[sanlock] branch master updated: python: Remove extra link args

This is an automated email from the git hooks/post-receive script.

nsoffer pushed a commit to branch master
in repository sanlock.

The following commit(s) were added to refs/heads/master by this push:
     new 5044719  python: Remove extra link args
5044719 is described below

commit 5044719a27cb41889ec08177cba977596b783e83
Author: Nir Soffer <nsoffer(a)redhat.com&gt;
AuthorDate: Sun Aug 2 02:01:06 2020 +0300

    python: Remove extra link args
    
    Fedora 33 builds fails now with:
    
    /usr/bin/ld: /tmp/sanlock.cpython-39-x86_64-linux-gnu.so.mpvMfj.ltrans0.ltrans.o:
    relocation R_X86_64_PC32 against undefined symbol `PyExc_ValueError' can
    not be used when making a shared object; recompile with -fPIC
    
    We use these extra link args:
    
        extra_link_args=['-fPIE', '-Wl,-z,relro,-z,now'],
    
    Looking the generated compiler command[1]:
    
    gcc -pthread \
        -shared \
        -Wl,-z,relro \
        -Wl,--as-needed \
        -Wl,-z,now \
        -g \
        -Wl,-z,relro \
        -Wl,--as-needed \
        -Wl,-z,now \
        -g \
        -Wl,-z,relro \
        -Wl,--as-needed \
        -Wl,-z,now \
        -specs=/usr/lib/rpm/redhat/redhat-hardened-ld \
        -O2 \
        -fexceptions \
        -g \
        -grecord-gcc-switches \
        -pipe \
        -Wall \
        -Werror=format-security \
        -Wp,-D_FORTIFY_SOURCE=2 \
        -Wp,-D_GLIBCXX_ASSERTIONS \
        -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 \
        -fstack-protector-strong \
        -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 \
        -m64 \
        -mtune=generic \
        -fasynchronous-unwind-tables \
        -fstack-clash-protection \
        -fcf-protection build/temp.linux-x86_64-3.9/sanlock.o \
        -L../src \
        -L/usr/lib64 \
        -lsanlock \
        -o build/lib.linux-x86_64-3.9/sanlock.cpython-39-x86_64-linux-gnu.so \
        -fPIE \
        -Wl,-z,relro,-z,now
    
    This looks like a complete mess. These arguments are repeated 3 times:
    
        -Wl,-z,relro \
        -Wl,--as-needed \
        -Wl,-z,now \
    
    And our extra compiler flags adds the forth copy.
    
    gcc says this about -fPIE:
    
        These options are similar to -fpic and -fPIC, but the generated
        position-independent code can be only linked into executables
    
    But our python extension is a shared object, so I don't think -fPIE
    makes sense.
    
    The extra arguments were added in:
    
    commit a1929080a6ce51879139eb8d05a425ccd3d37082
    Author: David Teigland <teigland(a)redhat.com&gt;
    Date:   Wed Oct 14 13:21:04 2015 -0500
    
        python: add compile flags
    
    Without any justification. I assume the intent was good, but it looks
    like this change was not needed, and somehow it worked until now.
    
    If some hardening is needed, it should be done by python build
    infrastructure, not in sanlock. And it seems that python do use some
    hardening specs (e.g. -specs=/usr/lib/rpm/redhat/redhat-hardened-ld).
    
    [1] https://kojipkgs.fedoraproject.org//work/tasks/8900/48358900/build.log
    
    Signed-off-by: Nir Soffer <nsoffer(a)redhat.com&gt;
---
 python/setup.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/python/setup.py b/python/setup.py
index 0f3d683..b3bfaf1 100644
--- a/python/setup.py
+++ b/python/setup.py
@@ -12,7 +12,6 @@ sanlock = Extension(name='sanlock',
                     include_dirs=['../src'],
                     library_dirs=['../src'],
                     extra_compile_args=["-std=c99"],
-                    extra_link_args=['-fPIE', '-Wl,-z,relro,-z,now'],
                     libraries=sanlocklib)
 
 version = None

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.