1. Patchew
  2. linux
  3. [PATCH 0/2] ebpf: improves bpftool security
  4. View patch

[PATCH 1/2] libbpf: add fPIC option for static library

Xin Liu posted 2 patches 3 years, 6 months ago
[PATCH 1/2] libbpf: add fPIC option for static library
Posted by Xin Liu 3 years, 6 months ago 
Some programs depned on libbpf.a(eg:bpftool). If libbpf.a miss -fPIC,
this will cause a similar error at compile time:

/usr/bin/ld: .../libbpf.a(libbpf-in.o): relocation
R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which
may bind externally can not be used when making a sharedobject;
recompile with -fPIC

Use -fPIC for static library compilation to solve this problem.

Signed-off-by: Xin Liu <liuxin350@huawei.com>
---
 tools/lib/bpf/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index 4c904ef0b47e..427e971f4fcd 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -91,9 +91,10 @@ override CFLAGS += $(INCLUDES)
 override CFLAGS += -fvisibility=hidden
 override CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 override CFLAGS += $(CLANG_CROSS_FLAGS)
+override CFLAGS += -fPIC
 
 # flags specific for shared library
-SHLIB_FLAGS := -DSHARED -fPIC
+SHLIB_FLAGS := -DSHARED
 
 ifeq ($(VERBOSE),1)
   Q =
-- 
2.33.0
Re: [PATCH 1/2] libbpf: add fPIC option for static library
Posted by Andrii Nakryiko 3 years, 6 months ago 
On Sat, Sep 24, 2022 at 3:13 AM Xin Liu <liuxin350@huawei.com> wrote:
>
> Some programs depned on libbpf.a(eg:bpftool). If libbpf.a miss -fPIC,
> this will cause a similar error at compile time:
>
> /usr/bin/ld: .../libbpf.a(libbpf-in.o): relocation
> R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which
> may bind externally can not be used when making a sharedobject;
> recompile with -fPIC
>
> Use -fPIC for static library compilation to solve this problem.
>
> Signed-off-by: Xin Liu <liuxin350@huawei.com>
> ---
>  tools/lib/bpf/Makefile | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
> index 4c904ef0b47e..427e971f4fcd 100644
> --- a/tools/lib/bpf/Makefile
> +++ b/tools/lib/bpf/Makefile
> @@ -91,9 +91,10 @@ override CFLAGS += $(INCLUDES)
>  override CFLAGS += -fvisibility=hidden
>  override CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
>  override CFLAGS += $(CLANG_CROSS_FLAGS)
> +override CFLAGS += -fPIC
>

It seems wrong to force -fPIC for static library just because in some
situations users might want to statically link their *shared* library
with *static* libbpf. It's a bit unconventional, even though I see
situations in which this might be useful.

But I don't think this can be a default. I see three possible solutions:

1. Do nothing. Let users specify EXTRA_CFLAGS=-fPIC if they need
position-independent static lib
2. Let packagers decide this (again, through EXTRA_CFLAGS or by
patching Makefile, whichever is best). Or maybe build both PIC and
non-PIC static libraries and package both?
3. Produce PIC and non-PIC libbpf.a libraries from libbpf's Makefile.

I'm not sure which one is the best answer, would be nice to hear
opinions of people who do the packaging and distribution of libbpf in
distros.

>  # flags specific for shared library
> -SHLIB_FLAGS := -DSHARED -fPIC
> +SHLIB_FLAGS := -DSHARED
>
>  ifeq ($(VERBOSE),1)
>    Q =
> --
> 2.33.0
>
Re: [PATCH 1/2] libbpf: add fPIC option for static library
Posted by John Fastabend 3 years, 6 months ago 
Andrii Nakryiko wrote:
> On Sat, Sep 24, 2022 at 3:13 AM Xin Liu <liuxin350@huawei.com> wrote:
> >
> > Some programs depned on libbpf.a(eg:bpftool). If libbpf.a miss -fPIC,
> > this will cause a similar error at compile time:
> >
> > /usr/bin/ld: .../libbpf.a(libbpf-in.o): relocation
> > R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which
> > may bind externally can not be used when making a sharedobject;
> > recompile with -fPIC
> >
> > Use -fPIC for static library compilation to solve this problem.
> >
> > Signed-off-by: Xin Liu <liuxin350@huawei.com>
> > ---
> >  tools/lib/bpf/Makefile | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
> > index 4c904ef0b47e..427e971f4fcd 100644
> > --- a/tools/lib/bpf/Makefile
> > +++ b/tools/lib/bpf/Makefile
> > @@ -91,9 +91,10 @@ override CFLAGS += $(INCLUDES)
> >  override CFLAGS += -fvisibility=hidden
> >  override CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
> >  override CFLAGS += $(CLANG_CROSS_FLAGS)
> > +override CFLAGS += -fPIC
> >
> 
> It seems wrong to force -fPIC for static library just because in some
> situations users might want to statically link their *shared* library
> with *static* libbpf. It's a bit unconventional, even though I see
> situations in which this might be useful.
> 
> But I don't think this can be a default. I see three possible solutions:
> 
> 1. Do nothing. Let users specify EXTRA_CFLAGS=-fPIC if they need
> position-independent static lib
> 2. Let packagers decide this (again, through EXTRA_CFLAGS or by
> patching Makefile, whichever is best). Or maybe build both PIC and
> non-PIC static libraries and package both?
> 3. Produce PIC and non-PIC libbpf.a libraries from libbpf's Makefile.
> 
> I'm not sure which one is the best answer, would be nice to hear
> opinions of people who do the packaging and distribution of libbpf in
> distros.

