gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #326819 from risicle/ris-shadowstack

Browse Source 
cc-wrapper: add support for `shadowstack` hardening flag
This commit is contained in:
Emily
2024-07-28 19:07:52 +01:00
committed by GitHub
parent 9f368dc2ef 0dacfda0af
commit 8a837af302
17 changed files with 118 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/stdenv/stdenv.chapter.md
+10
View File
@@ -1538,6 +1538,16 @@ Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Execut
Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
#### `shadowstack` {#shadowstack}
Adds the `-fcf-protection=return` compiler option. This enables the Shadow Stack feature supported by some newer processors, which maintains a user-inaccessible copy of the program's stack containing only return-addresses. When returning from a function, the processor compares the return-address value on the two stacks and throws an error if they do not match, considering it a sign of corruption and possible tampering. This should significantly increase the difficulty of ROP attacks.
For the Shadow Stack to be enabled at runtime, all code linked into a process must be built with Shadow Stack enabled, so this is probably only useful to enable on a wide scale, so that all of a packages dependencies also have the feature enabled.
This is currently only supported on some newer Intel and AMD processors as part of the Intel CET set of features. However, the generated code should continue to work on older processors which will simply omit any of this checking.
This breaks some code that does advanced stack management or exception handling. If enabling this hardening flag it is important to test the result on a system that has known working and enabled CET support, so that any such breakage can be discovered.
#### `trivialautovarinit` {#trivialautovarinit}
Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.
nixos/doc/manual/release-notes/rl-2411.section.md
+2
View File
@@ -300,6 +300,8 @@
- Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop
listed as a regular entry in Cinnamon Wayland session's window list applet.
- The `shadowstack` hardening flag has been added, though disabled by default.
- Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners
should be changed to using *runner authentication tokens* by configuring
pkgs/build-support/cc-wrapper/add-hardening.sh
+5 -1
View File
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
fi
if (( "${NIX_DEBUG:-0}" >= 1 )); then
declare -a allHardeningFlags=(fortify fortify3 stackprotector stackclashprotection pie pic strictoverflow format trivialautovarinit zerocallusedregs)
declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection pie pic strictoverflow format trivialautovarinit zerocallusedregs)
declare -A hardeningDisableMap=()
# Determine which flags were effectively disabled so we can report below.
@@ -75,6 +75,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
;;
esac
;;
shadowstack)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling shadowstack >&2; fi
hardeningCFlagsBefore+=('-fcf-protection=return')
;;
stackprotector)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
pkgs/development/compilers/gcc/default.nix
+6
View File
@@ -431,6 +431,12 @@ pipe ((callFile ./common/builder.nix {}) ({
) "stackclashprotection"
++ optional (!atLeast11) "zerocallusedregs"
++ optionals (!atLeast12) [ "fortify3" "trivialautovarinit" ]
++ optional (!(
atLeast8
&& targetPlatform.isLinux
&& targetPlatform.isx86_64
&& targetPlatform.libc == "glibc"
)) "shadowstack"
++ optionals (langFortran) [ "fortify" "format" ];
