In preparation for ASLR [1] support add WITH_PIE to support building with -fPIE.

This is currently an opt-in build flag. Once ASLR support is ready and stable it should changed to opt-out and be enabled by default along with ASLR. Each application Makefile uses opt-out to ensure that ASLR will be enabled by default in new directories when the system is compiled with PIE/ASLR. [2] Mark known build failures as NO_PIE for now. The only known runtime failure was rtld. [1] http://www.bsdcan.org/2014/schedule/events/452.en.html Submitted by: Shawn Webb <lattera@gmail.com> Discussed between: des@ and Shawn Webb [2]
svn path=/head/; revision=267233
2014-06-08 17:29:31 +00:00 · 2014-06-08 17:29:31 +00:00 · 864c53ead8 · 2020-12-20 02:59:44 +00:00
commit 864c53ead8
parent 590d636321
151 changed files with 312 additions and 4 deletions
--- a/Makefile.inc1
+++ b/Makefile.inc1
@ -245,7 +245,7 @@ BMAKE=		MAKEOBJDIRPREFIX=${WORLDTMP} \
 		${BMAKEENV} ${MAKE} ${WORLD_FLAGS} -f Makefile.inc1 \
 		DESTDIR= \
 		BOOTSTRAPPING=${OSRELDATE} \
-		SSP_CFLAGS= \
+		SSP_CFLAGS= MK_PIE=no \
 		MK_HTML=no MK_INFO=no NO_LINT=yes MK_MAN=no \
 		-DNO_PIC MK_PROFILE=no -DNO_SHARED \
 		-DNO_CPU_CFLAGS MK_WARNS=no MK_CTF=no \
@ -257,7 +257,7 @@ TMAKE=		MAKEOBJDIRPREFIX=${OBJTREE} \
 		TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH} \
 		DESTDIR= \
 		BOOTSTRAPPING=${OSRELDATE} \
-		SSP_CFLAGS= \
+		SSP_CFLAGS= MK_PIE=no \
 		-DNO_LINT \
 		-DNO_CPU_CFLAGS MK_WARNS=no MK_CTF=no MK_CLANG_FULL=no MK_LLDB=no MK_TESTS=no

@ -275,7 +275,7 @@ KTMAKE=		TOOLS_PREFIX=${WORLDTMP} MAKEOBJDIRPREFIX=${WORLDTMP} \
 		${KTMAKEENV} ${MAKE} ${WORLD_FLAGS} -f Makefile.inc1 \
 		DESTDIR= \
 		BOOTSTRAPPING=${OSRELDATE} \
-		SSP_CFLAGS= \
+		SSP_CFLAGS= MK_PIE=no \
 		MK_HTML=no MK_INFO=no -DNO_LINT MK_MAN=no \
 		-DNO_PIC MK_PROFILE=no -DNO_SHARED \
 		-DNO_CPU_CFLAGS MK_WARNS=no MK_CTF=no
--- a/bin/rmail/Makefile
+++ b/bin/rmail/Makefile
@ -14,6 +14,8 @@ MAN=	rmail.8
 WARNS?=	2
 CFLAGS+=-I${SENDMAIL_DIR}/include -I.

+NO_PIE=	yes
+
 LIBSMDIR=	${.OBJDIR}/../../lib/libsm
 LIBSM=		${LIBSMDIR}/libsm.a

--- a/gnu/usr.bin/binutils/addr2line/Makefile
+++ b/gnu/usr.bin/binutils/addr2line/Makefile
@ -14,4 +14,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/nm/Makefile
+++ b/gnu/usr.bin/binutils/nm/Makefile
@ -15,4 +15,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/objcopy/Makefile
+++ b/gnu/usr.bin/binutils/objcopy/Makefile
@ -14,4 +14,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/objdump/Makefile
+++ b/gnu/usr.bin/binutils/objdump/Makefile
@ -16,4 +16,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/readelf/Makefile
+++ b/gnu/usr.bin/binutils/readelf/Makefile
@ -17,4 +17,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/size/Makefile
+++ b/gnu/usr.bin/binutils/size/Makefile
@ -14,4 +14,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/strings/Makefile
+++ b/gnu/usr.bin/binutils/strings/Makefile
@ -14,4 +14,6 @@ DPADD+=	${RELTOP}/libbfd/libbfd.a
 DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/binutils/strip/Makefile
+++ b/gnu/usr.bin/binutils/strip/Makefile
@ -15,4 +15,6 @@ DPADD+=	${RELTOP}/libiberty/libiberty.a
 LDADD=	${DPADD}
 INSTALLFLAGS= -S

