[SOLVED]Do we have the plan about adding option -fPIE? lazarus / 64-FPC development ---------------------------------------------------------------------- TYDQ · 2024-08-07 07:57 gcc's -fPIE option can make the executable loading position independent.It is important that loaded executable files cannot to be affected by other loaded executable files.Do our fpc development team has the plan to add this for further version? ---------------------------------------------------------------------- paweld · 2024-08-07 08:04 @TYDQ: I think you can get answers to your questions faster on the mailing list - you have links in the left menu of the page ---------------------------------------------------------------------- MarkMLl · 2024-08-07 08:09 I've attempted to make that point more than once. MarkMLl ---------------------------------------------------------------------- marcov · 2024-08-07 08:24 FPC already has that as "-Cg". ---------------------------------------------------------------------- MarkMLl · 2024-08-07 08:33 Quote from: marcov on August 07, 2024, 10:24:18 amFPC already has that as "-Cg". Frankly I /thought/ there was. The problem appears to be that looking at help output Code: [Select]-Cg        Generate PIC code Ditto in the documentation at https://www.freepascal.org/docs- html/current/user/userap1.html#x171-178000A so it certainly doesn't spring out when one does the sort of quick check I tried earlier... since there's a whole line available I thing the term could usefully be given in full rather than as an acronym. MarkMLl ---------------------------------------------------------------------- H₂SO₄ · 2024-08-07 08:37 Quote from: marcov on August 07, 2024, 10:24:18 amFPC already has that as "-Cg". PIC ≠ PIE  though, right? AFAIK the key thing about position- independent executables is that they are loaded to a different, randomized base address each time they run (ASLR), which in turn requires that the executable be composed entirely of position- independent code. ---------------------------------------------------------------------- MarkMLl · 2024-08-07 08:57 Quote from: Khrys on August 07, 2024, 10:37:32 amQuote from: marcov on August 07, 2024, 10:24:18 amFPC already has that as "-Cg". PIC ≠ PIE  though, right? AFAIK the key thing about position- independent executables is that they are loaded to a different, randomized base address each time they run (ASLR), which in turn requires that the executable be composed entirely of position- independent code. But I think that's what OP's asking about... and https://gcc.gnu.org/onlinedocs/gcc-3.2/gcc/Code-Gen- Options.html#Code%20Gen%20Options discussed -fpic and fPIC options with no mention of -fPIE. MarkMLl ---------------------------------------------------------------------- marcov · 2024-08-07 09:44 I also quickly researched, but found no definitive answer. Still it seems to me that -fpie is simply passed to the linker on the final link to set some tags in the ELF header. So compiling everything with -Cg, and passing -k-pie to the final link might work, give it a try. ---------------------------------------------------------------------- Thaddy · 2024-08-07 10:44 It might work with an external linker, Marco? or does the internal linker support that too? ---------------------------------------------------------------------- marcov · 2024-08-07 11:11 Quote from: Thaddy on August 07, 2024, 12:44:58 pmIt might work with an external linker, Marco? or does the internal linker support that too? I assumed this was about ELF, where there is an alpha stage internal linker, but default is external. Afaik win64 EXEs are always position independent. ---------------------------------------------------------------------- dbannon · 2024-08-07 11:25 Yes, it does work (sorry for an image instead of text, its in a vm and I'm away from home). EDIT: posted too early ! FPCHARD=" -Cg  -k-pie -k-znow " .... Include $FPCHARD on the fpc command line. As you say, its passed to the linker. Seems to work on all except POWER64el Davo ---------------------------------------------------------------------- TYDQ · 2024-08-07 11:28 Quote from: marcov on August 07, 2024, 10:24:18 amFPC already has that as "-Cg". Cg is -fPIC(Position independent code),when PIC object files linked to executable or shared library by linker,they will be not Position independent. -fPIE is Position independent executable,it is not the same as just compiling position independent object files. Do you mean it(the -Cg) is same as -fPIE in fpc in linux? ---------------------------------------------------------------------- TYDQ · 2024-08-07 11:30 Quote from: marcov on August 07, 2024, 11:44:06 amI also quickly researched, but found no definitive answer. Still it seems to me that -fpie is simply passed to the linker on the final link to set some tags in the ELF header. So compiling everything with -Cg, and passing -k-pie to the final link might work, give it a try. Thank you for telling me a new method to make the executable which is PIE. ---------------------------------------------------------------------- dbannon · 2024-08-07 11:38 My app has been 'PIE' in Debian for several years. I don't do it to the binaries I compile and ship myself because of a measurable (but not really noticeable) slow down. But Debian demand it. I don't think its really necessary on an app that is used on a personal desktop, most certainly is necessary on a shared system or server. But my app is hardly likely to be running on such as system. Davo ---------------------------------------------------------------------- Thaddy · 2024-08-07 12:20 It needs both -Cg and -k-pie, but indeed it works like a charm. Examined with readelf -d -r ---------------------------------------------------------------------- Fred vS · 2024-08-07 13:41 I use this and it works for all my Unix releases (Linux, FreeBSD, NetBSD, MacOs): Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i -Cg -k-pie -k-znow I only have problems with OpenBSD amd64/aarch64, here the result dont show a pie executable. ---------------------------------------------------------------------- MarkMLl · 2024-08-07 13:46 Without wanting to divert the thread, I can confirm that -k (or the equivalent, as shown, from the Lazarus IDE) is useful for all sorts of things. The important thing is no extra spaces, and the right number of dashes as required by the linker. MarkMLl ---------------------------------------------------------------------- dbannon · 2024-08-08 05:08 Proper hardening needs -  -Cg  -k-pie -k-znow As I mentioned above. And demonstrated with (any recent) 'file' command. Davo ---------------------------------------------------------------------- TYDQ · 2024-08-20 15:33 Quote from: dbannon on August 08, 2024, 07:08:01 amProper hardening needs -  -Cg  -k-pie -k-znow As I mentioned above. And demonstrated with (any recent) 'file' command. Davo I was told that there is a -static-pie option in gcc,Do we have the plan that adding -static-pie? ---------------------------------------------------------------------- dbannon · 2024-08-20 23:35 While obviously I have no idea whats planned its worth noting that those PIE options are not there for FPC, they are passed directly to the linker. Maybe the same applies to -statis-pie ? Further research is indicated .... Davo ---------------------------------------------------------------------- TYDQ · 2024-08-21 00:10 Quote from: dbannon on August 21, 2024, 01:35:45 amWhile obviously I have no idea whats planned its worth noting that those PIE options are not there for FPC, they are passed directly to the linker. Maybe the same applies to -statis-pie ? Further research is indicated .... Davo However,the linker's(ld's) -static-pie option is depracated now,I don't know why depracate that. But gcc still have this option. ---------------------------------------------------------------------- TYDQ · 2024-08-22 10:16 Quote from: dbannon on August 21, 2024, 01:35:45 amWhile obviously I have no idea whats planned its worth noting that those PIE options are not there for FPC, they are passed directly to the linker. Maybe the same applies to -statis-pie ? Further research is indicated .... Davo I have discovered that combine -k-pie -k--no-dynamic-linker can make static pie.