};
pkgs/development/compilers/llvm/common/clang/default.nix
+5
View File
@@ -138,6 +138,11 @@ let
isClang = true;
hardeningUnsupportedFlagsByTargetPlatform = targetPlatform:
[ "fortify3" ]
++ lib.optional (
(lib.versionOlder release_version "7")
|| !targetPlatform.isLinux
|| !targetPlatform.isx86_64
) "shadowstack"
++ lib.optional (
(lib.versionOlder release_version "11")
|| (targetPlatform.isAarch64 && (lib.versionOlder release_version "18.1"))
pkgs/development/compilers/llvm/common/llvm/default.nix
+1
View File
@@ -104,6 +104,7 @@ stdenv.mkDerivation (rec {
hardeningDisable = [
"trivialautovarinit"
"shadowstack"
];
nativeBuildInputs = [ cmake ]
pkgs/development/libraries/glibc/2.39-revert-cet-default-disable.patch
+49
View File
@@ -0,0 +1,49 @@
Revert 55d63e731253de82e96ed4ddca2e294076cd0bc5
--- b/sysdeps/x86/cpu-features.c
+++ a/sysdeps/x86/cpu-features.c
@@ -110,7 +110,7 @@
if (!CPU_FEATURES_CPU_P (cpu_features, RTM_ALWAYS_ABORT))
CPU_FEATURE_SET_ACTIVE (cpu_features, RTM);
+#if CET_ENABLED
-#if CET_ENABLED && 0
CPU_FEATURE_SET_ACTIVE (cpu_features, IBT);
CPU_FEATURE_SET_ACTIVE (cpu_features, SHSTK);
#endif
reverted:
--- b/sysdeps/x86/cpu-tunables.c
+++ a/sysdeps/x86/cpu-tunables.c
@@ -35,17 +35,6 @@
break; \
}
-#define CHECK_GLIBC_IFUNC_CPU_BOTH(f, cpu_features, name, len) \
- _Static_assert (sizeof (#name) - 1 == len, #name " != " #len); \
- if (tunable_str_comma_strcmp_cte (&f, #name)) \
- { \
- if (f.disable) \
- CPU_FEATURE_UNSET (cpu_features, name) \
- else \
- CPU_FEATURE_SET_ACTIVE (cpu_features, name) \
- break; \
- }
-
/* Disable a preferred feature NAME. We don't enable a preferred feature
which isn't available. */
#define CHECK_GLIBC_IFUNC_PREFERRED_OFF(f, cpu_features, name, len) \
@@ -142,13 +131,11 @@
}
break;
case 5:
- {
- CHECK_GLIBC_IFUNC_CPU_BOTH (n, cpu_features, SHSTK, 5);
- }
if (n.disable)
{
CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, LZCNT, 5);
CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, MOVBE, 5);
+ CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SHSTK, 5);
CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, SSSE3, 5);
CHECK_GLIBC_IFUNC_CPU_OFF (n, cpu_features, XSAVE, 5);
}
pkgs/development/libraries/glibc/common.nix
+4 -1
View File
@@ -37,6 +37,7 @@
, profilingLibraries ? false
, withGd ? false
, enableCET ? false
, enableCETRuntimeDefault ? false
, extraBuildInputs ? []
, extraNativeBuildInputs ? []
, ...
@@ -50,6 +51,7 @@ in
assert withLinuxHeaders -> linuxHeaders != null;
assert withGd -> gd != null && libpng != null;
assert enableCET == false -> !enableCETRuntimeDefault;
stdenv.mkDerivation ({
version = version + patchSuffix;
@@ -114,7 +116,8 @@ stdenv.mkDerivation ({
lib.optional (isAarch64 && isLinux) ./0001-aarch64-math-vector.h-add-NVCC-include-guard.patch
)
++ lib.optional stdenv.hostPlatform.isMusl ./fix-rpc-types-musl-conflicts.patch
++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch;
++ lib.optional stdenv.buildPlatform.isDarwin ./darwin-cross-build.patch
++ lib.optional enableCETRuntimeDefault ./2.39-revert-cet-default-disable.patch;
postPatch =
''
pkgs/development/libraries/glibc/default.nix
+2 -1
View File
@@ -3,6 +3,7 @@
, profilingLibraries ? false
, withGd ? false
, enableCET ? if stdenv.hostPlatform.isx86_64 then "permissive" else false
, enableCETRuntimeDefault ? false
, pkgsBuildBuild
, libgcc
}:
@@ -16,7 +17,7 @@ let
in
(callPackage ./common.nix { inherit stdenv; } {
inherit withLinuxHeaders withGd profilingLibraries enableCET;
inherit withLinuxHeaders withGd profilingLibraries enableCET enableCETRuntimeDefault;
