From 2c9a2e020e33c86f54f905abb3c2dc127304456e Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Wed, 26 Aug 2026 09:59:25 -0400 Subject: [PATCH] Link Ruby with `-z now` for full RELRO Debian's linker defaults leave both `ruby` and `libruby.so` with lazy binding, so their GOTs stay writable for the life of the process and remain available as a target once an attacker has an arbitrary write. Export `LDFLAGS` before `configure`. Ruby's `configure` appends to `LDFLAGS` and seeds `DLDFLAGS` from it, so the interpreter, `libruby.so`, and native extensions built downstream all pick it up. Alpine already links this way, so the change is a no-op there. The image codecs reachable through `libvips` have had many memory safety bugs. Making the GOT read-only does not fix those bugs, but it removes one of the easier ways to escalate a memory write into code execution. --- 3.3/alpine3.23/Dockerfile | 2 ++ 3.3/alpine3.24/Dockerfile | 2 ++ 3.3/bookworm/Dockerfile | 2 ++ 3.3/slim-bookworm/Dockerfile | 2 ++ 3.3/slim-trixie/Dockerfile | 2 ++ 3.3/trixie/Dockerfile | 2 ++ 3.4/alpine3.23/Dockerfile | 2 ++ 3.4/alpine3.24/Dockerfile | 2 ++ 3.4/bookworm/Dockerfile | 2 ++ 3.4/slim-bookworm/Dockerfile | 2 ++ 3.4/slim-trixie/Dockerfile | 2 ++ 3.4/trixie/Dockerfile | 2 ++ 4.0/alpine3.23/Dockerfile | 2 ++ 4.0/alpine3.24/Dockerfile | 2 ++ 4.0/bookworm/Dockerfile | 2 ++ 4.0/slim-bookworm/Dockerfile | 2 ++ 4.0/slim-trixie/Dockerfile | 2 ++ 4.0/trixie/Dockerfile | 2 ++ Dockerfile.template | 2 ++ 19 files changed, 38 insertions(+) diff --git a/3.3/alpine3.23/Dockerfile b/3.3/alpine3.23/Dockerfile index 63b92bd40..0ddbd077a 100644 --- a/3.3/alpine3.23/Dockerfile +++ b/3.3/alpine3.23/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/alpine3.24/Dockerfile b/3.3/alpine3.24/Dockerfile index 118ae595d..9b8263d44 100644 --- a/3.3/alpine3.24/Dockerfile +++ b/3.3/alpine3.24/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/bookworm/Dockerfile b/3.3/bookworm/Dockerfile index 3180158ff..09c609803 100644 --- a/3.3/bookworm/Dockerfile +++ b/3.3/bookworm/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/slim-bookworm/Dockerfile b/3.3/slim-bookworm/Dockerfile index 340f84d36..5e5f2309d 100644 --- a/3.3/slim-bookworm/Dockerfile +++ b/3.3/slim-bookworm/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/slim-trixie/Dockerfile b/3.3/slim-trixie/Dockerfile index 195313510..77593c6b4 100644 --- a/3.3/slim-trixie/Dockerfile +++ b/3.3/slim-trixie/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/trixie/Dockerfile b/3.3/trixie/Dockerfile index f9fe3390c..7a7a70d70 100644 --- a/3.3/trixie/Dockerfile +++ b/3.3/trixie/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/alpine3.23/Dockerfile b/3.4/alpine3.23/Dockerfile index df92bcf0a..80014869d 100644 --- a/3.4/alpine3.23/Dockerfile +++ b/3.4/alpine3.23/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/alpine3.24/Dockerfile b/3.4/alpine3.24/Dockerfile index 6d0c21465..6f4e6c812 100644 --- a/3.4/alpine3.24/Dockerfile +++ b/3.4/alpine3.24/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/bookworm/Dockerfile b/3.4/bookworm/Dockerfile index 9472c0e27..66b157644 100644 --- a/3.4/bookworm/Dockerfile +++ b/3.4/bookworm/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/slim-bookworm/Dockerfile b/3.4/slim-bookworm/Dockerfile index b1eccc954..a0bbda116 100644 --- a/3.4/slim-bookworm/Dockerfile +++ b/3.4/slim-bookworm/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/slim-trixie/Dockerfile b/3.4/slim-trixie/Dockerfile index 076061f05..a5b43ee79 100644 --- a/3.4/slim-trixie/Dockerfile +++ b/3.4/slim-trixie/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/trixie/Dockerfile b/3.4/trixie/Dockerfile index 093b89ad4..fe9358d0e 100644 --- a/3.4/trixie/Dockerfile +++ b/3.4/trixie/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/alpine3.23/Dockerfile b/4.0/alpine3.23/Dockerfile index 715da445c..f4ed99a62 100644 --- a/4.0/alpine3.23/Dockerfile +++ b/4.0/alpine3.23/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/alpine3.24/Dockerfile b/4.0/alpine3.24/Dockerfile index be49267ec..d13b5fb01 100644 --- a/4.0/alpine3.24/Dockerfile +++ b/4.0/alpine3.24/Dockerfile @@ -95,6 +95,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/bookworm/Dockerfile b/4.0/bookworm/Dockerfile index e93a59fc8..0145c09cb 100644 --- a/4.0/bookworm/Dockerfile +++ b/4.0/bookworm/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/slim-bookworm/Dockerfile b/4.0/slim-bookworm/Dockerfile index 020711eb7..e6eae69f7 100644 --- a/4.0/slim-bookworm/Dockerfile +++ b/4.0/slim-bookworm/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/slim-trixie/Dockerfile b/4.0/slim-trixie/Dockerfile index 035a02667..7ff65ec60 100644 --- a/4.0/slim-trixie/Dockerfile +++ b/4.0/slim-trixie/Dockerfile @@ -88,6 +88,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/trixie/Dockerfile b/4.0/trixie/Dockerfile index 8f3244b7c..3ed65ba43 100644 --- a/4.0/trixie/Dockerfile +++ b/4.0/trixie/Dockerfile @@ -63,6 +63,8 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/Dockerfile.template b/Dockerfile.template index 5fdb9cce7..b6b0102e0 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -194,6 +194,8 @@ RUN set -eux; \ {{ ) else "" end -}} autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup + export LDFLAGS="-Wl,-z,relro,-z,now${LDFLAGS:+ $LDFLAGS}"; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \