cmd/go: harden against cgo LDFLAGS allowing arbitrary file read at build time on darwin

[thatnealpatel]

cmd/go/internal/work/security.go:225 contains the canonical allowlist.

A module containing -Wl,-sectcreate:

// #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,/Users/victim/.ssh/super_secret
import "C"

And a victim using CGO_ENABLED=1 and go build on darwin/arm64 will read the contents of /Users/victim/.ssh/super_secret and embed it in the binary. Since exfiltration of this information, even on a multi-user system, requires significant privilege, this is considered to be a hardening measure.

[gabyhelp]

Related Issues

• cmd/go: whitelist `-sectcreate` flag in cgo LDFLAGS #28832 (closed)
• cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565 (closed)
• cmd/go: arbitrary code execution during build on darwin (fix CVE-2025-22867) #71476 (closed)
• proposal: cmd/go: cgo flags blacklisting mechanism for compiler safety #23844 (closed)
• cmd/go/internal/work/security.go: allow direct linking of Windows .lib static libraries #64679 (closed)
• CGO_LDFLAGS_ALLOW as go cmd build flag #33521 (closed)
• cmd/go: add -flat_namespace to LDFLAGS whitelist #26173 (closed)
• cmd/go/internal/work/security: add `-ftls-model=(.*)` to safelist #69711 (closed)
• cmd/go: arbitrary code execution during build on darwin (CVE-2024-24787) #67119 (closed)
• cmd/cgo: add -ldflags to augment CGO_LDFLAGS #66456 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}