guix: build GCC with --enable-host-bind-now
What the developer wrote
Authored by fanquake
guix: build GCC with --enable-host-bind-now
What changed, and why it matters
This commit hardens the Bitcoin Core Guix build by compiling GCC itself with a security flag called --enable-host-bind-now. That flag tells the linker to mark the resulting GCC programs so they resolve all dynamic-library addresses immediately at load time, rather than lazily when first used. This is a defensive hardening measure that makes certain memory-corruption attacks harder, but it is not a fix for a known exploitable bug in Bitcoin Core.
No urgent action required. Treat as routine hardening. Review whether other build environments (non-Guix) apply equivalent hardening to toolchain and release binaries.
Security signals we found
Hardening flag added to compiler build configuration
BIND_NOW / full RELRO-style behavior for toolchain binaries
No functional code change in Bitcoin Core itself
No CVE, bug report, or exploit referenced in commit
Evidence from the diff
The patch adds –enable-host-bind-now=yes to the GCC configure flags used in contrib/guix/manifest.scm for both the base GCC package and the final GCC used in the Guix build environment. BIND_NOW (the runtime effect of this flag) forces the dynamic loader to resolve and bind all PLT/GOT entries before transferring control to the program. This mitigates some lazy-binding attacks (e.g., overwriting GOT/PLT entries after load) and pairs with RELRO. It is a build-hardening change, not a patch for a specific vulnerability.
Changed components
contrib/guix/manifest.scmGuix-based deterministic build toolchainGCC compiler package configurationInspect captured patch +2 / −0
diff --git a/contrib/guix/manifest.scm b/contrib/guix/manifest.scm
index f805ba6d..fd0e2e6a 100644
--- a/contrib/guix/manifest.scm
+++ b/contrib/guix/manifest.scm
@@ -421,6 +421,7 @@ inspecting signatures in Mach-O binaries.")
;; https://gcc.gnu.org/install/configure.html
(list "--enable-threads=posix",
"--enable-default-ssp=yes",
+ "--enable-host-bind-now=yes",
"--disable-gcov",
"--disable-libgomp",
building-on)))))))
@@ -436,6 +437,7 @@ inspecting signatures in Mach-O binaries.")
(list "--enable-initfini-array=yes",
"--enable-default-ssp=yes",
"--enable-default-pie=yes",
+ "--enable-host-bind-now=yes",
"--enable-standard-branch-protection=yes",
"--enable-cet=yes",
"--disable-gcov",
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.