Problem: Static binaries are more vulnerable to attacks Fix By: Compile with -fPIC or -fPIE Waive If: Don't. Example: FAIL: pic test because -fpic/-fpie not enabled
Programs can be compiled to either load at a fixed address in memory (static programs) or at a random address assigned at startup time (dynamic programs). Static programs are more vulnerable to exploits because an attacker will know exactly where every part of the program is located. Thus building dynamic executables is recommended.
This test checks that the appropriate compiler option has been used to generate dynamic code. For shared libraries this is the -fPIE option should be used. For dynamic executables the -fPIC option should be used. Note - there are lower case alternatives of these options (ie -fpie and -fpic) which can also be used. The difference between the lower case and upper case versions is architecture dependent, but usually the lower case version will only work with smaller programs, wheres the upper case version works for all program sizes.
Note - this check is related to the The pie test test. This test checks that the correct compile time option has been used. That test checks that the correct link time option has been used.
If necessary the test can be disabled via the --skip-pic option and re-enabled via the --test-pic option.