Not a distro or pkg maintainer but my $.02 is I would just leave it
for 1 and 2.

> 
> >  # flags specific for shared library
> > -SHLIB_FLAGS := -DSHARED -fPIC
> > +SHLIB_FLAGS := -DSHARED
> >
> >  ifeq ($(VERBOSE),1)
> >    Q =
> > --
> > 2.33.0
> >
Re: [PATCH 1/2] libbpf: add fPIC option for static library
Posted by Quentin Monnet 3 years, 6 months ago 
Sat Sep 24 2022 11:12:08 GMT+0100 ~ Xin Liu <liuxin350@huawei.com>
> Some programs depned on libbpf.a(eg:bpftool). If libbpf.a miss -fPIC,

Typo "depned"

> this will cause a similar error at compile time:
> 
> /usr/bin/ld: .../libbpf.a(libbpf-in.o): relocation
> R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which
> may bind externally can not be used when making a sharedobject;
> recompile with -fPIC
> 
> Use -fPIC for static library compilation to solve this problem.
> 
> Signed-off-by: Xin Liu <liuxin350@huawei.com>
> ---
>  tools/lib/bpf/Makefile | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
> index 4c904ef0b47e..427e971f4fcd 100644
> --- a/tools/lib/bpf/Makefile
> +++ b/tools/lib/bpf/Makefile
> @@ -91,9 +91,10 @@ override CFLAGS += $(INCLUDES)
>  override CFLAGS += -fvisibility=hidden
>  override CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
>  override CFLAGS += $(CLANG_CROSS_FLAGS)
> +override CFLAGS += -fPIC
>  
>  # flags specific for shared library
> -SHLIB_FLAGS := -DSHARED -fPIC
> +SHLIB_FLAGS := -DSHARED
>  
>  ifeq ($(VERBOSE),1)
>    Q =

Hi, the two patches look OK to me, but it would be nice to have a bit
more context on what the flags do other than “fixing this particular
issue” and how they improve bpftool security. It would also be
interesting to have a note on what it does on various architectures, my
understanding is that only some archs are supported (I read AArch64,
m68k, PowerPC and SPARC), I guess the flags are silently ignored on x86
for example?

Thanks,
Quentin
Re: [PATCH 1/2] libbpf: add fPIC option for static library
Posted by Xin Liu 3 years, 6 months ago 
On Tue, 27 Sep 2022 at 6:21:20 PM Quentin <quentin@isovalent.com> wrote:
> Sat Sep 24 2022 11:12:08 GMT+0100 ~ Xin Liu <liuxin350@huawei.com>
> > Some programs depned on libbpf.a(eg:bpftool). If libbpf.a miss -fPIC,
> 
> Typo "depned"
> 
> > this will cause a similar error at compile time:
> > 
> > /usr/bin/ld: .../libbpf.a(libbpf-in.o): relocation
> > R_AARCH64_ADR_PREL_PG_HI21 against symbol `stderr@@GLIBC_2.17' which
> > may bind externally can not be used when making a sharedobject;
> > recompile with -fPIC
> > 
> > Use -fPIC for static library compilation to solve this problem.
> > 
> > Signed-off-by: Xin Liu <liuxin350@huawei.com>
> > ---
> >  tools/lib/bpf/Makefile | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
> > index 4c904ef0b47e..427e971f4fcd 100644
> > --- a/tools/lib/bpf/Makefile
> > +++ b/tools/lib/bpf/Makefile
> > @@ -91,9 +91,10 @@ override CFLAGS += $(INCLUDES)
> >  override CFLAGS += -fvisibility=hidden
> >  override CFLAGS += -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
> >  override CFLAGS += $(CLANG_CROSS_FLAGS)
> > +override CFLAGS += -fPIC
> >  
> >  # flags specific for shared library
> > -SHLIB_FLAGS := -DSHARED -fPIC
> > +SHLIB_FLAGS := -DSHARED
> >  
> >  ifeq ($(VERBOSE),1)
> >    Q =
> 
> Hi, the two patches look OK to me, but it would be nice to have a bit
> more context on what the flags do other than “fixing this particular
> issue” and how they improve bpftool security. It would also be
> interesting to have a note on what it does on various architectures, my
> understanding is that only some archs are supported (I read AArch64,
> m68k, PowerPC and SPARC), I guess the flags are silently ignored on x86
> for example?
> 
> Thanks,
> Quentin
> 
This advice is very useful to me. Thank you very much for your reply.
I'll fix it in the V2 version.

Thansk,
Xin Liu

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.