Dynamic linking
Do any Linux/glibc or Linux/musl systems support static PIE binaries, yet? Without static PIE support you don't benefit from ASLR (at least not fully). This 2018 article seems like a good breakdown of the issues: <a href="https://www.leviathansecurity.com/blog/aslr-protection-for-statically-linked-executables" rel="nofollow">https://www.leviathansecurity.com/blog/aslr-protection-for-s...</a><p>OpenBSD has supported static PIE since 2015; not just supported, but all system static binaries (e.g. /bin and /sbin) are built as static PIEs, and I believe PIE is the default behavior when using `cc -static`. The reasons for the switch and the required toolchain changes are summarized in this presentation: <a href="https://www.openbsd.org/papers/asiabsdcon2015-pie-slides.pdf" rel="nofollow">https://www.openbsd.org/papers/asiabsdcon2015-pie-slides.pdf</a><p>Also, simply checking the "static PIE" box isn't the end of the story. There are different ways to accomplish it, and some are better than others in terms of ASLR, W^X, and other exploit mitigations. It's been a couple of years since I last looked into and had a hold on all the issues simultaneously[1], but the basic takeaway is that dynamic linking in system toolchains and system runtimes is far more mature than static linking.<p>[1] static PIE issues are a nexus of exploit mitigation techniques, so if you want to deep dive into exploit mitigation or even just linking issues then chasing the static PIE rabbit is a good approach.