[CI] Disable PIE on Linux Premerge Builds #154584
Conversation
We do not gain any additional security from having PIE on the test binaries, and this does have an impact on test times. It is about 10% from my measurements. Not as much as previous reports (https://reviews.llvm.org/D140880), but still significant. This is a similar gain to finish enabling the lit internal shell, which will take significantly more effort.
boomanaiden154
requested review from
Endilll,
Keenuts,
cmtice,
dschuff,
gburgessiv,
rnk and
tstellar
|
This seems reasonable to me, but I would prefer a second opinion on this? |
|
I think this is pretty reasonable. PIE improves ASLR, reducing the ability of a binary to be exploited, but for PRs, people can write whatever code they want into LLVM and we will happily compile and execute it :D |
|
We might even consider doing this in CMake. I'd probably use it on our CI if we had it. |
What do you mean do this in CMake? As in add an additional flag? In https://reviews.llvm.org/D140880 the consensus seemed to be that having a flag doesn't make a lot of sense because it's more complexity in the CMake for about the same number of characters as explicitly setting |
|
Ah yeah I didn't actually read the discussion there. makes sense, and it's easy enough to just do ourselves. |
3 participants
We do not gain any additional security from having PIE on the test binaries, and this does have an impact on test times. It is about 10% from my measurements. Not as much as previous reports (https://reviews.llvm.org/D140880), but still significant. This is a similar gain to finish enabling the lit internal shell, which will take significantly more effort. I also do not think this is a meaningful enough difference from the "default" configuration to keep it the default, especially given the option is mostly set by distros.