#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) ----------------------------------------+---------------------------------- Reporter: nomeata | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC failed | Unknown/Multiple Test Case: | Difficulty: Unknown Blocking: | Blocked By: | Related Tickets: ----------------------------------------+---------------------------------- Comment (by nomeata): Yes, without the hardening flags it builds. So it is likely caused by 2aa78106ae8f3c9b71d7b85c2a8a5558c4c35fb4. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:2 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) ----------------------------------------+---------------------------------- Reporter: nomeata | Owner: simonmar Type: bug | Status: new Priority: high | Milestone: 7.8.3 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC failed | Unknown/Multiple Test Case: | Difficulty: Unknown Blocking: | Blocked By: | Related Tickets: ----------------------------------------+---------------------------------- Changes (by simonmar): * owner: => simonmar * priority: normal => high * milestone: => 7.8.3 Comment: Milestoning 7.8.3 since this patch was merged into the 7.8 branch too. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:4 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) ----------------------------------------+---------------------------------- Reporter: nomeata | Owner: Type: bug | Status: infoneeded Priority: high | Milestone: 7.8.3 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC failed | Unknown/Multiple Test Case: | Difficulty: Unknown Blocking: | Blocked By: | Related Tickets: ----------------------------------------+---------------------------------- Changes (by nomeata): * owner: simonmar => Comment: I’ll work on it when I find the time. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:6 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) ----------------------------------------+---------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: new Priority: high | Milestone: 7.8.3 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC failed | Unknown/Multiple Test Case: | Difficulty: Unknown Blocking: | Blocked By: | Related Tickets: ----------------------------------------+---------------------------------- Changes (by nomeata): * owner: => nomeata Comment: (Sorry for the multiple changes, but I don’t the the permissions to assign the ticket to me otherwise.) -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:8 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) ----------------------------------------+---------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: infoneeded Priority: high | Milestone: 7.8.4 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC failed | Unknown/Multiple Test Case: | Difficulty: Unknown Blocking: | Blocked By: | Related Tickets: ----------------------------------------+---------------------------------- Comment (by rwbarton): I managed to reproduce this by making a Frankenpackage from ghc HEAD plus the debian directory from `apt-get source ghc`. Here are the flags that are being used: {{{ rwbarton@morphism:/tmp$ ghc -optl-fPIE -optl-pie -optl-Wl,-z,relro -optl- Wl,-z,now test [1 of 1] Compiling Main ( test.hs, test.o ) Linking test ... /usr/bin/ld: test.o: relocation R_X86_64_32S against `stg_bh_upd_frame_info' can not be used when making a shared object; recompile with -fPIC test.o: error adding symbols: Bad value collect2: error: ld returned 1 exit status }}} `-optl-pie` is the offending flag. (`test.hs` is just a trivial program `main = print "hi"`.) -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:11 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: infoneeded Priority: high | Milestone: 7.12.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Revisions: -------------------------------------+------------------------------------- Comment (by mitchty): It appears I'm hitting an instance of this, or a related case after porting ghc to Alpine Linux. Though the situation I'm encountering is slightly different, the error I see is the same as rwbarton noted earlier with the stg function. What I am seeing with a ghc --make test.hs compile of a really simple haskell program: https://gist.githubusercontent.com/mitchty/296be0fd030aba6aa7b5/raw/f8459935... If you note from that make.out example, stg_bh_upd_frame_info is not PIC after its been statically linked. To explain a bit more, Alpine linux is setup to compile with PIE executables by default, as well as PIC libraries. This can be changed for errant things which cannot use aslr if needed, but the default ABI requires PIE/PIC. Effectively Alpine linux is running the same as Debian when hardened. However if necessary you can use an escape hatch of -nopie -fno-PIC, which is how I had to port ghc. This presents a problem however, as it appears ghc will not emit PIC assembly in this case. Nor is there apparently an option to do so that one can toggle via configure or auto tools or editing the settings file directly to achieve that goal. What would appear to be needed here after chatting with rwbarton on irc is some way to have ghc emit PIC assembly on Linux x86_64 platforms when necessary. Note that in the case of Alpine Linux, we would want PIC/PIE to always be on. For Debian hardened that may not hold true in that ghc itself might need to be built as a pie executable but executables it creates in this situation may not need to be pie. As an example, gcc on Alpine Linux has the following macros set by default with no feature switches enabled to gcc: $ echo ";" | gcc -E -dD -c -| grep PIC #define __PIC__ 2 $ echo ";" | gcc -E -dD -c -| grep PIE #define __PIE__ 2 Also note, unlike the Debian hardening, there is no easy way to change these defaults outside of possibly recompiling gcc. From the discussion in irc the following two options seem reasonable: - Add a value to the settings file to control if ghc will emit PIC assembly by default or not - Possibly attempt to detect that the Linux in use requires PIC/PIE via some trick like the above gcc preprocessor dumps The latter may be a better option overall but I will need to compare against the other hardened linux flavors in all their possible settings. As an example Gentoo linux allows you to change the gcc hardened settings at run time, which would make detection of the "right" thing to do rather difficult. Similar behavior would apply to fedora as well. I'm not sure the correct way forward but for the moment a setting to adjust what type of assembly ghc emits would seem the best option. Right now I have to force all binaries to be nopie as a workaround to this issue. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:15 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: infoneeded Priority: high | Milestone: 7.12.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Revisions: -------------------------------------+------------------------------------- Comment (by slyfox): I propose to extent SysTools.hs:getCompilerInfo to detect PIC at ghc startup time as we do with gcc/clang and set fPIC default accordingly. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:17 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: infoneeded Priority: high | Milestone: 7.12.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Revisions: -------------------------------------+------------------------------------- Comment (by slyfox): Replying to [comment:18 rwbarton]:

If we do so should we apply the options from `-optc-foo` when doing this detection?

