build with -fstack-protector by default

[lennart]

Some distributions enable -fstack-protector globally (such as Ubuntu), others don't (such as Debian).

It makes sense to enable this feature explicitly for Avahi, since we are a networked service and we don't do anything particularly problematic which would be incompatible with it.

Needs some autoconf magic, of course, since it is only available in gcc 4.1 and some patched versions of gcc 3.x.

Also build everything as a PIE/PIC to make address space randomization actually work.

[tedp]

Here are some macros that might help out: http://bugs.debian.org/cgi-bin/bugreport.cgi/gcc_stack_protect.m4?bug=366094;msg=17;att=3

You're not meant to have to add -lssp to the LDFLAGS manually, but I've found I had to on a few occasions. I think Lennart suggested putting -lssp in LIBS instead of LDFLAGS.

[lennart]

(In [1411]) add gcc stack protector m4 to svn. unfortunately we cannot enable it (yet), because it breaks our build in avahi-glib, due to some unknonwn reason. tedp, help me! (re #105)

[tedp]

If you add -Wl,-z,defs to LDFLAGS (please do!) it will detect unresolved symbols in avahi-common:

.libs/libavahi_common_la-domain.o: In function `avahi_service_name_split':
/tmp/avahi-trunk/avahi-common/domain.c:575: undefined reference to `__stack_chk_fail_local'

This turns out to be a bug in glibc (fixed in glibc 2.5 by Ulrich Drepper, 2006-07-28). I have played around trying to create a test case, but no luck yet.

-fstack-protector works fine with glibc 2.5, or with '-lssp' if ssp support is not included in libc. Debian 4.0 is currently broken in this way (as of libc6 2.3.6.ds1-13), so it would be nice to have a configure test to work around an affected libc.

Yes, the '-lssp' should be added to LIBS not LDFLAGS in the autoconf macro (although that might be unnecessary since ssp has been folded into libc).

If anyone wants to have a go at creating an autoconf test for this problem, it would be great.

[tedp]

For the benefit of search engines, without -Wl,-z,defs in the linker options you'll get an error message more like this when something tries to link with the library:

/usr/bin/ld: .libs/glib-watch-test: hidden symbol `__stack_chk_fail_local' in /usr/lib/gcc/i486-linux-gnu/4.1.2/libssp_nonshared.a(libssp_nonshared_la-ssp-local.o) is referenced by DSO
/usr/bin/ld: final link failed: Nonrepresentable section on output

[tedp]

Better autoconf macros

[tedp]

Tests for buggy stack-smashing protection

[lennart]

(In [1440]) Yes, I suck. This commit contains two totally unrelated changes and I really should commit them seperately, but I am ignoring my own rules, and do it in a single commit. I suck. I really do. I am sorry. Please don't try this at home. And please don't tell your children!

* Show properly that avahi-autoipd is not built if libdaemon is missing (Closes #133)

* Enable stack-smashing protection if available and wokring. Patch from tedp. (Closes #105)