glibc adds system-wide loader hardening tunables

glibc is gaining a set of dynamic-loader tunables that let administrators enforce memory-safety and relocation policies system-wide, answering a request from Daniel Colascione for a way to refuse non-PIE executables.

Adhemerval Zanella posted a twelve-part series that introduces glibc.rtld.require_pie, textrel, wx_segments, bind_now, relative_rpath, and relro. Each defaults to today's permissive behavior. Set to the strict value, they make ld.so refuse position-dependent main programs, objects with text relocations, writable-and-executable segments, empty or relative RPATH/RUNPATH entries (which resolve against the working directory and can be abused even for AT_SECURE processes), and binaries lacking PT_GNU_RELRO or immediate binding. A companion glibc.rtld.hardened umbrella turns the whole set on at once, plus the existing execstack lock-down, while still allowing per-setting exceptions in /etc/tunables.conf. Like gcc -fhardened, the umbrella's contents are not ABI and may grow across releases.

The tunables are aimed at nonoverridable entries in /etc/tunables.conf so the policy applies even to setuid and other AT_SECURE processes. Architecture caveats remain: hppa and sparc place the PLT in a WX segment, so wx_segments cannot be enforced there, and older MIPS kernels still need an executable stack.

Along the way the series fixes an aarch64 BTI bug in which remapping writable segments discarded loader relocations and crashed dlopen, switching those cases to mprotect instead. The final patches make three long-standing distribution practices the upstream configure defaults: bind-now linking (full RELRO and a read-only GOT), -fstack-protector-strong, and the highest supported _FORTIFY_SOURCE level. Distributors that already ship these settings gain matching upstream behavior; others can still opt out with the corresponding --disable flags.

Taken together, the work gives distributions a single, documented knob for loader policy rather than a scatter of environment variables and local patches, and it hardens the library build itself to match what major distros already ship.