Request to compile Firefox with -fpie and -pie options to fully support ASLR

[baldyeti]

Just to be clear, in the Mozilla KB article page that was shared earlier there are two options mentioned to build Firefox. Firstly is the option of Install Firefox .deb package for Debian-based distributions and the second option is Install Firefox from Mozilla builds. And MX is using the first option

Correct me if i am wrong but I believe it is the other way around. If i read DO correctly MX is packaging the mozilla binary, *not* the debian package ?

[fehlix]

Just to be clear, in the Mozilla KB article page that was shared earlier there are two options mentioned to build Firefox. Firstly is the option of Install Firefox .deb package for Debian-based distributions and the second option is Install Firefox from Mozilla builds. And MX is using the first option

Correct me if i am wrong but I believe it is the other way around. If i read DO correctly MX is packaging the mozilla binary, *not* the debian package ?

The MX provided deb is based on Mozilla's provide tar, as verified with the sha256sum:

Code: Select all

033aece8cbe2e7ce4893f2422a4d922f97cd6570ddb9ae8e2f9ea0bf411db689  ./MOZILLA-TAR/firefox/firefox-bin
033aece8cbe2e7ce4893f2422a4d922f97cd6570ddb9ae8e2f9ea0bf411db689  ./MOZILLA-MX/firefox_130.0.1~mozillabinaries-1mx23+1_amd64.deb.EXTRACTED/opt/firefox/firefox-bin

Both deb and tar provided by Mozilla builds do have DYN enabled
as shown here with the extracted tar and deb's:

Code: Select all

readelf -h ./MOZILLA-DEB/firefox_130.0.1~build1_amd64.deb.extracted/usr/lib/firefox/firefox-bin
  Type:                              DYN (Position-Independent Executable file)
readelf -h ./MOZILLA-TAR/firefox/firefox-bin
  Type:                              DYN (Position-Independent Executable file)
readelf -h ./MOZILLA-MX/firefox_130.0.1~mozillabinaries-1mx23+1_amd64.deb.EXTRACTED/opt/firefox/firefox-bin
  Type:                              DYN (Position-Independent Executable file)

Now, based on the puzzle solving post by @kmathern here viewtopic.php?p=791463#p791463
the original request of the thread appears to me as answered: No need to rebuild, b/c DYN is provided by Mozilla provided build either as deb or as tar.
I would consider this thread to be solved, and maybe to reduce further FUD oriented misleading statements would consider this thread to be a candidate to get closed.
Thanks

[j2mcgreg]

I agree with @fehlix and this thread is locked.