# hardened xorg-x11

## pennedinil

I was able to get xorg to compile with 

USE+="hardened pic" 

and 

CFLAGS+="-fstack-protector"

But I couldn't get the X server to start. I'm using binary nvidia drivers and I was getting a bunch of messages about missing symbols in nvidia.o. I tried downgrading/upgrading nvidia-kernel & nvidia-glx, but that didn't help. 

I also re-emerged xorg with and without -fstack-protector but couldn't get X to load my nvidia driver.

I finally compiled xorg with 

USE="-hardened -pic" 

and no -fstack-protector in CCFLAGS. I have X server up and running now, but I was wondering if anyone else had experienced similar problems, or if I was just doing soimething wrong. 

My CCFLAGS settings are quite conservative -

CFLAGS="-pipe -O2 -march=pentium4 -fomit-frame-pointers -ftracer"

Anyone else with similar experiences?

EDIT: 

Fixed issue with Xorg-x11, but I don't think it's the right approach. Only consolation is that now Xorg-x11 works.

I had to change -

1. USE="-hardened -pie -pic"

2. CFLAGS="... -fno-stack-protector -fno-PIE -fno-PIC"

3. Edit ebuild so it would not strip out the above options from CFLAGS

Means Xorg-x11 has none of the SSP or PIE security built into it. But it now works!

I know some claims have been made that -fstack-protector will not break xorg-x11, but I tried comparing the logs/stderrs generated with and without the above flags, and I feel much more comfortable just removing all of the security flags.

EDIT: (on 19-10-2004)

More an update for latest Xorg. 

With the hardened toolchain, CFLAGS need to be stripped of -fPIE (or -fpie) and replaced with -fno-pie. I also added -DPIC because supposedly this makes the builds more robust. Seems to be working fine thus far.

And yes, -fstack-protector can be left in CFLAGS.Last edited by pennedinil on Tue Oct 19, 2004 6:53 pm; edited 2 times in total

----------

## asimon

Looks like Bug 47197: xorg-x11 and xfree break with PIE / dlloader, showing unresolved symbols.

BTW compiling with -fstack-protector is fine (It's running here with stack-protector), it's hardened/pie which break things.

----------

## revo

well, for me it seems compiling with -fstack-protector is _not_ fine, cause i am unable to start the X server when compiled with this.

the last output was:

Symbol __guard from module /usr/X11R6/lib/modules/fonts/libbitmap.a is unresolved!

Symbol __stack_smash_handler from module /usr/X11R6/lib/modules/fonts/libbitmap.a is unresolved!

Symbol __guard from module /usr/X11R6/lib/modules/fonts/libbitmap.a is unresolved!

Symbol __guard from module /usr/X11R6/lib/modules/fonts/libbitmap.a is unresolved!

btw, i don't use any binary nvidia-drivers, just plain nv driver.

----------

## Target

Exact same errors as revo, using either nvidia or nv driver.

----------

## reeder

After reading this week's newsletter about -fstack-protector I added it to my CFLAGS and did my normal weekly update.  xorg-x11-6.7.0-r2 was new and got emerged.  But restarting X failed with the errors about the symbols __guard and __stack_smash_handler being unresolved in libbitmap.a.

Removing -fstack-protector and re-emerging xorg-x11 solved the problem.

My CFLAGS are "-O2 -march=athlon-xp -fomit-frame-pointer"

I suspect that the problem is with some other thing that depends on libbitmap wasn't compiled with -fstack-protector and that recompiling it would solve the problem.  But how do you find out what that is?

I like the idea of protecting myself from common programming errors and would like to be able to use -fstack-protector.

-- William

----------

## didl

Have a look at

http://www.gentoo.org/proj/en/hardened/hardenedxorg.xml

Pretty much, if you use the hardened toolchain you either

have to compile X statically (which works) or use the dlloader 

and fiddle with the modules section (which might or might not work)

in your xorg.conf.

----------

## reeder

Thanks!  I'm not using the hardened toolchain, just the -fstack-protector flag.  But I'll try the static linking and see if that helps.  I'll post the results when I'm done.

-- William

----------

## haz3l

https://forums.gentoo.org/viewtopic.php?t=230443

for nvidia problems

----------

## reeder

didl, I put -fstack-protector back in my CFLAGS and recompiled xorg-x11 statically (directions in the link you referenced) and it seems to have worked.

THANKS!

Just in case anyone is wondering, my kernel is 2.6.7-gentoo-r11 (from gentoo-dev-sources) and I'm still using the nv driver for my ancient nvidia card.

Thanks again,

-- William

----------

