Remove "-fpie" -- causes compilation downstream failures by tianon · Pull Request #351 · docker-library/php

tianon · 2016-12-12T19:00:10Z

Note that I'm intentionally not marking #347 as closed here -- this is only part of the issue pointed out there (downstream compilation failures). We still likely need to address the issue of our users not expecting downstream C*FLAGS/LDFLAGS pollution, but I think this change is good regardless.

See docker-library#347 (comment).

tianon · 2016-12-12T20:37:04Z

See also http://stackoverflow.com/a/16023793/433558, which quotes from https://gcc.gnu.org/onlinedocs/gcc-4.8.0/gcc/Code-Gen-Options.html#Code-Gen-Options:

-fpic

Generate position-independent code (PIC) suitable for use in a shared library, if supported for the target machine.

-fPIC

If supported for the target machine, emit position-independent code, suitable for dynamic linking and avoiding any limit on the size of the global offset table. This option makes a difference on the m68k, PowerPC and SPARC.

-fpie
-fPIE

These options are similar to -fpic and -fPIC, but generated position independent code can be only linked into executables.

tianon · 2016-12-12T20:38:02Z

(Which explains why -fpie causes problems for downstream builds, and will potentially cause problems for our own .so builds too unless PHP's build system is smart enough to filter it out.)

tianon · 2016-12-12T20:46:00Z

Potentially useful context:

/usr/src/php # grep -irn 'fpie' .
/usr/src/php # grep -irn 'fpic' .
./configure:98576:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./configure:98588:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./configure:98613:	lt_prog_compiler_pic='-fPIC'
./configure:98619:      lt_prog_compiler_pic='-fPIC'
./configure:98690:        lt_prog_compiler_pic='-fPIC'
./configure:98697:	lt_prog_compiler_pic='-fpic'
./configure:99584:	archive_cmds='$rm $output_objdir/$soname~$CC -shared -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./configure:99600:	archive_cmds='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
./configure:99627:	  archive_cmds='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
./configure:102329:        archive_cmds_CXX='$rm $output_objdir/$soname~$CC -shared -nostdlib -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./configure:102394:	      archive_cmds_CXX='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./configure:102397:	      archive_cmds_CXX='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./configure:102400:	      archive_cmds_CXX='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./configure:103111:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./configure:103125:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./configure:103140:	lt_prog_compiler_pic_CXX='-fPIC'
./configure:103145:      lt_prog_compiler_pic_CXX='-fPIC'
./configure:103238:	    lt_prog_compiler_pic_CXX='-fPIC'
./configure:103249:        lt_prog_compiler_pic_CXX='-fPIC'
./configure:103255:	    lt_prog_compiler_pic_CXX='-fpic'
./ext/hash/tests/fnv1a32.phpt:288:	array( ')\\l~-hmG{}`"\\y`7eo6FpIc1\\_x/rC~{ k{.UjURi7TF16]w&s>w>"*z', 'c6ec7195' ),
./build/libtool.m4:3207:        _LT_AC_TAGVAR(archive_cmds, $1)='$rm $output_objdir/$soname~$CC -shared -nostdlib -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./build/libtool.m4:3272:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./build/libtool.m4:3275:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./build/libtool.m4:3278:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./build/libtool.m4:4768:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./build/libtool.m4:4782:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./build/libtool.m4:4797:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:4802:      _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:4895:	    _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:4906:        _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:4912:	    _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
./build/libtool.m4:5058:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./build/libtool.m4:5070:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./build/libtool.m4:5095:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:5101:      _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:5172:        _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./build/libtool.m4:5179:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
./build/libtool.m4:5877:	_LT_AC_TAGVAR(archive_cmds, $1)='$rm $output_objdir/$soname~$CC -shared -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./build/libtool.m4:5893:	_LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
./build/libtool.m4:5920:	  _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
./acinclude.m4:1549:  AC_MSG_CHECKING([whether -fPIC is required])
./acinclude.m4:1556:            CFLAGS="$CFLAGS -fPIC";;
./acinclude.m4:1558:            CFLAGS="$CFLAGS -fpic";;
./aclocal.m4:1549:  AC_MSG_CHECKING([whether -fPIC is required])
./aclocal.m4:1556:            CFLAGS="$CFLAGS -fPIC";;
./aclocal.m4:1558:            CFLAGS="$CFLAGS -fpic";;
./aclocal.m4:6318:        _LT_AC_TAGVAR(archive_cmds, $1)='$rm $output_objdir/$soname~$CC -shared -nostdlib -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./aclocal.m4:6383:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./aclocal.m4:6386:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+nodefaultrpath -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./aclocal.m4:6389:	      _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -nostdlib -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $predep_objects $libobjs $deplibs $postdep_objects $compiler_flags'
./aclocal.m4:7879:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./aclocal.m4:7893:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./aclocal.m4:7908:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:7913:      _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8006:	    _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8017:        _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8023:	    _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
./aclocal.m4:8169:      # Although the cygwin gcc ignores -fPIC, still need this for old-style
./aclocal.m4:8181:      # Interix 3.x gcc -fpic/-fPIC options generate broken code.
./aclocal.m4:8206:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8212:      _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8283:        _LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
./aclocal.m4:8290:	_LT_AC_TAGVAR(lt_prog_compiler_pic, $1)='-fpic'
./aclocal.m4:8988:	_LT_AC_TAGVAR(archive_cmds, $1)='$rm $output_objdir/$soname~$CC -shared -fPIC ${wl}+b ${wl}$install_libdir -o $output_objdir/$soname $libobjs $deplibs $compiler_flags~test $output_objdir/$soname = $lib || mv $output_objdir/$soname $lib'
./aclocal.m4:9004:	_LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
./aclocal.m4:9031:	  _LT_AC_TAGVAR(archive_cmds, $1)='$CC -shared -fPIC ${wl}+h ${wl}$soname ${wl}+b ${wl}$install_libdir -o $lib $libobjs $deplibs $compiler_flags'

