If you compile the package with: LDFLAGS=" -Wl,--hash-style=gnu -Wl,-z,norelro" you won't see "No Relro" so it is not respected To test please use checksec from app-admin/checksec ~ $ checksec --file=/lib64/libc-2.32.so RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Full RELRO Canary found NX enabled DSO No RPATH No RUNPATH No Symbols Yes 79 170 /lib64/libc-2.32.so
glibc explicitly overrides relro value: Makeconfig-+link-before-libc = -nostdlib -nostartfiles -o $@ \ Makeconfig- $(sysdep-LDFLAGS) $(LDFLAGS) $(LDFLAGS-$(@F)) \ Makeconfig: $(combreloc-LDFLAGS) $(relro-LDFLAGS) $(hashstyle-LDFLAGS) \ Makeconfig- $(firstword $(CRT-$(@F)) $(csu-objpfx)$(start-installed-name)) \ Makeconfig- $(+preinit) $(+prector) \ Makeconfig- $(filter-out $(addprefix $(csu-objpfx),start.o \ Makeconfig- $(start-installed-name))\ Makeconfig- $(+preinit) $(link-extra-libs) \ Makeconfig- $(common-objpfx)libc% $(+postinit),$^) \ Makeconfig- $(link-extra-libs) What behaviour do you expect?
(In reply to Sergei Trofimovich from comment #1) > glibc explicitly overrides relro value: > > Makeconfig-+link-before-libc = -nostdlib -nostartfiles -o $@ \ > Makeconfig- $(sysdep-LDFLAGS) $(LDFLAGS) $(LDFLAGS-$(@F)) \ > Makeconfig: $(combreloc-LDFLAGS) $(relro-LDFLAGS) > $(hashstyle-LDFLAGS) \ > Makeconfig- $(firstword $(CRT-$(@F)) > $(csu-objpfx)$(start-installed-name)) \ > Makeconfig- $(+preinit) $(+prector) \ > Makeconfig- $(filter-out $(addprefix $(csu-objpfx),start.o \ > Makeconfig- > $(start-installed-name))\ > Makeconfig- $(+preinit) $(link-extra-libs) \ > Makeconfig- $(common-objpfx)libc% $(+postinit),$^) \ > Makeconfig- $(link-extra-libs) > > What behaviour do you expect? I'd expect user flags always override default flags unless it is well known to break.
(In reply to Agostino Sarubbo from comment #2) it is going to break. glibc clobbers flags when it must. it's producing the fundamental libs in your system used to bootstrap all other processes.
(In reply to SpanKY from comment #3) > (In reply to Agostino Sarubbo from comment #2) > > it is going to break. glibc clobbers flags when it must. it's producing > the fundamental libs in your system used to bootstrap all other processes.