I was going to object that the C compiler options can vary between input files in a single compilation (with `OPTIONS_GHC`) though technically the same is true of the C compiler program and it looks like we don't currently handle that correctly either. Probably it would not be unreasonably difficult to redo the detection only when the program/options have actually changed.

Does the Debian (or Fedora/Gentoo) build system have some extra magic

I think we need to ignore -optc during autodetection and should check only vanilla pgmC. It should simplify meaning of ghc -fPIC -optc-fno-PIC. I would say ghc -fno-PIC should disable PIC for both gcc/ghc even if fPIC is a default. that makes all invocations of gcc produce PIC/PIE by default? Otherwise `ghc -optl-fPIE -optl-pie -optl-Wl,-z,relro -optl-Wl,-z,now` is not going to get the job done in any case, and the build systems will have to learn about how to specify either `-fPIC` or `-optc-fPIC` to `ghc` even if we do this autodetection and it uses the C compiler options. Hardened gentoo patches gcc to default to -fPIC -fPIE -pie. Defaults there: {{{ # gcc -dM -E - < /dev/null | grep -E -i 'pic|pie' #define __pie__ 2 #define __PIE__ 2 #define __pic__ 2 #define __PIC__ 2 }}} What bothers me is -optl-pie seems not to work even for -split-objs case on vanilla gcc/ghc: {{{ $ echo 'main = print "hello"' > a.hs $ ghc --make -optl-pie -fPIC -optc-fPIC -dynamic a.hs -fforce-recomp [1 of 1] Compiling Main ( a.hs, a.o ) Linking a ... $ ghc --make -optl-pie -fPIC -optc-fPIC -dynamic a.hs -fforce-recomp -split-objs [1 of 1] Compiling Main ( a.hs, a.o ) /usr/lib/gcc/x86_64-pc-linux-gnu/5.1.0/../../../../x86_64-pc-linux- gnu/bin/ld: -r and -shared may not be used together collect2: error: ld returned 1 exit status }}} An evil corner case as we use ld for partial linking. Can be an argument for native fPIE/pie support in ghc. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:19 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

Hardened gentoo patches gcc to default to -fPIC -fPIE -pie. Defaults

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: infoneeded Priority: high | Milestone: 7.12.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Revisions: -------------------------------------+------------------------------------- Comment (by kgardas): Replying to [comment:19 slyfox]: there:

{{{ # gcc -dM -E - < /dev/null | grep -E -i 'pic|pie' #define __pie__ 2 #define __PIE__ 2 #define __pic__ 2 #define __PIC__ 2 }}}

What bothers me is -optl-pie seems not to work even for -split-objs case on vanilla gcc/ghc: {{{ $ echo 'main = print "hello"' > a.hs $ ghc --make -optl-pie -fPIC -optc-fPIC -dynamic a.hs -fforce-recomp [1 of 1] Compiling Main ( a.hs, a.o ) Linking a ... $ ghc --make -optl-pie -fPIC -optc-fPIC -dynamic a.hs -fforce-recomp -split-objs [1 of 1] Compiling Main ( a.hs, a.o ) /usr/lib/gcc/x86_64-pc-linux-gnu/5.1.0/../../../../x86_64-pc-linux- gnu/bin/ld: -r and -shared may not be used together collect2: error: ld returned 1 exit status }}} An evil corner case as we use ld for partial linking. Can be an argument for native fPIE/pie support in ghc.

I'm curious but isn't -split-objs purely static library thing? IMHO it's not usable for -shared nor -dynamic nor -fPIC etc. Please correct me if I'm wrong here... -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:21 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: new Priority: high | Milestone: 8.0.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Rev(s): Wiki Page: | -------------------------------------+------------------------------------- Changes (by rwbarton): * status: infoneeded => new Comment: I don't know whether this will resolve the original issue, but I think we should implement slyfox's suggestion as described in comment:17 and comment:19. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:24 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: new Priority: high | Milestone: 8.2.1 Component: Compiler | Version: 7.9 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: | Differential Rev(s): Wiki Page: | -------------------------------------+------------------------------------- Changes (by erikd): * cc: erikd (added) -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:26 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler

#9007: fails to build with hardening flags enabled (relocation R_X86_64_32 against `stg_CHARLIKE_closure'...) -------------------------------------+------------------------------------- Reporter: nomeata | Owner: nomeata Type: bug | Status: closed Priority: high | Milestone: 8.2.1 Component: Compiler | Version: 7.9 Resolution: duplicate | Keywords: Operating System: Unknown/Multiple | Architecture: Type of failure: Building GHC | Unknown/Multiple failed | Test Case: Blocked By: | Blocking: Related Tickets: #12759 | Differential Rev(s): Wiki Page: | -------------------------------------+------------------------------------- Changes (by bgamari): * status: new => closed * resolution: => duplicate * related: => #12759 Comment: Indeed, I believe this should have been fixed by #12759. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9007#comment:28 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler