From 932bf58e90c733f016d41e255b89bef80a5cc33e Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Fri, 7 Jun 2024 20:17:19 +0100 Subject: [PATCH] doc/stdenv: hardening flags: move zerocallusedregs into "enabled by default" section following dd80ca4d00c685ad1df5d312d1a6fc9e02265539 --- doc/stdenv/stdenv.chapter.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md index f2bc7f71de38..41e6819dc25f 100644 --- a/doc/stdenv/stdenv.chapter.md +++ b/doc/stdenv/stdenv.chapter.md @@ -1654,6 +1654,10 @@ This flag can break dynamic shared object loading. For instance, the module syst intel_drv.so: undefined symbol: vgaHWFreeHWRec ``` +#### `zerocallusedregs` {#zerocallusedregs} + +Adds the `-fzero-call-used-regs=used-gpr` compiler option. This causes the general-purpose registers that an architecture's calling convention considers "call-used" to be zeroed on return from the function. This can make it harder for attackers to construct useful ROP gadgets and also reduces the chance of data leakage from a function call. + ### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default} The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services. @@ -1667,10 +1671,6 @@ Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Execut Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option. If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`. -#### `zerocallusedregs` {#zerocallusedregs} - -Adds the `-fzero-call-used-regs=used-gpr` compiler option. This causes the general-purpose registers that an architecture's calling convention considers "call-used" to be zeroed on return from the function. This can make it harder for attackers to construct useful ROP gadgets and also reduces the chance of data leakage from a function call. - #### `trivialautovarinit` {#trivialautovarinit} Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.