freebsd-src/tools/build/options/WITH_BIND_NOW

Build all binaries with the
.Dv DF_BIND_NOW
flag set to indicate that the run-time loader should perform all relocation
processing at process startup rather than on demand.
The combination of the
.Va BIND_NOW
and
.Va RELRO
options provide "full" Relocation Read-Only (RELRO) support.
With full RELRO the entire GOT is made read-only after performing relocation at
startup, avoiding GOT overwrite attacks.
Add a WITH_BIND_NOW build knob The linker's -z now flag sets the DF_BIND_NOW flag, which signals to the runtime loader that all relocation processing should be performed at process startup rather than on demand. In combination with lld's default of enabling relro this causes the GOT to be made read-only when the process starts, preventing straightforward GOT overwrite attacks. Shawn Webb discovered a failure on HardenedBSD with BIND_NOW and ifunc use, which resulted in my rtld fix in r340137. Add a BIND_NOW knob as it is trivial to do so and is a useful ELF hardening feature. This change is equivalent to HardenedBSD's but not identical as there are other diffs/conflicts nearby. Note that our ELF Tool Chain readelf does not currently decode the DF_BIND_NOW flag - see PR232983. Reviewed by: brooks MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D17846 2018-11-06 15:52:49 +00:00			`Build all binaries with the`
			`.Dv DF_BIND_NOW`
			`flag set to indicate that the run-time loader should perform all relocation`
			`processing at process startup rather than on demand.`
Add RELRO build knob, default to enabled Note that lld enables relro by default, so that we already had either partial or full RELRO, depending on the state of the BIND_NOW knob. Add a RELRO knob so that the option can be disabled if desired, and so that builds using the GNU toolchain are equivalent to those using the standard Clang/LLVM toolchain. Reviewed by: markj MFC after: 3 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35545 2022-06-22 13:58:04 +01:00			`The combination of the`
			`.Va BIND_NOW`
			`and`
			`.Va RELRO`
			`options provide "full" Relocation Read-Only (RELRO) support.`
			`With full RELRO the entire GOT is made read-only after performing relocation at`
			`startup, avoiding GOT overwrite attacks.`