Making use of "-z relro"

[Leomania]

I've been unable to find any description of how to use the "-z relro" linker option in the PaX-patched version of binutils. Is this simply added to the LDFLAGS variable for any executables that a user chooses to build *after* binutils is patched, compiled and installed? Are there specific applications that benefit from it more than others, for instance PHP?

Thanks in advance for any light you might shed on this.

[PaX Team]

I've been unable to find any description of how to use the "-z relro" linker option in the PaX-patched version of binutils. Is this simply added to the LDFLAGS variable for any executables that a user chooses to build *after* binutils is patched, compiled and installed? Are there specific applications that benefit from it more than others, for instance PHP?

Thanks in advance for any light you might shed on this.

normally it's the distro's job to make use of all these toolchain features, but if you want to cook your own system, i suggest that you at least take a look at what hardened gentoo http://www.gentoo.org/proj/en/hardened/ (also check the FAQ) or hardened LFS do http://www.linuxfromscratch.org/hlfs/view/unstable/.

first, the PaX patch for binutils is only for emitting the PT_PAX_FLAGS program header, it's independent of -z relro which has been in binutils since 2.15 or so now. second, since -z relro (and don't forget -z now) is a linker switch, you obviously need to pass it to the linker, whether that's via LDFLAGS or CFLAGS depends on what your system/packages take. in general the easiest way is to pass it through the gcc specs file so you don't have to modify anything else.