tree 12bdf76893cd40f7c552a8a27348164bc788f4f9
parent ff51a738cf487811a7890d5292c38bc30eb54e45
author Avi Kivity <avi@redhat.com> 1321380737 +0200
committer Anthony Liguori <aliguori@us.ibm.com> 1321909559 -0600

configure: build position independent executables on x86-Linux hosts

Change the default on x86 Linux hosts to building PIE (position
independent executables); instead of restricting the option to
user-only targets, apply it to all targets.

In addition, set the relocation sections to read-only (relro) when
available; this reduces the attack surface by disallowing changes to
relocation tables at runtime.

While PIE reduces performance and relro increases load time, it
greatly improves security, with the potential to reduce a code
execution vulnerability to a self denial of service.

Non-x86 are not changed, as they require TCG changes; neither are
non-Linux, due to lack of test coverage.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>