scripts: add MACHO PIE check to security-check.py #17787
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 tasks
fanquake
force-pushed
the
add_macOS_to_security_check
branch
from
a4ec782
to
f99430f
Compare
Gitian builds
|
fanquake
force-pushed
the
add_macOS_to_security_check
branch
from
f99430f
to
abf45bd
Compare
|
Fixed up some documentation, added a function to retrieve all MACH-O flags and an additional commit to check for |
fanquake
force-pushed
the
add_macOS_to_security_check
branch
from
abf45bd
to
7c9e821
Compare
|
code review ACK 7c9e821 |
laanwj
added a commit
that referenced
this issue
Jan 2, 2020
7c9e821 scripts: add MACHO NOUNDEFS check to security-check.py (fanquake) 4ca92dc scripts: add MACHO PIE check to security-check.py (fanquake) Pull request description: This uses `otool -vh` to print the mach header and look for the `PIE` flag: ```bash otool -vh src/bitcoind Mach header magic cputype cpusubtype caps filetype ncmds sizeofcmds flags MH_MAGIC_64 X86_64 ALL LIB64 EXECUTE 24 2544 NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE ``` From [`mach-o/loader.h`](https://opensource.apple.com/source/cctools/cctools-927.0.2/include/mach-o/loader.h.auto.html): ```c #define MH_PIE 0x200000 /* When this bit is set, the OS will load the main executable at a random address. Only used in MH_EXECUTE filetypes. */ ``` ACKs for top commit: laanwj: code review ACK 7c9e821 Tree-SHA512: 5ba2f60440d0e31c70371a355c91ca4f723d80f7287d04e2098bf5b11892cc74216ff8f1454603c4db9675d4f7983614843b992b8dcfca0309aadf2aa7ab2e4b
|
(Ir)relevant, but related discussion from IRC: |
sidhujag
pushed a commit
to syscoin/syscoin
that referenced
this issue
Jan 2, 2020
7c9e821 scripts: add MACHO NOUNDEFS check to security-check.py (fanquake) 4ca92dc scripts: add MACHO PIE check to security-check.py (fanquake) Pull request description: This uses `otool -vh` to print the mach header and look for the `PIE` flag: ```bash otool -vh src/bitcoind Mach header magic cputype cpusubtype caps filetype ncmds sizeofcmds flags MH_MAGIC_64 X86_64 ALL LIB64 EXECUTE 24 2544 NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE ``` From [`mach-o/loader.h`](https://opensource.apple.com/source/cctools/cctools-927.0.2/include/mach-o/loader.h.auto.html): ```c #define MH_PIE 0x200000 /* When this bit is set, the OS will load the main executable at a random address. Only used in MH_EXECUTE filetypes. */ ``` ACKs for top commit: laanwj: code review ACK 7c9e821 Tree-SHA512: 5ba2f60440d0e31c70371a355c91ca4f723d80f7287d04e2098bf5b11892cc74216ff8f1454603c4db9675d4f7983614843b992b8dcfca0309aadf2aa7ab2e4b
sidhujag
pushed a commit
to syscoin-core/syscoin
that referenced
this issue
Nov 10, 2020
7c9e821 scripts: add MACHO NOUNDEFS check to security-check.py (fanquake) 4ca92dc scripts: add MACHO PIE check to security-check.py (fanquake) Pull request description: This uses `otool -vh` to print the mach header and look for the `PIE` flag: ```bash otool -vh src/bitcoind Mach header magic cputype cpusubtype caps filetype ncmds sizeofcmds flags MH_MAGIC_64 X86_64 ALL LIB64 EXECUTE 24 2544 NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE ``` From [`mach-o/loader.h`](https://opensource.apple.com/source/cctools/cctools-927.0.2/include/mach-o/loader.h.auto.html): ```c #define MH_PIE 0x200000 /* When this bit is set, the OS will load the main executable at a random address. Only used in MH_EXECUTE filetypes. */ ``` ACKs for top commit: laanwj: code review ACK 7c9e821 Tree-SHA512: 5ba2f60440d0e31c70371a355c91ca4f723d80f7287d04e2098bf5b11892cc74216ff8f1454603c4db9675d4f7983614843b992b8dcfca0309aadf2aa7ab2e4b
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
This uses
otool -vhto print the mach header and look for thePIEflag:otool -vh src/bitcoind Mach header magic cputype cpusubtype caps filetype ncmds sizeofcmds flags MH_MAGIC_64 X86_64 ALL LIB64 EXECUTE 24 2544 NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIEFrom
mach-o/loader.h: