Automatic merge of trunk into multilib

chapter05/gcc-pass1.xml

@@ -167,6 +167,20 @@ cd       build</userinput></screen>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+      <term><parameter>--enable-default-pie and
+      --enable-default-ssp</parameter></term>
+        <listitem>
+          <para>Those switches allow GCC to compile programs with
+	  some hardening security features (more information on those in
+	  the <xref linkend="pie-ssp-info"/> in chapter 8). They are not
+	  strictly needed at this stage, since the compiler will only produce
+	  temporary executables. But it is cleaner to have the temporary
+	  packages be as close as possible to the final ones.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><parameter>--disable-shared</parameter></term>
         <listitem>

chapter08/gcc.xml

@@ -124,6 +124,23 @@ cd       build</userinput></screen>
       </varlistentry>
     </variablelist>
 
+    <note id="pie-ssp-info" xreflabel="note on PIE and SSP">
+      <para>
+        PIE (position independent executable) is a technique to produce
+        binary programs that can be loaded anywhere in memory. Together
+        with a feature named ASLR (Address Space Layout Randomization),
+        this allows programs to never have the same memory layout,
+        thus defeating attacks based on reproducible memory patterns.
+      </para>
+      <para>
+        SSP (Stack Smashing Protection) is a technique to ensure
+        that the parameter stack is not corrupted. Stack corruption can
+        for example alter the return address of a subroutine,
+        which would allow transferring control to an attacker program instead
+        of the original one.
+      </para>
+    </note>
+
     <para>Compile the package:</para>
 
 <screen><userinput remap="make">make</userinput></screen>
@@ -157,6 +174,10 @@ su tester -c "PATH=$PATH make -k check"</userinput></screen>
     url="&test-results;"/> and
     <ulink url="https://gcc.gnu.org/ml/gcc-testresults/"/>.</para>
 
+    <para>In gcc, eleven tests, in the i386 test suite are known to FAIL.
+    It's because the test files do not account for the
+    <parameter>--enable-default-pie</parameter> option.</para>
+
     <para>In g++, four tests related to PR100400 are known to be reported
     as both XPASS and FAIL.  It's because the test file for this known issue
     is not well written.</para>