Bug 743158

Summary:	chromium: setuid binaries need to be position independent
Product:	[openSUSE] openSUSE 12.2	Reporter:	Ludwig Nussel <lnussel>
Component:	Other	Assignee:	Forgotten User sM9JzehKpy <forgotten_sM9JzehKpy>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	security-team
Version:	Factory
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	744091

Description Ludwig Nussel 2012-01-24 15:51:31 UTC

chromium triggered the rpmlint check
"non-position-independent-executable" which means there are one or
more binaries that need to be compiled as position independent
executable.

To fix the issue add -fPIE to CFLAGS and -pie to LDFLAGS of the
binaries in question.

Comment 1 Forgotten User sM9JzehKpy 2012-01-24 21:45:33 UTC

In my test repo, I have resolved this situation for the SUID binary chrome_sandbox. The rpmlint warning has now disappeared. Is this indeed the only binary that requires these flags or should Chromium itself also be compiled with those flags ?

Comment 2 Ludwig Nussel 2012-01-25 07:56:19 UTC

Sure, it may make sense to compile chromium itself as pie indeed as it's exposed to untrusted network data.

Comment 3 Bernhard Wiedemann 2012-01-31 08:00:28 UTC

This is an autogenerated message for OBS integration:
This bug (743158) was mentioned in
https://build.opensuse.org/request/show/102128 Factory / chromium

Comment 4 Forgotten User sM9JzehKpy 2012-01-31 10:11:27 UTC

Hi Ludwig, 

The indicated SR to Factory would resolve the rpmlint warning on the missing PIE flag for the chrome_sandbox binary. 

I have checked out to compile chromium itself also with PIE, but at this moment Google is indicating that compiling with PIE would break remote debugging. 

As commented by the chromium development team: 

          # TODO(rkc): Currently building Chrome with the PIE flag causes
          # remote debugging to break (remote debugger does not get correct
          # section header offsets hence causing all symbol handling to go
          # kaboom). See crosbug.com/15266

Comment 5 Bernhard Wiedemann 2012-01-31 11:00:35 UTC

This is an autogenerated message for OBS integration:
This bug (743158) was mentioned in
https://build.opensuse.org/request/show/102152 12.1 / chromium