hardening: what changed

Revision 2 to 3. Removed lines have a minus sign; added lines have a plus sign.

Old	New		Line
1		-	Hardening - PIE or PIC - applies to Linux. PIE Hardening applies also to Windows, and its probably useful on Windows. The same FPC command line switches apply on Windows.
	1	+	Hardening - PIE or PIC - applies to Linux. PIE Hardening applies also to Windows, and its probably useful on Windows. The same FPC command line switches apply on Windows.
2	2
3	3		## Overview
4	4
5		-	For our purpose here, "hardening" means making your binary harder to hack while running. Key is [PIE](<https://en.wikipedia.org/wiki/Position-independent_code>), Position Independent Executable. FPC supports PIE with a couple of options on most platforms. Some environments require it and it makes good sense, especially in a server application. Its suggested that PIE Hardening increases the size of an executable and slows it down marginally.
	5	+	For our purpose here, "hardening" means making your binary harder to hack while running. Key is [PIE](https://en.wikipedia.org/wiki/Position-independent_code), Position Independent Executable. FPC supports PIE with a couple of options on most platforms. Some environments require it and it makes good sense, especially in a server application. Its suggested that PIE Hardening increases the size of an executable and slows it down marginally.
6	6
7		-	~~Most projects only require the following extra FPC command line switches -~~
8		-	~~```~~
	7	+	Most projects only require the following extra FPC command line switches -
	8	+
	9	+	``` bash
9	10		-Cg -k-pie -znow
10	11		```
11	12
12		-	~~However, there are some corner cases -~~
13		-
14		-	* Lazarus application will probably already have the "-Cg" in its compile line.
15		-	* Small, command line applications that would generate a statically linked binary will compile fine but not run ("No such file or directory"). The difficulty is that FPC does not bother to embed instructions about portable linking in such a binary because it appears unnecessary. The solution is to add "{$linklib c}" without the inverted commas to your source. This requests LibC be linked, forcing a dynamically linked binary and FPC provides the necessary information for the linker.
16		-	* At present, late 2021, PIE Hardening does not seem to work on PowerPC64le systems, see [this bug report](<https://gitlab.com/freepascal.org/fpc/source/-/issues/39451>)
17		-	* Some linux operating systems have a _file_ command that mentions the word 'pie' in its output when directed to a PIE Hardened binary, but some don't. But all recent OSs will, with a PIE Hardened binary, list something like _interpreter /lib64/ld-linux-x86-64.so.2_ \- that library must exist, if not, you have the _statically linked binary_ problem mentioned above.
	13	+	However, there are some corner cases -
18	14
19		-
	15	+	- Lazarus application will probably already have the "-Cg" in its compile line.
	16	+	- Small, command line applications that would generate a statically linked binary will compile fine but not run ("No such file or directory"). The difficulty is that FPC does not bother to embed instructions about portable linking in such a binary because it appears unnecessary. The solution is to add "{\$linklib c}" without the inverted commas to your source. This requests LibC be linked, forcing a dynamically linked binary and FPC provides the necessary information for the linker.
	17	+	- At present, late 2021, PIE Hardening does not seem to work on PowerPC64le systems, see [this bug report](https://gitlab.com/freepascal.org/fpc/source/-/issues/39451)
	18	+	- Some linux operating systems have a file command that mentions the word 'pie' in its output when directed to a PIE Hardened binary, but some don't. But all recent OSs will, with a PIE Hardened binary, list something like interpreter /lib64/ld-linux-x86-64.so.2 - that library must exist, if not, you have the statically linked binary problem mentioned above.
20	19
21	20		## Example
22	21
23		-	~~Following is an example test file -~~
24		-	~~```~~
	22	+	Following is an example test file -
	23	+
	24	+	``` pascal
25	25		program Test;
26		-	~~{$linklib c}~~
27		-	~~begin~~
28		-	~~writeln('test');~~
29		-	~~end.~~
	26	+	{$linklib c}
	27	+	begin
	28	+	writeln('test');
	29	+	end.
30	30		```
31	31
32		-	~~Compile with this -~~
33		-	~~```~~
	32	+	Compile with this -
	33	+
	34	+	``` bash
34	35		fpc -Cg -k-pie -k-znow test.pas
35	36		```
36	37
37		-	~~And examine the result -~~
38		-	~~```~~
	38	+	And examine the result -
	39	+
	40	+	``` bash
39	41		$> file test [enter]
40		-	~~test: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.4.0, stripped~~
	42	+	test: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.4.0, stripped
41	43		```
42	44
43		-
44		-
45	45		## See Also
46	46
47		-	* <https://wiki.freepascal.org/Hardened_runtime_for_macOS>
48		-	* <https://wiki.debian.org/Hardening>
49		-	* <https://wiki.freepascal.org/Debian_package_structure>
50		-	* This [[GDB Debugger Tips\|gdb page]] mentions a problem debugging PIE.
	47	+	- <https://wiki.freepascal.org/Hardened_runtime_for_macOS>
	48	+	- <https://wiki.debian.org/Hardening>
	49	+	- <https://wiki.freepascal.org/Debian_package_structure>
	50	+	- This [gdb page](https://wiki.freepascal.org/GDB_Debugger_Tips) mentions a problem debugging PIE.
51	51
52	52		---
53		-	From the Free Pascal wiki, page "hardening", as the Internet Archive kept it on 2022-07-07. Copyright stays with the author who wrote it, according to the old wiki's [[Licensing]] page. If you have concerns about this material, [message the admin](/wiki-contact).
	53	+	From the Free Pascal wiki, page "hardening", as it stood on 2021-12-08 after a change by Alextp, out of the wiki's dump of 2024-05-26. Copyright stays with the author who wrote it, according to the old wiki's [[Licensing]] page. If you have concerns about this material, [message the admin](/wiki-contact).

Back to history