build: enable PIE by default

[lizan]

Signed-off-by: Lizan Zhou lizan@tetrate.io

Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:

[lizan]

@PiotrSikora @agl @davidben is it possible to add -fPIC to BoringSSL FIPS build?

[PiotrSikora]

As far as I know, we can't, since the Security Policy has to be followed to the dot when building module... but @agl is the authority here.

[htuch]

Thanks @lizan, this is a very helpful improvement.

[mattklein123]

Can we add a release note also about this? I think it's useful to let people know that we expect the binary to be runnable under ASLR.

[htuch]

LGTM, just some nits. Thanks.
/wait

[lizan]

/retest

[repokitteh-read-only]

🔨 rebuilding ci/circleci: coverage (failed build)

🐱

Caused by: a #8792 (comment) was created by @lizan.

see: more, trace.

[htuch]

Thanks!

[nareddyt]

HI @lizan, could you explain the -fPIC copt you added to .bazelrc? I get what the copt does, but I don't understand why it's needed to build now.

[lizan]

@nareddyt to link a binary with -pie all objects (.o files) has to be compiled with -fPIC. --copt is propagating all the way down to dependencies including foreign_cc cmake rules.