pname = "glibc" + lib.optionalString withGd "-gd" + lib.optionalString (stdenv.cc.isGNU && libgcc==null) "-nolibgcc";
}).overrideAttrs(previousAttrs: {
pkgs/development/libraries/pcre/default.nix
+6 -3
View File
@@ -1,5 +1,7 @@
{ lib, stdenv, fetchurl, fetchpatch, updateAutotoolsGnuConfigScriptsHook
, pcre, windows ? null
# Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
, enableJit ? !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
, variant ? null
}:
@@ -18,11 +20,12 @@ stdenv.mkDerivation rec {
outputs = [ "bin" "dev" "out" "doc" "man" ];
# Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
configureFlags = lib.optional (!(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--enable-jit=auto" ++ [
hardeningDisable = lib.optional enableJit "shadowstack";
configureFlags = [
"--enable-unicode-properties"
"--disable-cpp"
]
] ++ lib.optional enableJit "--enable-jit=auto"
++ lib.optional (variant != null) "--enable-${variant}";
patches = [
pkgs/stdenv/darwin/default.nix
+1
View File
@@ -433,6 +433,7 @@ in
isFromBootstrapFiles = true;
hardeningUnsupportedFlags = [
"fortify3"
"shadowstack"
"stackclashprotection"
"zerocallusedregs"
];
pkgs/stdenv/generic/make-derivation.nix
+1
View File
@@ -115,6 +115,7 @@ let
"format"
"fortify"
"fortify3"
"shadowstack"
"pic"
"pie"
"relro"
pkgs/stdenv/linux/bootstrap-tools-musl/default.nix
+7 -1
View File
@@ -15,5 +15,11 @@ derivation ({
langC = true;
langCC = true;
isGNU = true;
hardeningUnsupportedFlags = [ "fortify3" "zerocallusedregs" "trivialautovarinit" ];
hardeningUnsupportedFlags = [
"fortify3"
"shadowstack"
"stackclashprotection"
"trivialautovarinit"
"zerocallusedregs"
];
} // extraAttrs)
pkgs/stdenv/linux/bootstrap-tools/default.nix
+1
View File
@@ -17,6 +17,7 @@ derivation ({
isGNU = true;
hardeningUnsupportedFlags = [
"fortify3"
"shadowstack"
"stackclashprotection"
"trivialautovarinit"
"zerocallusedregs"
pkgs/tools/package-management/lix/common.nix
+5 -2
View File
@@ -244,8 +244,11 @@ stdenv.mkDerivation {
meson test --no-rebuild "''${flagsArray[@]}"
runHook postInstallCheck
'';
# strictoverflow is disabled because we trap on signed overflow instead
hardeningDisable = [ "strictoverflow" ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
hardeningDisable = [
"shadowstack"
# strictoverflow is disabled because we trap on signed overflow instead
"strictoverflow"
] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
# hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
# hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
separateDebugInfo = stdenv.isLinux && !enableStatic;
pkgs/tools/package-management/nix/common.nix
+3 -1
View File
@@ -101,7 +101,9 @@ self = stdenv.mkDerivation {
hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
hardeningDisable = [
"shadowstack"
] ++ lib.optional stdenv.hostPlatform.isMusl "fortify";
nativeBuildInputs = [
pkg-config
pkgs/top-level/stage.nix
+10
View File
@@ -292,10 +292,20 @@ let
pkgsExtraHardening = super';
stdenv = super'.withDefaultHardeningFlags (
super'.stdenv.cc.defaultHardeningFlags ++ [
"shadowstack"
"stackclashprotection"
"trivialautovarinit"
]
) super'.stdenv;
glibc = super'.glibc.override rec {
enableCET = if self'.stdenv.hostPlatform.isx86_64 then "permissive" else false;
enableCETRuntimeDefault = enableCET != false;
};
} // lib.optionalAttrs (with super'.stdenv.hostPlatform; isx86_64 && isLinux) {
# causes shadowstack disablement
pcre = super'.pcre.override { enableJit = false; };
pcre-cpp = super'.pcre-cpp.override { enableJit = false; };
pcre16 = super'.pcre16.override { enableJit = false; };
})
] ++ overlays;
};