(PA-6896) Enable pie on RHEL 9 and up

(PA-6896) remove the shared flag
puppetlabs · Sep 3, 2024 · d5c828e · d5c828e
1 parent a1da62b
commit d5c828e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/configs/components/ruby-3.2.5.rb b/configs/components/ruby-3.2.5.rb
@@ -94,7 +94,7 @@
   special_flags = " --prefix=#{ruby_dir} --with-opt-dir=#{settings[:prefix]} "
 
   if settings[:supports_pie]
-    special_flags += " CFLAGS='#{settings[:cflags]}' LDFLAGS='#{settings[:ldflags]}' CPPFLAGS='#{settings[:cppflags]}' "
+    special_flags += " CFLAGS='-fPIC -fstack-protector-strong -fno-plt -O2' LDFLAGS='#{settings[:ldflags]}' CPPFLAGS='-fPIE #{settings[:cppflags]}' "
   end
 
   # Ruby's build process requires a "base" ruby and we need a ruby to install

diff --git a/configs/projects/_shared-compiler-settings.rb b/configs/projects/_shared-compiler-settings.rb
@@ -12,7 +12,6 @@
 # are too old to support these flags.
 
 if((platform.is_sles? && platform.os_version.to_i >= 15) ||
-      (platform.is_el? && platform.os_version.to_i == 8 && platform.architecture !~ /ppc64/) ||
       (platform.is_debian? && platform.os_version.to_i >= 10) ||
       (platform.is_ubuntu? && platform.os_version.to_i >= 22) ||
       platform.is_fedora?
@@ -21,4 +20,9 @@
   proj.setting(:cppflags, "-I#{proj.includedir} -D_FORTIFY_SOURCE=2")
   proj.setting(:cflags, '-fstack-protector-strong -fno-plt -O2')
   proj.setting(:ldflags, "-L#{proj.libdir} -Wl,-rpath=#{proj.libdir},-z,relro,-z,now")
+elsif(platform.is_el? && platform.os_version.to_i >= 8)
+  proj.setting(:supports_pie, true)
+  proj.setting(:cppflags, "-I#{proj.includedir} -D_FORTIFY_SOURCE=2")
+  proj.setting(:cflags, '-fPIC -pie -fstack-protector-strong -fno-plt -O2')
+  proj.setting(:ldflags, "-L#{proj.libdir} -Wl,-rpath=#{proj.libdir},-z,relro,-z,now")
 end