dpkg-buildflags: Disable bindnow if relro is not used

There is no point in enabling full relro (aka bindnow) if relro is
not enabled. It just brings its disadvantages and none of its possible
advantages.

debian/changelog

@@ -24,6 +24,7 @@ dpkg (1.16.1.1) UNRELEASED; urgency=low
     in CPPFLAGS, instead of CFLAGS and CXXFLAGS. Closes: #642521, #643632
   * Fix typo to correctly set DEB_*_ARCH_BITS instead of DEB_*_ARCH in
     architecture.mk. Thanks to Thorsten Glaser <tg@mirbsd.org>.
+  * Make dpkg-buildflags disable full relro (bindnow) if relro is not enabled.
 
  -- Raphaël Hertzog <hertzog@debian.org>  Tue, 27 Sep 2011 08:15:51 +0200
 

scripts/Dpkg/Vendor/Debian.pm

@@ -145,6 +145,9 @@ sub add_hardening_flags {
     # Relro
     if ($use_feature{"relro"} and $cpu !~ /^(ia64|hppa|avr32)$/) {
 	$flags->append("LDFLAGS", "-Wl,-z,relro");
+    } else {
+	# Disable full relro if relro is not enabled.
+	$use_feature{"bindnow"} = 0;
     }
     # Bindnow
     if ($use_feature{"bindnow"}) {