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/gdb/gdb/Makefile
+++ b/gnu/usr.bin/gdb/gdb/Makefile
@ -14,5 +14,7 @@ LDFLAGS+= -Wl,-E
 DPADD=	${GDBLIBS} ${BULIBS} ${LIBM} ${LIBREADLINE} ${LIBTERMCAP} ${LIBGNUREGEX}
 LDADD=	${GDBLIBS} ${BULIBS} -lm -lreadline -ltermcap -lgnuregex

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
 CFLAGS+=	-DDEBUGDIR=\"${DEBUGDIR}\"
--- a/gnu/usr.bin/gdb/gdbtui/Makefile
+++ b/gnu/usr.bin/gdb/gdbtui/Makefile
@ -15,4 +15,6 @@ LDFLAGS+= -Wl,-E
 DPADD=	${GDBLIBS} ${BULIBS} ${LIBM} ${LIBREADLINE} ${LIBTERMCAP} ${LIBGNUREGEX}
 LDADD=	${GDBLIBS} ${BULIBS} -lm -lreadline -ltermcap -lgnuregex

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/gdb/kgdb/Makefile
+++ b/gnu/usr.bin/gdb/kgdb/Makefile
@ -17,4 +17,6 @@ LDADD=	${GDBLIBS} ${BULIBS} -lkvm${GDB_SUFFIX} -lm -lreadline -ltermcap \
 CFLAGS+= -Wl,-export-dynamic
 .endif

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grodvi/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grodvi/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grohtml/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grohtml/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 MAN=

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grolbp/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grolbp/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grolj4/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grolj4/Makefile
@ -7,4 +7,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grops/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grops/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/devices/grotty/Makefile
+++ b/gnu/usr.bin/groff/src/devices/grotty/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBDRIVER} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBDRIVER} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/eqn/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/eqn/Makefile
@ -11,6 +11,8 @@ SCRIPTS=	neqn
 MAN=		eqn.1 neqn.1
 CLEANFILES=	eqn.cpp eqn_tab.h ${SCRIPTS} ${MAN} y.tab.c y.tab.h

+NO_PIE=	yes
+
 eqn_tab.h: eqn.cpp

 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/grn/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/grn/Makefile
@ -6,4 +6,6 @@ DPADD=	 	${LIBGROFF} ${LIBM}
 LDADD=	 	${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/html/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/html/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF}
 LDADD=		${LIBGROFF}
 MAN=

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/pic/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/pic/Makefile
@ -8,6 +8,8 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	${MAN} pic.cpp pic_tab.h y.tab.c y.tab.h

+NO_PIE=	yes
+
 pic_tab.h: pic.cpp

 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/refer/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/refer/Makefile
@ -7,4 +7,6 @@ DPADD=		${LIBBIB} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBBIB} ${LIBGROFF} -lm
 CLEANFILES=	label.cpp label_tab.h ${MAN} y.tab.c y.tab.h

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/soelim/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/soelim/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF}
 LDADD=		${LIBGROFF}
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/preproc/tbl/Makefile
+++ b/gnu/usr.bin/groff/src/preproc/tbl/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/roff/groff/Makefile
+++ b/gnu/usr.bin/groff/src/roff/groff/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/roff/troff/Makefile
+++ b/gnu/usr.bin/groff/src/roff/troff/Makefile
@ -7,6 +7,8 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	majorminor.cpp ${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 majorminor.cpp: ${GROFF_DIST}/VERSION ${GROFF_DIST}/REVISION
--- a/gnu/usr.bin/groff/src/utils/addftinfo/Makefile
+++ b/gnu/usr.bin/groff/src/utils/addftinfo/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF}
 LDADD=		${LIBGROFF}
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/utils/hpftodit/Makefile
+++ b/gnu/usr.bin/groff/src/utils/hpftodit/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/utils/indxbib/Makefile
+++ b/gnu/usr.bin/groff/src/utils/indxbib/Makefile
@ -6,6 +6,8 @@ DPADD=		${LIBBIB} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBBIB} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 beforeinstall:
 	${INSTALL} -o ${BINOWN} -g ${BINGRP} -m ${NOBINMODE} \
 	    ${DIST_DIR}/eign ${DESTDIR}${SHAREDIR}/dict/
--- a/gnu/usr.bin/groff/src/utils/lkbib/Makefile
+++ b/gnu/usr.bin/groff/src/utils/lkbib/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBBIB} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBBIB} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/utils/lookbib/Makefile
+++ b/gnu/usr.bin/groff/src/utils/lookbib/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBBIB} ${LIBGROFF} ${LIBM}
 LDADD=		${LIBBIB} ${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/groff/src/utils/tfmtodit/Makefile
+++ b/gnu/usr.bin/groff/src/utils/tfmtodit/Makefile
@ -6,4 +6,6 @@ DPADD=		${LIBGROFF} ${LIBM}
 LDADD=		${LIBGROFF} -lm
 CLEANFILES=	${MAN}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/gnu/usr.bin/rcs/Makefile.inc
+++ b/gnu/usr.bin/rcs/Makefile.inc
@ -1,3 +1,4 @@
 # $FreeBSD$

