sudo-project/sudo

Compiling on AIX with native compilers fails

mikewhitton998 opened this issue · 4 comments

mikewhitton998 commented

When compiling using the following configure command, that has generally been used by our org for years, fails now with 1.9.12p1:

./configure --with-ldap=/opt/IBM/ldap/V6.4 --with-ldap-conf-file=/etc/security/ldap/ldap.cfg --with-aixauth --with-incpath=/opt/IBM/ldap/V6.4/include --with-libpath=/opt/IBM/ldap/V6.4/lib

Here is the failure message issued by the linker:

This is the error message we are getting:

ld: 0706-005 Cannot find or open file: stack-clash-protection
ld:fopen(): No such file or directory
make: 1254-004 The error code from the last command is 255.

Stop.
make: 1254-004 The error code from the last command is 2.

However, when I disable hardening everything appears to compile correctly:

./configure --with-ldap=/opt/IBM/ldap/V6.4 --with-ldap-conf-file=/etc/security/ldap/ldap.cfg --with-aixauth --with-incpath=/opt/IBM/ldap/V6.4/include --with-libpath=/opt/IBM/ldap/V6.4/lib --disable-hardening

I cannot find any reference to this 'stack-clash-protection' in the IBM documentation for XL C.

millert commented

It sounds like the configure test for whether -fstack-clash-protection is accepted by the compiler is not working properly. I'll add an explicit check for whether the flag is also accepted by the linker. That may solve the problem.

  • 👍1
millert commented

Please try 1.9.12p2 and let me know if that fixes the problem.

mikewhitton998 commented

I ran the compilation of 1.9.12p2 and it compiled successfully and all of the unit tests passed. However, it is still incorrectly reporting that stack clash protection is a supported compiler option:

checking for compiler stack protector support... no
checking whether C compiler supports -fstack-clash-protection... yes
checking whether the linker accepts -fstack-clash-protection... no

In the XL C compiler for AIX the '-f' option provides the linker with a list of object files passed to it from the compiler:

https://www.ibm.com/docs/en/xl-c-and-cpp-aix/16.1?topic=descriptions-f#opt_f_lower

The '-fstack-clash-protection' appears to be specifically for the gcc compiler.

Thanks for your help fixing this, I will continue to test this new release but it appear to be functioning properly.

millert commented

Thanks for testing. In the future I may restrict those check to compilers that define GNUC.

  • 👍1