A Look At the Specs ...

(warning: GCC internals ahead. For ye who wishes to stay sane, stay away, stay very far away)

Part of the major changes hardy->intrepid was the inclusion of hardening configurations in GCC. This was originally handled via a script called hardening-wrapper, which using the alternates system to replace GCC with a wrapper script, which passed a variety of options (see the wiki for the full list) and was controllable via environmental variables.

After intrepid, all of these options (aside from PIE) was moved into GCC specifically via the spec mechanism. For those unaware, GCC (and binutils) is essentially several smaller programs, such as the C preprocessor, cc1, assembler, linker, etc. The specs strings is essentially a rules system that controls the arguements to each of these mini programs. Lets take a more specific look at these strings. You can view the gcc specs can be viewed with gcc -dumpspecs

(Ubuntu GCC 4.3.1 Intrepid Alpha, for beverity sake, here's just a small section)

*cpp_unique_options:
%{C|CC:%{!E:%eGCC does not support -C or -CC without -E}} %{!Q:-quiet} %{nostdinc*} %{C} %{CC} %{v} %{I*&F*} %{P} %I %{MD:-MD %{!o:%b.d}%{o*:%.d%*}} %{MMD:-MMD %{!o:%b.d}%{o*:%.d%*}} %{M} %{MM} %{MF*} %{MG} %{MP} %{MQ*} %{MT*} %{!E:%{!M:%{!MM:%{!MT:%{!MQ:%{MD|MMD:%{o*:-MQ %*}}}}}}} %{remap} %{g3|ggdb3|gstabs3|gcoff3|gxcoff3|gvms3:-dD} %{H} %C %{D*&U*&A*} %{i*} %Z %i %{fmudflap:-D_MUDFLAP -include mf-runtime.h} %{fmudflapth:-D_MUDFLAP -D_MUDFLAPTH -include mf-runtime.h} %{!D_FORTIFY_SOURCE:%{!D_FORTIFY_SOURCE=*:%{!U_FORTIFY_SOURCE:-D_FORTIFY_SOURCE=2}}} %{E|M|MM:%W{o*}}

While this appears to a load of messy strings, it defines the command line arguements GCC accepts, and what it does. The last section for instance was added in Ubuntu to add the FORTIFY_SOURCE defines, as well as include the offswitch for it. Adding the PIE switch would be done under the cc1 section which is what handles the PIE processing, in a similar mechanism. This way, we can apply PIE to every package, and then manually add -fno-PIE on any package that requires it to be disabled.

This is a quick overview of specs, and I hope you learned something by reading it, and understanding how this will be done.

More progress ...

After further research, I attempted to use Linux from Scratch as a base for my attempts to compile the base system. This lead me to High Security LFS, which is the base chroot built with PIE, which is what I want. I can't find anyone who's done HLFS on amd64, so it will be rather interesting to see how well this works.

GCC sucks.

On my quest to build the archive with PIE, I discovered the first major headache, is that there is a rather interesting circular dependency in the compiler toolchain.

Roughly speaking, libgcc is linked to to glibc, which is linked to libgmp, which the compiler is dependent on, making it not possible to directly build the compiler built with PIE (and as an additional fun fact, the three stage bootstrap makes hardened wrapper non-effective. CFLAGS can be passed to the second and third stage bootstrap so this isn't a huge limitation, but it will regular beating gcc's debain/rules2 into passing the flags correctly. I'm now at the point roughly where I can try to build perl from source, then dpkg and aptitude.