[sudo-users] [BUG] Another system (solaris 10 sparc) requires --disable-pie flag

[Christian Jullien]

Maybe here is the culprit?

Given:
#include <stdlib.h>
#include <stdio.h>
int
main()
{
  return printf("malloc %p\n", malloc(100));
}

I get:
[jullien at pastre]src$ gcc -o foo -pie foo.c && ./foo
malloc 0
[jullien at pastre]src$ gcc -o foo foo.c && ./foo
malloc 20918

Now the question, why do you link the binaries with -pie ? as in

/bin/bash ../libtool --tag=disable-static --mode=link gcc -m64 -mptr64
-mcpu=v9 -o sudo conversation.o env_hooks.o exec.o exec_common.o exec_pty.o
get_pty.o hooks.o net_ifs.o load_plugins.o parse_args.o signal.o sudo.o
sudo_edit.o tgetpass.o ttyname.o utmp.o  solaris.o locale_stub.o
-Wl,-z,relro -pie -Wc,-fstack-protector-all -lsocket -lnsl
../common/libcommon.la ../compat/libreplace.la

To me, -pie is only needed for .so, right?

When you link with or without -pie, binary size is about the same (378240
V.S. 377808 if -pie) and use exactly the same .so dependencies

 [jullien at pastre]src$ ldd sudo                            # either with or
without -pie
        libsocket.so.1 =>        /lib/libsocket.so.1
        libnsl.so.1 =>   /lib/libnsl.so.1
        libssp.so.0 =>   /usr/local/lib/libssp.so.0
        libc.so.1 =>     /lib/libc.so.1
        libgcc_s.so.1 =>         /usr/local/lib/libgcc_s.so.1
        libmp.so.2 =>    /lib/libmp.so.2
        libmd.so.1 =>    /lib/libmd.so.1
        libscf.so.1 =>   /lib/libscf.so.1
        libdoor.so.1 =>  /lib/libdoor.so.1
        libuutil.so.1 =>         /lib/libuutil.so.1
        libgen.so.1 =>   /lib/libgen.so.1
        libm.so.2 =>     /lib/libm.so.2
        /platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
        /platform/SUNW,Ultra-5_10/lib/libmd_psr.so.1

When I remove  manually -pie only for sudo link it works.

My suggestion is to compile all files with -pie (when configured with -pie),
link with -pie the .so you want to create and -remove -pie for binary tools
(sudo, visudo ...)

WDYT ?

C.

-----Original Message-----
From: Todd C. Miller [mailto:Todd.Miller at courtesan.com] 
Sent: jeudi 23 mai 2013 15:41
To: Christian Jullien
Cc: sudo-users at sudo.ws
Subject: Re: [sudo-users] [BUG] Another system (solaris 10 sparc) requires
--disable-pie flag

On Wed, 15 May 2013 21:23:09 +0200, "Christian Jullien" wrote:

> In case it helps, here is the result of truss sudo when I don't 
> compile with
> --disable-pie:

That trace looks quite different from what I see.  I don't have any
lwp_create in my trace, but I an running an older Solaris 10 patch level.
The placement of the bad brk() call is suspiciously close to where
methods_unicode.so.3 is loaded.

Can you try building with --disable-nls but with PIE enabled and see if that
changes anything?

 - todd