc1_options:
-+ %{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}
diff --git a/redhat-hardened-ld b/redhat-hardened-ld
index 4e407b3..b653d6b 100644
--- a/redhat-hardened-ld
+++ b/redhat-hardened-ld
@@ -1,5 +1,5 @@
 *self_spec:
-+ %{!shared:-pie}
++ %{!r:%{!shared:-pie}}
 
 *link:
-+ -z now
++ %{!r:-z now}
diff --git a/redhat-ld b/redhat-ld
new file mode 100644
index 0000000..6e9940d
--- /dev/null
+++ b/redhat-ld
@@ -0,0 +1,5 @@
+*self_spec:
++ %{!r:%{!shared:-pie}}
+
+*link:
++ %{!r:%{!shared:-z now}}
diff --git a/redhat-rpm-config.spec b/redhat-rpm-config.spec
index 87581fe..8fe62a2 100644
--- a/redhat-rpm-config.spec
+++ b/redhat-rpm-config.spec
@@ -6,7 +6,7 @@
 
 Summary: Red Hat specific rpm configuration files
 Name: redhat-rpm-config
-Version: 28
+Version: 29
 Release: 1%{?dist}
 # No version specified.
 License: GPL+
@@ -18,8 +18,9 @@ Source0: macros
 Source1: rpmrc
 
 # gcc specs files for hardened builds
-Source50: redhat-hardened-cc1
-Source51: redhat-hardened-ld
+Source50: redhat-cc1
+Source51: redhat-ld
+Source52: redhat-hardened-ld
 
 # The macros defined by these files are for things that need to be defined
 # at srpm creation time when it is not feasible to require the base packages
@@ -92,7 +93,7 @@ cp -p %{sources} .
 %install
 mkdir -p %{buildroot}%{rrcdir}
 install -p -m 644 -t %{buildroot}%{rrcdir} macros rpmrc
-install -p -m 444 -t %{buildroot}%{rrcdir} redhat-hardened-*
+install -p -m 444 -t %{buildroot}%{rrcdir} %{SOURCE50} %{SOURCE51} %{SOURCE52}
 install -p -m 755 -t %{buildroot}%{rrcdir} config.*
 install -p -m 755 -t %{buildroot}%{rrcdir} dist.sh rpmsort symset-table kmodtool
 install -p -m 755 -t %{buildroot}%{rrcdir} brp-*
@@ -135,6 +136,10 @@ install -p -m 755 -t %{buildroot}%{_rpmconfigdir} kmod.prov
 %{_rpmconfigdir}/macros.d/macros.kmp
 
 %changelog
+* Wed Mar 25 2015 Adam Jackson <ajax@redhat.com> 29-1
+- Hardening changes: default _hardened_build off, link executables as -z now
+  and PIE.  _hardened_build now only affects -z now for shared libraries.
+
 * Thu Feb 19 2015 Till Maas <opensource@till.name> - 28-1
 - Enable harden flags by default (#1192183)
 
-- 
1.9.3

