From 11b46206a6d5d4755df64cdd0bb433b3dfe87e2d Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 4 Sep 2026 09:47:39 -0400 Subject: [PATCH] Link Ruby with `-z now` for full RELRO Debian's linker defaults leave `ruby` and `libruby.so` with lazy binding, so their GOTs stay writable for the life of the process and an attacker with an arbitrary write can overwrite them. Export `LDFLAGS` before `configure`. Ruby's `configure` appends to `LDFLAGS` and seeds `DLDFLAGS` from it, so the interpreter, `libruby.so`, and native extensions built downstream all pick it up. The spelling `-Wl,-z,relro -Wl,-z,now` matches what Debian's `hardening=+bindnow` emits for its own `libruby` package. Alpine already links this way, so the change is a no-op there. The image codecs reachable through `libvips` have had many memory safety bugs. A read-only GOT does not fix them, but it removes one of the easier ways to turn a memory write into code execution. --- 3.3/alpine3.23/Dockerfile | 4 ++++ 3.3/alpine3.24/Dockerfile | 4 ++++ 3.3/bookworm/Dockerfile | 4 ++++ 3.3/slim-bookworm/Dockerfile | 4 ++++ 3.3/slim-trixie/Dockerfile | 4 ++++ 3.3/trixie/Dockerfile | 4 ++++ 3.4/alpine3.23/Dockerfile | 4 ++++ 3.4/alpine3.24/Dockerfile | 4 ++++ 3.4/bookworm/Dockerfile | 4 ++++ 3.4/slim-bookworm/Dockerfile | 4 ++++ 3.4/slim-trixie/Dockerfile | 4 ++++ 3.4/trixie/Dockerfile | 4 ++++ 4.0/alpine3.23/Dockerfile | 4 ++++ 4.0/alpine3.24/Dockerfile | 4 ++++ 4.0/bookworm/Dockerfile | 4 ++++ 4.0/slim-bookworm/Dockerfile | 4 ++++ 4.0/slim-trixie/Dockerfile | 4 ++++ 4.0/trixie/Dockerfile | 4 ++++ Dockerfile.template | 4 ++++ 19 files changed, 76 insertions(+) diff --git a/3.3/alpine3.23/Dockerfile b/3.3/alpine3.23/Dockerfile index 63b92bd40..2722a3be9 100644 --- a/3.3/alpine3.23/Dockerfile +++ b/3.3/alpine3.23/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/alpine3.24/Dockerfile b/3.3/alpine3.24/Dockerfile index 118ae595d..8f45fa68b 100644 --- a/3.3/alpine3.24/Dockerfile +++ b/3.3/alpine3.24/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/bookworm/Dockerfile b/3.3/bookworm/Dockerfile index 3180158ff..1929fd1b2 100644 --- a/3.3/bookworm/Dockerfile +++ b/3.3/bookworm/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/slim-bookworm/Dockerfile b/3.3/slim-bookworm/Dockerfile index 340f84d36..39f73a23a 100644 --- a/3.3/slim-bookworm/Dockerfile +++ b/3.3/slim-bookworm/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/slim-trixie/Dockerfile b/3.3/slim-trixie/Dockerfile index 195313510..6e8503ff1 100644 --- a/3.3/slim-trixie/Dockerfile +++ b/3.3/slim-trixie/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.3/trixie/Dockerfile b/3.3/trixie/Dockerfile index f9fe3390c..202c46746 100644 --- a/3.3/trixie/Dockerfile +++ b/3.3/trixie/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/alpine3.23/Dockerfile b/3.4/alpine3.23/Dockerfile index df92bcf0a..2d338eaf5 100644 --- a/3.4/alpine3.23/Dockerfile +++ b/3.4/alpine3.23/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/alpine3.24/Dockerfile b/3.4/alpine3.24/Dockerfile index 6d0c21465..7d8956b6d 100644 --- a/3.4/alpine3.24/Dockerfile +++ b/3.4/alpine3.24/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/bookworm/Dockerfile b/3.4/bookworm/Dockerfile index 9472c0e27..0ba0464a3 100644 --- a/3.4/bookworm/Dockerfile +++ b/3.4/bookworm/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/slim-bookworm/Dockerfile b/3.4/slim-bookworm/Dockerfile index b1eccc954..f3e85b602 100644 --- a/3.4/slim-bookworm/Dockerfile +++ b/3.4/slim-bookworm/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/slim-trixie/Dockerfile b/3.4/slim-trixie/Dockerfile index 076061f05..88f391205 100644 --- a/3.4/slim-trixie/Dockerfile +++ b/3.4/slim-trixie/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/3.4/trixie/Dockerfile b/3.4/trixie/Dockerfile index 093b89ad4..df28804f6 100644 --- a/3.4/trixie/Dockerfile +++ b/3.4/trixie/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/alpine3.23/Dockerfile b/4.0/alpine3.23/Dockerfile index 715da445c..7a060eeef 100644 --- a/4.0/alpine3.23/Dockerfile +++ b/4.0/alpine3.23/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/alpine3.24/Dockerfile b/4.0/alpine3.24/Dockerfile index be49267ec..24d63d092 100644 --- a/4.0/alpine3.24/Dockerfile +++ b/4.0/alpine3.24/Dockerfile @@ -95,6 +95,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/bookworm/Dockerfile b/4.0/bookworm/Dockerfile index e93a59fc8..4cd16ea88 100644 --- a/4.0/bookworm/Dockerfile +++ b/4.0/bookworm/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/slim-bookworm/Dockerfile b/4.0/slim-bookworm/Dockerfile index 020711eb7..6dcab2bb9 100644 --- a/4.0/slim-bookworm/Dockerfile +++ b/4.0/slim-bookworm/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/slim-trixie/Dockerfile b/4.0/slim-trixie/Dockerfile index 035a02667..67880db0f 100644 --- a/4.0/slim-trixie/Dockerfile +++ b/4.0/slim-trixie/Dockerfile @@ -88,6 +88,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/4.0/trixie/Dockerfile b/4.0/trixie/Dockerfile index 8f3244b7c..036858b34 100644 --- a/4.0/trixie/Dockerfile +++ b/4.0/trixie/Dockerfile @@ -63,6 +63,10 @@ RUN set -eux; \ \ autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \ diff --git a/Dockerfile.template b/Dockerfile.template index 5fdb9cce7..3f1eeebdf 100644 --- a/Dockerfile.template +++ b/Dockerfile.template @@ -194,6 +194,10 @@ RUN set -eux; \ {{ ) else "" end -}} autoconf; \ gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \ +# full RELRO: "-z now" disables lazy binding so the loader can map the GOT read-only at startup +# https://github.com/docker-library/ruby/pull/529 +# https://salsa.debian.org/ruby-team/ruby/-/blob/8a55ab83e2c1783d80d0117fecbda533ac75f3e3/debian/rules#L63-67 (Debian's "hardening=+bindnow" produces the same flags) + export LDFLAGS='-Wl,-z,relro -Wl,-z,now'; \ ./configure \ --build="$gnuArch" \ --disable-install-doc \