 LIBRCS=	${.OBJDIR}/../lib/librcs.a
+NO_PIE=	yes
--- a/gnu/usr.bin/texinfo/info/Makefile
+++ b/gnu/usr.bin/texinfo/info/Makefile
@ -13,6 +13,8 @@ CFLAGS+= -DINFODIR=\"${INFODIR}:/usr/local/info:.\"
 DPADD=	${LIBTERMCAP} ${LIBTXI}
 LDADD=	-ltermcap ${LIBTXI}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH:	${TXIDIR}/info ${TXIDIR}/doc
--- a/gnu/usr.bin/texinfo/infokey/Makefile
+++ b/gnu/usr.bin/texinfo/infokey/Makefile
@ -6,6 +6,8 @@ SRCS=	infokey.c key.c
 DPADD=	${LIBTXI}
 LDADD=	${LIBTXI}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH:	${TXIDIR}/info ${TXIDIR}/doc
--- a/gnu/usr.bin/texinfo/install-info/Makefile
+++ b/gnu/usr.bin/texinfo/install-info/Makefile
@ -5,6 +5,8 @@ PROG=	install-info
 DPADD=	${LIBTXI}
 LDADD=	${LIBTXI}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH:	${TXIDIR}/util ${TXIDIR}/doc
--- a/gnu/usr.bin/texinfo/makeinfo/Makefile
+++ b/gnu/usr.bin/texinfo/makeinfo/Makefile
@ -8,6 +8,8 @@ SRCS=	cmds.c defun.c files.c float.c footnote.c html.c \
 DPADD=	${LIBTXI}
 LDADD=	${LIBTXI}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH:	$(TXIDIR)/makeinfo $(TXIDIR)/doc
--- a/gnu/usr.bin/texinfo/texindex/Makefile
+++ b/gnu/usr.bin/texinfo/texindex/Makefile
@ -5,6 +5,8 @@ PROG=	texindex
 DPADD=	${LIBTXI}
 LDADD=	${LIBTXI}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH:	${TXIDIR}/util ${TXIDIR}/doc
--- a/kerberos5/libexec/digest-service/Makefile
+++ b/kerberos5/libexec/digest-service/Makefile
@ -14,6 +14,8 @@ LDADD=	-lhdb -lkdc -lheimipcs -lkrb5 -lroken -lasn1 -lcrypto -lcrypt \
 	${LIBVERS} -lheimntlm
 USEPRIVATELIB= heimipcs

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/libexec/hprop/Makefile
+++ b/kerberos5/libexec/hprop/Makefile
@ -16,6 +16,8 @@ LDADD=	-lhdb -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/libexec/hpropd/Makefile
+++ b/kerberos5/libexec/hpropd/Makefile
@ -10,6 +10,8 @@ LDADD=	-lhdb -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/libexec/ipropd-master/Makefile
+++ b/kerberos5/libexec/ipropd-master/Makefile
@ -11,6 +11,8 @@ LDADD=	-lkadm5srv -lhdb -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 foo::
 	echo ${LIBHX509}

