Hi,

libapache2-mod-ldap-userdir fails to build when LTO is enabled in the
default build flags (e.g. DEB_BUILD_MAINT_OPTIONS=optimize=+lto). Ubuntu
enables LTO by default on most architectures, so we hit it there:

  apxs -c -Wdate-time -D_FORTIFY_SOURCE=3 -Wl,-Bsymbolic-functions ... \
       -flto=auto -ffat-lto-objects -Wl,-z,relro ... mod_ldap_userdir.c
  apxs:Error: Unknown option: f.
  apxs:Error: Unknown option: t.
  apxs:Error: Unknown option: -.
  make[2]: *** [Makefile:10: .libs/mod_ldap_userdir.so] Error 1

Ubuntu build log:
https://launchpad.net/ubuntu/+source/libapache2-mod-ldap-userdir/1.1.19-2.2/+build/32793477

Makefile.in passes the build flags directly to apxs:

  $(APXS) -c $(CPPFLAGS) $(LDFLAGS) $(LIBS) $(TLS) mod_ldap_userdir.c

apxs only accepts compiler/linker flags wrapped as -Wc,... or -Wl,....
The -Wl,-prefixed parts of LDFLAGS work, but bare flags such as
-flto=auto and -ffat-lto-objects are parsed by apxs as unknown options.

Since 1.1.19-2.2 switched to a plain dh sequence (#989941),
dh_auto_configure passes the full LDFLAGS to configure, so any LTO flags
in LDFLAGS now break the build. It builds in Debian today only because
Debian does not enable LTO by default.

Upstream (https://github.com/jwm/mod_ldap_userdir) has had no commits
since the 1.1.19 release in 2012, so I'm reporting it here rather than
upstream.

The minimal fix is to disable LTO for this package (debian-rules.diff,
attached):

  -export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-branch
  +export DEB_BUILD_MAINT_OPTIONS=hardening=+all,-branch optimize=-lto

A more thorough fix would be to patch Makefile.in so that flags apxs does
not understand natively are passed in -Wc,/-Wl, form, or to filter
LDFLAGS so that only -L/-l/-Wl, entries reach apxs directly.

Note: the diff has not been test-built yet.

Thanks,

Hi,

Follow-up: the optimize=-lto workaround from my first message is not
enough. On Ubuntu's amd64v3 builds LDFLAGS also contain -march=x86-64-v3,
which apxs rejects the same way:

  apxs:Error: Unknown option: m.
  apxs:Error: Unknown option: r.

So the problem is general: any bare flag in LDFLAGS breaks the apxs call.

Attached is a proper fix (apxs-wrap-ldflags.patch, applies after
destdir.patch). apxs strips one "-Wl," from each -Wl,<flag> option and
passes <flag> on to the libtool link command, so the patch wraps every
LDFLAGS entry as -Wl,<flag>. With it, the package builds with
LDFLAGS containing "-flto=auto -ffat-lto-objects -march=x86-64-v3", and
with the default flags. The resulting module still gets full RELRO and
BIND_NOW from the hardening flags. The optimize=-lto change is not needed
with this patch.

We are applying it in Ubuntu as 1.1.19-2.2ubuntu1.

Thanks,