From ee6407728fa3cc43b32f69e88a4e0a5d28dc5235 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 14:06:34 +0200 Subject: Adding debian version 3.5.24-0+deb11u1. Signed-off-by: Daniel Baumann --- .../patches/12_add_bind_now_and_relro_to_pie.diff | 26 ++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 debian/patches/12_add_bind_now_and_relro_to_pie.diff (limited to 'debian/patches/12_add_bind_now_and_relro_to_pie.diff') diff --git a/debian/patches/12_add_bind_now_and_relro_to_pie.diff b/debian/patches/12_add_bind_now_and_relro_to_pie.diff new file mode 100644 index 0000000..0a16cbb --- /dev/null +++ b/debian/patches/12_add_bind_now_and_relro_to_pie.diff @@ -0,0 +1,26 @@ +Subject: add immediate binding and relro when enabling position independent + executables +Author: Steve Beattie + +When enabling position independent executables (-pie) to get better +Address Space Layout Protection, using immediate binding (linking with +"-z now") gives better protection as well. Added relro to the patch as well +since it seems to have gotten lost somewhere (ScottK/2016-07-29). + +--- + makedefs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: postfix/makedefs +=================================================================== +--- postfix.orig/makedefs ++++ postfix/makedefs +@@ -1219,7 +1219,7 @@ case "$pie" in + case " $CCARGS " in + *" $CCARGS_PIE "*) CCARGS_PIE=;; + esac +- SYSLIBS_PIE="-pie";; ++ SYSLIBS_PIE="-pie -z relro -z now";; + ""|no) ;; + *) error "Specify \"pie=yes\" or \"pie=no\"";; + esac -- cgit v1.2.3