--- a/kerberos5/libexec/ipropd-slave/Makefile
+++ b/kerberos5/libexec/ipropd-slave/Makefile
@ -11,6 +11,8 @@ LDADD=	-lkadm5srv -lhdb -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/lib/kadm5
--- a/kerberos5/libexec/kadmind/Makefile
+++ b/kerberos5/libexec/kadmind/Makefile
@ -15,6 +15,8 @@ LDADD=	-lkadm5srv -lgssapi -lhdb -lkrb5 -lroken \
 	-lasn1 ${LIBVERS} -lcrypto -lcrypt ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kadmin
--- a/kerberos5/libexec/kcm/Makefile
+++ b/kerberos5/libexec/kcm/Makefile
@ -26,6 +26,8 @@ LDADD=	-lhdb -lkrb5 -lroken -lasn1 -lheimntlm -lheimipcs \
 USEPRIVATELIB= heimipcs
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kcm
--- a/kerberos5/libexec/kdc/Makefile
+++ b/kerberos5/libexec/kdc/Makefile
@ -14,6 +14,8 @@ DPADD=	${LIBKDC} ${LIBHDB} ${LIBKRB5} ${LIBROKEN} ${LIBASN1} \
 	${LIBCRYPTO} ${LIBCRYPT} ${LIBVERS}
 LDADD=	-lkdc -lhdb -lkrb5 -lroken -lasn1 -lcrypto -lcrypt ${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/libexec/kdigest/Makefile
+++ b/kerberos5/libexec/kdigest/Makefile
@ -13,6 +13,8 @@ SRCS=	kdigest.c \
 	kdigest-commands.c \
 	kdigest-commands.h

+NO_PIE=	yes
+
 kdigest-commands.h: kdigest-commands.in
 	${SLC} ${.ALLSRC:M*.in}

--- a/kerberos5/libexec/kfd/Makefile
+++ b/kerberos5/libexec/kfd/Makefile
@ -9,6 +9,8 @@ DPADD=	${LIBKRB5} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO} \
 LDADD=	-lkrb5 -lroken -lasn1 -lcrypto -lcrypt \
 	${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/appl/kf
--- a/kerberos5/libexec/kimpersonate/Makefile
+++ b/kerberos5/libexec/kimpersonate/Makefile
@ -11,6 +11,8 @@ DPADD=	${LIBKAFS5} ${LIBKRB5} ${LIBHEIMNTLM} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO}
 LDADD=	-lkafs5 -lkrb5 -lheimntlm -lroken -lasn1 -lcrypto -lcrypt \
 	${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kuser
--- a/kerberos5/libexec/kpasswdd/Makefile
+++ b/kerberos5/libexec/kpasswdd/Makefile
@ -9,6 +9,8 @@ LDADD=	-lkadm5srv -lhdb -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kpasswd
--- a/kerberos5/tools/asn1_compile/Makefile
+++ b/kerberos5/tools/asn1_compile/Makefile
@ -27,6 +27,8 @@ CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/asn1 -I.

 CLEANFILES= roken.h lex.c parse.c

+NO_PIE=	yes
+
 roken.h:
 	 make-roken > ${.TARGET}

--- a/kerberos5/tools/slc/Makefile
+++ b/kerberos5/tools/slc/Makefile
@ -14,6 +14,8 @@ CFLAGS+=-I${KRB5DIR}/lib/roken -I${KRB5DIR}/lib/sl -I${KRB5DIR}/lib/vers -I.

 CLEANFILES= roken.h slc-gram.c slc-lex.c

+NO_PIE=	yes
+
 roken.h:
 	${MAKE_ROKEN} > ${.TARGET}

--- a/kerberos5/usr.bin/hxtool/Makefile
+++ b/kerberos5/usr.bin/hxtool/Makefile
@ -10,6 +10,8 @@ DPADD=	${LIBHX509} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO} ${LIBCRYPT} ${LIBSL} ${LI
 LDADD=	-lhx509 -lroken -lasn1 -lcrypto -lcrypt ${LIBSL} ${LIBVERS} -ledit
 SRCS=	hxtool.c hxtool-commands.c hxtool-commands.h

+NO_PIE=	yes
+
 hxtool-commands.h: hxtool-commands.in
 	${SLC} ${.ALLSRC:M*.in}

--- a/kerberos5/usr.bin/kadmin/Makefile
+++ b/kerberos5/usr.bin/kadmin/Makefile
@ -36,6 +36,8 @@ LDADD=	-lkadm5clnt -lkadm5srv -lhdb -lkrb5 -lhx509 \
 	-ledit -lncurses ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 kadmin-commands.h: ${KRB5DIR}/kadmin/kadmin-commands.in
--- a/kerberos5/usr.bin/kcc/Makefile
+++ b/kerberos5/usr.bin/kcc/Makefile
@ -19,6 +19,8 @@ SRCS=	kcc.c \
 	kswitch.c \
 	copy_cred_cache.c

+NO_PIE=	yes
+
 kcc-commands.h: kcc-commands.in
 	${SLC} ${.ALLSRC:M*.in}

--- a/kerberos5/usr.bin/kdestroy/Makefile
+++ b/kerberos5/usr.bin/kdestroy/Makefile
@ -8,6 +8,8 @@ LDADD=	-lkafs5 -lkrb5 -lheimntlm -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt
 MAN=	kdestroy.1