(no reference anywhere in the entire PHP build system and code of fpie, but several instances of fpic)

yosifkit · 2016-12-12T23:22:49Z

More info about pic and pie: https://codywu2010.wordpress.com/2014/11/29/about-elf-pie-pic-and-else/. A few notable quotes:

To create a PIE properly you also need to pass on the instruction to linker hence another switch is needed as well “-pie”

pie executable can be loaded to any address and with Address space layout randomization (ASLR) enabled system it’s intentionally done for enhancement of security.

while for shared object it allows kernel implementation to pick an address at will.
The same logic applies to both shared lib as well as pie executable since they are under the cover the same sort of stuff.

So, adding pie to php itself should help the kernel when running multiple instances of php so that it can share the php executable as well as any dynamic libraries. (at least, that is how I understand it)

Given that users are having issues with these flags being set, I am instead creating a PR to make them PHP_ env vars so that we can use them while compiling php itself while also being able to use them in the docker-php-ext- configure and install scripts for the php modules if the user has not provided their own.

Having -fpie and -pie does not affect building the php module .so files (tested gd. mbstring, mysqli, opcache, pdo, pdo_mysql).

Remove "-fpie" -- causes compilation downstream failures

603e1f9

See docker-library#347 (comment).

yosifkit mentioned this pull request Dec 12, 2016

Swap CFLAGS to PHP_CLFAGS #352

Merged

tianon closed this in #352 Dec 13, 2016

tianon deleted the fpie branch December 13, 2016 17:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove "-fpie" -- causes compilation downstream failures#351

Remove "-fpie" -- causes compilation downstream failures#351
tianon wants to merge 1 commit intodocker-library:masterfrom
infosiftr:fpie

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

yosifkit commented Dec 12, 2016

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

tianon commented Dec 12, 2016

Uh oh!

yosifkit commented Dec 12, 2016

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants