User:Kevin/DRAFT When to use PIE compiler flags

This page is a DRAFT
This page is a draft, please don't follow it until it's no longer a draft

Introduction

PIE (Position Independent Executables) are binaries that are made entirely from position-independent code. This allows for address space layout randomization, increasing security and making some attacks much more difficult.

Advantages

• Binaries are more difficult to attack/compromise.

Disadvantages

• You can no longer use prelink on your binaries, resulting in a slower startup time.

Guideline

All Fedora Packages should use the default Fedora Compilation flags as listed on the http://fedoraproject.org/wiki/Packaging/RPMMacros#Build_flags_macros_and_variables page. Overriding these flags for performance optimizations (for instance, -O3 instead of -O2) is generally discouraged (if you can present benchmarks that show a significant speedup for this particular code, this could be revisited on a case-by-case basis). There are certain, security related flags that are commonly allowed. These flags may degrade performance slightly but the increased security can be worthwhile for some programs.

PIE

PIE adds security to executables by [FIXME: Fill in briefly how PIE works]

To add these flags, use something like this:

FIXME: Add macros when available.

FESCo maintains a list of packages that must have PIE turned on. See #FESCo list side for which packages require which flags.

If you package meets the following critera you should consider enabling the PIE compiler flags:

• Your package is long running. This means it's likely to be started and keep running until the machine is rebooted, not start on demand and quit on idle.

• Your package has suid binaries, or binaries with capabilities.

• Your package runs as root.

• Your package accepts/processes untrusted input.

There are some notable disadvantages to enabling PIE that should be considered in making the decision:

• Some code does not compile with PIE (or does not function properly).

• You can not use prelink on PIE enabled binaries, resulting in a slower startup time.

FESCo list side

NOTE: this will be in another page:

FESCo maintains a list of packages that they require to have certain additional compilation flags enabled. See [Page TBD] for which packages require which flags. This page will contain:

systemd

mingetty

udevd

rsyslog

abrtd

NetworkManager

ntpd

acpid

openssh

gdm

sendmail

postfix

exim

references

http://en.wikipedia.org/wiki/Position-independent_code

https://fedorahosted.org/fesco/ticket/563

https://fedorahosted.org/fpc/ticket/93

http://wiki.debian.org/Hardening

https://wiki.ubuntu.com/Security/Features

https://wiki.ubuntu.com/Security/Features#Built_as_PIE