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kuser
--- a/kerberos5/usr.bin/kf/Makefile
+++ b/kerberos5/usr.bin/kf/Makefile
@ -9,6 +9,8 @@ DPADD=	${LIBKRB5} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO} \
 LDADD=	-lkrb5 -lroken -lasn1 -lcrypto -lcrypt \
 	${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/appl/kf
--- a/kerberos5/usr.bin/kgetcred/Makefile
+++ b/kerberos5/usr.bin/kgetcred/Makefile
@ -6,6 +6,8 @@ CFLAGS+=	-I${KRB5DIR}/lib/asn1 \
 DPADD=	${LIBKRB5} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO} ${LIBCRYPT} ${LIBVERS}
 LDADD=	-lkrb5 -lroken -lasn1 -lcrypto -lcrypt ${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kuser
--- a/kerberos5/usr.bin/kinit/Makefile
+++ b/kerberos5/usr.bin/kinit/Makefile
@ -7,6 +7,8 @@ DPADD=	${LIBKAFS5} ${LIBKRB5} ${LIBHEIMNTLM} ${LIBROKEN} ${LIBVERS} \
 LDADD=	-lkafs5 -lkrb5 -lheimntlm -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kuser
--- a/kerberos5/usr.bin/kpasswd/Makefile
+++ b/kerberos5/usr.bin/kpasswd/Makefile
@ -7,6 +7,8 @@ DPADD=	${LIBKRB5} ${LIBHX509} ${LIBROKEN} ${LIBVERS} \
 LDADD=	-lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kpasswd
--- a/kerberos5/usr.bin/ksu/Makefile
+++ b/kerberos5/usr.bin/ksu/Makefile
@ -13,6 +13,8 @@ DPADD=	${LIBKAFS5} ${LIBKRB5} ${LIBHX509} ${LIBROKEN} ${LIBVERS} \
 LDADD=	-lkafs5 -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/appl/su
--- a/kerberos5/usr.bin/string2key/Makefile
+++ b/kerberos5/usr.bin/string2key/Makefile
@ -11,6 +11,8 @@ DPADD=	${LIBHDB} ${LIBKRB5} ${LIBROKEN} ${LIBASN1} ${LIBCRYPTO} \
 	${LIBCRYPT} ${LIBVERS}
 LDADD=	-lhdb -lkrb5 -lroken -lasn1 -lcrypto -lcrypt ${LIBVERS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/usr.bin/verify_krb5_conf/Makefile
+++ b/kerberos5/usr.bin/verify_krb5_conf/Makefile
@ -8,6 +8,8 @@ DPADD=	${LIBKAFS5} ${LIBKRB5} ${LIBHX509} ${LIBROKEN} ${LIBVERS} \
 LDADD=	-lkafs5 -lkrb5 -lhx509 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -lcom_err

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/lib/krb5
--- a/kerberos5/usr.sbin/iprop-log/Makefile
+++ b/kerberos5/usr.sbin/iprop-log/Makefile
@ -13,6 +13,8 @@ DPADD=	${LIBKADM5SRV} ${LIBHDB} ${LIBKRB5} ${LIBASN1} ${LIBCRYPTO} \
 LDADD=	-lkadm5srv -lhdb -lkrb5 -lasn1 -lcrypto -lcrypt ${LIBSL} -lroken \
 	${LIBVERS} -ledit

+NO_PIE=	yes
+
 iprop-commands.h: iprop-commands.in
 	${SLC} ${.ALLSRC:M*.in}

--- a/kerberos5/usr.sbin/kstash/Makefile
+++ b/kerberos5/usr.sbin/kstash/Makefile
@ -10,6 +10,8 @@ LDADD=	-lhdb -lkrb5 -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt ${LDAPLDADD}
 LDFLAGS=${LDAPLDFLAGS}

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 .PATH: ${KRB5DIR}/kdc
--- a/kerberos5/usr.sbin/ktutil/Makefile
+++ b/kerberos5/usr.sbin/ktutil/Makefile
@ -22,6 +22,8 @@ DPADD=	${LIBKADM5CLNT} ${LIBKRB5} ${LIBSL} ${LIBROKEN} ${LIBVERS} \
 LDADD=	-lkadm5clnt -lkrb5 ${LIBSL} -lroken ${LIBVERS} \
 	-lasn1 -lcrypto -lcrypt -ledit

+NO_PIE=	yes
+
 .include <bsd.prog.mk>

 ktutil-commands.h: ${KRB5DIR}/admin/ktutil-commands.in
--- a/lib/csu/amd64/Makefile
+++ b/lib/csu/amd64/Makefile
@ -9,6 +9,8 @@ CFLAGS+=	-I${.CURDIR}/../common \
 		-I${.CURDIR}/../../libc/include
 CFLAGS+=	-fno-omit-frame-pointer

+NO_PIE=	yes
+
 all: ${OBJS}

 CLEANFILES=	${OBJS}
--- a/lib/csu/i386-elf/Makefile
+++ b/lib/csu/i386-elf/Makefile
@ -13,6 +13,8 @@ CFLAGS+=	-I${.CURDIR}/../common \
 CLEANFILES=	${FILES} crt1_c.o crt1_s.o gcrt1_c.o Scrt1_c.o
 CLEANFILES+=	crt1_c.s gcrt1_c.s Scrt1_c.s

+NO_PIE=	yes
+
 # See the comment in lib/csu/common/crtbrand.c for the reason crt1_c.c is not
 # directly compiled to .o files.

--- a/libexec/mail.local/Makefile
+++ b/libexec/mail.local/Makefile
@ -9,6 +9,8 @@ SRCS=	mail.local.c
 MAN=	mail.local.8
 CFLAGS+=-I${SENDMAIL_DIR}/include -I.

+NO_PIE=	yes
+
 WARNS?=	2
 WFORMAT=0

--- a/libexec/rtld-elf/Makefile
+++ b/libexec/rtld-elf/Makefile
@ -78,5 +78,7 @@ beforeinstall:

 .PATH: ${.CURDIR}/${RTLD_ARCH}

+NO_PIE=	yes
+
 .include <bsd.symver.mk>
 .include <bsd.prog.mk>
--- a/libexec/smrsh/Makefile
+++ b/libexec/smrsh/Makefile
@ -9,6 +9,8 @@ SRCS=	smrsh.c
 MAN=	smrsh.8
 CFLAGS+=-I${SENDMAIL_DIR}/src -I${SENDMAIL_DIR}/include -I.

+NO_PIE=	yes
+
 LIBSMDIR=	${.OBJDIR}/../../lib/libsm
 LIBSM=		${LIBSMDIR}/libsm.a

--- a/libexec/telnetd/Makefile
+++ b/libexec/telnetd/Makefile
@ -20,6 +20,8 @@ WFORMAT?=	0
 CFLAGS+=	-DLINEMODE -DUSE_TERMIO -DDIAGNOSTICS -DOLD_ENVIRON \
 		-DENV_HACK -DSTREAMSPTY

+NO_PIE=	yes
+
 .if ${MK_INET6_SUPPORT} != "no"
 CFLAGS+=	-DINET6
 .endif
--- a/sbin/fsck/Makefile
+++ b/sbin/fsck/Makefile
@ -5,4 +5,6 @@ PROG=	fsck
 SRCS=	fsck.c fsutil.c preen.c
 MAN=	fsck.8

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/sbin/ipf/ipf/Makefile
+++ b/sbin/ipf/ipf/Makefile
@ -39,4 +39,6 @@ DPADD+=	${LIBPCAP}
 LDADD+=	-lpcap
 .endif

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/sbin/ipf/ipfstat/Makefile
+++ b/sbin/ipf/ipfstat/Makefile
@ -8,4 +8,6 @@ MAN=		ipfstat.8
 DPADD+=  	${LIBCURSES}
 LDADD+=  	-lcurses

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/sbin/ipf/ipftest/Makefile
+++ b/sbin/ipf/ipftest/Makefile
@ -32,6 +32,8 @@ CLEANFILES+=	ipnat.tab.c ipnat.tab.h
 CLEANFILES+=	ippool_y.c ippool_l.c
 CLEANFILES+=	ippool.tab.c ippool.tab.h

+NO_PIE=	yes
+
 ipnat_y.c: ipnat_y.y
 	${YACC} -b ipnat -d ${.ALLSRC}
 	sed -e 's/yy/ipnat_yy/g' \
--- a/sbin/ipf/ipmon/Makefile
+++ b/sbin/ipf/ipmon/Makefile
@ -11,6 +11,8 @@ DPSRCS+=	${GENHDRS}

 CLEANFILES+=	${GENHDRS} ipmon_y.c ipmon_l.c

+NO_PIE=	yes
+
 ipmon_y.c: ipmon_y.y
 	${YACC} -d ${.ALLSRC}
 	sed -e 's/yy/ipmon_yy/g' \
--- a/sbin/ipf/ipnat/Makefile
+++ b/sbin/ipf/ipnat/Makefile
@ -11,6 +11,8 @@ DPSRCS+=	${GENHDRS}

 CLEANFILES+=	${GENHDRS} ipnat_y.c ipnat_l.c

+NO_PIE=	yes
+
 ipnat_y.c: ipnat_y.y
 	${YACC} -d ${.ALLSRC}
 	sed -e 's/yy/ipnat_yy/g' \
--- a/sbin/ipf/ippool/Makefile
+++ b/sbin/ipf/ippool/Makefile
@ -10,6 +10,8 @@ DPSRCS+=	${GENHDRS}

 CLEANFILES+=	${GENHDRS} ippool_y.c ippool_l.c

+NO_PIE=	yes
+
 ippool_y.c: ippool_y.y
 	${YACC} -d ${.ALLSRC}
 	sed -e 's/yy/ippool_yy/g' \
--- a/sbin/ipf/ipresend/Makefile
+++ b/sbin/ipf/ipresend/Makefile
@ -4,6 +4,8 @@ PROG=		ipresend
 SRCS=		ipresend.c ip.c resend.c sbpf.c sock.c 44arp.c
 MAN=		ipresend.1

+NO_PIE=	yes
+
 .PATH:		${.CURDIR}/../../../contrib/ipfilter/ipsend

 .include <bsd.prog.mk>
--- a/sbin/rcorder/Makefile
+++ b/sbin/rcorder/Makefile
@ -14,6 +14,8 @@ CFLAGS+= -DORDER -I.
 SRCS+=	util.h
 CLEANFILES+=	util.h

+NO_PIE=	yes
+
 util.h:
 	ln -sf ${.CURDIR}/../../lib/libutil/libutil.h ${.TARGET}

--- a/share/mk/bsd.opts.mk
+++ b/share/mk/bsd.opts.mk
@ -68,7 +68,8 @@ __DEFAULT_YES_OPTIONS = \
 __DEFAULT_NO_OPTIONS = \
    CTF \
    DEBUG_FILES \
-    INSTALL_AS_USER
+    INSTALL_AS_USER \
+    PIE

 .include <bsd.mkopt.mk>

--- a/share/mk/bsd.prog.mk
+++ b/share/mk/bsd.prog.mk
@ -11,6 +11,18 @@
 CFLAGS+=${COPTS}
 .endif

+.if ${MK_PIE} != "no" && (!defined(NO_PIE) || ${NO_PIE} == "no")
+.if !defined(RESCUE) && !defined(NO_SHARED)
+CFLAGS+= -fPIE -pie
+LDFLAGS+= -pie
+.elif defined(NO_SHARED)
+.if ${NO_SHARED} == "no" || ${NO_SHARED} == "NO"
+CFLAGS+= -fPIE -pie
+LDFLAGS+= -pie
+.endif
+.endif
+.endif
+
 .if ${MK_ASSERT_DEBUG} == "no"
 CFLAGS+= -DNDEBUG
 NO_WERROR=
--- a/sys/boot/i386/boot2/Makefile
+++ b/sys/boot/i386/boot2/Makefile
@ -22,6 +22,8 @@ BOOT2_UFS?=	UFS1_AND_UFS2
 #BOOT2_UFS?=	UFS2_ONLY
 #BOOT2_UFS?=	UFS1_ONLY

+NO_PIE=	yes
+
 CFLAGS=	-Os \
 	-fomit-frame-pointer \
 	-mrtd \
--- a/sys/boot/i386/btx/btx/Makefile
+++ b/sys/boot/i386/btx/btx/Makefile
@ -5,6 +5,8 @@ INTERNALPROG=
 MAN=
 SRCS=	btx.S

+NO_PIE=	yes
+
 .if defined(BOOT_BTX_NOHANG)
 BOOT_BTX_FLAGS=0x1
 .else
--- a/sys/boot/i386/btx/btxldr/Makefile
+++ b/sys/boot/i386/btx/btxldr/Makefile
@ -5,6 +5,8 @@ INTERNALPROG=
 MAN=
 SRCS=	btxldr.S

+NO_PIE=	yes
+
 CFLAGS+=-DLOADER_ADDRESS=${LOADER_ADDRESS}
 CFLAGS+=-I${.CURDIR}/../../common

--- a/sys/boot/i386/btx/lib/Makefile
+++ b/sys/boot/i386/btx/lib/Makefile
@ -7,4 +7,6 @@ SRCS=	btxcsu.S btxsys.s btxv86.s
 CFLAGS+=-I${.CURDIR}/../../common
 LDFLAGS=-Wl,-r

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/sys/boot/i386/loader/Makefile
+++ b/sys/boot/i386/loader/Makefile
@ -8,6 +8,8 @@ PROG=		${LOADER}.sym
 INTERNALPROG=
 NEWVERSWHAT?=	"bootstrap loader" x86

+NO_PIE=	yes
+
 # architecture-specific loader code
 SRCS=		main.c conf.c vers.c

--- a/sys/boot/mips/beri/boot2/Makefile
+++ b/sys/boot/mips/beri/boot2/Makefile
@ -32,6 +32,8 @@
 BINDIR?=	/boot
 INSTALLFLAGS=	-b

+NO_PIE=	yes
+
 LOADERS=	flashboot jtagboot
 FILES=		${LOADERS} ${LOADERS:S/$/.md5/}

--- a/sys/boot/mips/beri/loader/Makefile
+++ b/sys/boot/mips/beri/loader/Makefile
@ -36,6 +36,8 @@ PROG?=		loader
 NEWVERSWHAT=	"BERI loader" ${MACHINE_CPUARCH}
 INSTALLFLAGS=	-b

+NO_PIE=	yes
+
 # Architecture-specific loader code
 SRCS=		start.S						\
 		main.c						\
--- a/sys/boot/pc98/boot2/Makefile
+++ b/sys/boot/pc98/boot2/Makefile
@ -6,6 +6,8 @@
 CC:=		gcc
 COMPILER_TYPE:=	gcc

+NO_PIE=	yes
+
 FILES=		boot boot1 boot2

 NM?=		nm
--- a/sys/boot/pc98/btx/lib/Makefile
+++ b/sys/boot/pc98/btx/lib/Makefile
@ -7,4 +7,6 @@ SRCS=	btxcsu.S btxsys.s btxv86.s
 CFLAGS+=-I${.CURDIR}/../../../i386/common
 LDFLAGS=-Wl,-r

+NO_PIE=	yes
+
 .include <bsd.prog.mk>
--- a/sys/boot/pc98/loader/Makefile
+++ b/sys/boot/pc98/loader/Makefile
@ -8,6 +8,8 @@ PROG=		${LOADER}.sym
 INTERNALPROG=
 NEWVERSWHAT=	"bootstrap loader" pc98

+NO_PIE=	yes
+
 # architecture-specific loader code
 SRCS=		main.c conf.c vers.c
 .PATH:		${.CURDIR}/../../i386/loader
--- a/sys/boot/sparc64/boot1/Makefile
+++ b/sys/boot/sparc64/boot1/Makefile
@ -7,6 +7,8 @@ FILES?=	boot1
 SRCS=	_start.s boot1.c
 CLEANFILES=${FILES} boot1.aout

+NO_PIE=	yes
+
 BOOTBLOCKBASE= 0x4000

 CFLAGS.clang+=-mcmodel=small
--- a/sys/boot/sparc64/loader/Makefile
+++ b/sys/boot/sparc64/loader/Makefile
@ -7,6 +7,8 @@ PROG?=		loader
 NEWVERSWHAT?=	"bootstrap loader" sparc64
 INSTALLFLAGS=	-b

+NO_PIE=	yes
+
 # Architecture-specific loader code
 SRCS=		locore.S main.c metadata.c vers.c

--- a/tools/build/options/WITH_PIE
+++ b/tools/build/options/WITH_PIE
@ -0,0 +1,2 @@
+.\" $FreeBSD$
+Enable building of Position-Independent Executables (PIEs).
--- a/usr.bin/clang/clang-tblgen/Makefile
+++ b/usr.bin/clang/clang-tblgen/Makefile
@ -19,4 +19,6 @@ SRCS=	ClangASTNodesEmitter.cpp \
 LIBDEPS=llvmtablegen \
 	llvmsupport

+NO_PIE=	yes
+
 .include "../clang.prog.mk"
--- a/usr.bin/clang/clang.prog.mk
+++ b/usr.bin/clang/clang.prog.mk
@ -1,5 +1,7 @@
 # $FreeBSD$

+NO_PIE=	yes
+
 LLVM_SRCS= ${.CURDIR}/../../../contrib/llvm

 .include "../../lib/clang/clang.build.mk"
--- a/Show More
+++ b/Show More