cmake: add extra security compiler options #7587
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Gumix
added
full-ci
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
2 times, most recently
from
e42fe44
to
5acbfce
Compare
Gumix
commented
Aug 19, 2022
| @@ -37,7 +37,6 @@ DEB_DH_SYSTEMD_START_ARGS_tarantool-common := --no-restart-on-upgrade tarantool | |||
|
|
|||
| # Needed for proper backtraces in fiber.info() | |||
| DEB_DH_STRIP_ARGS := -X/usr/bin/tarantool | |||
| export DEB_BUILD_MAINT_OPTIONS = hardening=-stackprotector | |||
There was a problem hiding this comment.
Here hardening=-stackprotector means disabling stackprotector, not enabling.
locker
approved these changes
Aug 19, 2022
Totktonada
reviewed
Aug 24, 2022
Totktonada
reviewed
Aug 24, 2022
Totktonada
reviewed
Aug 24, 2022
Totktonada
reviewed
Aug 25, 2022
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
5acbfce
to
37ee9d5
Compare
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
3 times, most recently
from
7718f29
to
6602b37
Compare
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
1f542b4
to
3d68417
Compare
Totktonada
reviewed
Sep 9, 2022
Totktonada
reviewed
Sep 9, 2022
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
3d68417
to
bf491a5
Compare
Totktonada
approved these changes
Sep 9, 2022
There was a problem hiding this comment.
Thank you for the painstaking work!
The overall approach is okay for me. I made several manual tests and some of them are failed (see the comments above). I don't know how important those fails are and I don't know details about building platform/infrastructure of Tarantool Enterprise Edition. Depending of that the fails may be negligible or very important.
I'll approve the general approach and will lean on you regarding reproducing/fixing/postponing/discarding the remaining problems.
(TBH, I'm going to a vacation and just can't participate in a next review iteration.)
Gumix
added
do not merge
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
bf491a5
to
f8d128b
Compare
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
f8d128b
to
0cc4278
Compare
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
0cc4278
to
9a52a35
Compare
Introduce cmake option ENABLE_HARDENING, which is TRUE by default for non-debug regular and static builds, excluding AArch64 and FreeBSD. It passess compiler flags that harden Tarantool (including the bundled libraries) against memory corruption attacks. The following flags are passed: * -Wformat - Check calls to printf and scanf, etc., to make sure that the arguments supplied have types appropriate to the format string specified. * -Wformat-security -Werror=format-security - Warn about uses of format functions that represent possible security problems. And make the warning into an error. * -fstack-protector-strong - Emit extra code to check for buffer overflows, such as stack smashing attacks. * -fPIC -pie - Generate position-independent code (PIC). It allows to take advantage of the Address Space Layout Randomization (ASLR). * -z relro -z now - Resolve all dynamically linked functions at the beginning of the execution, and then make the GOT read-only. Also do not disable hardening for Debian and RPM-based Linux distros. Closes #5372 Closes #7536 NO_DOC=build NO_TEST=build
Gumix
force-pushed
the
iverbin/gh-7536-add-extra-security-compiler-options
branch
from
9a52a35
to
4b02131
Compare
locker
approved these changes
Sep 15, 2022
locker
deleted the
iverbin/gh-7536-add-extra-security-compiler-options
branch
|
Cherry-picked to 2.10. |
amdei
reviewed
Oct 12, 2022
| # Fuzzers are compiled without PIC support, | ||
| # LuaJIT in FreeBSD doesn't work with PIC (gh-7640), | ||
| # ligomp.a for AArch64 CentOS is compiled without PIC support. | ||
| if (ENABLE_FUZZER OR TARGET_OS_FREEBSD OR ${CMAKE_SYSTEM_PROCESSOR} MATCHES "aarch64") |
There was a problem hiding this comment.
Why hardening is disabled on arm64?
There was a problem hiding this comment.
Some arm64 Linux distros (e.g. CentOS) include system libraries that do not allow to compile Tarantool as position-independent binary, that's why I disabled hardening by default for arm64. There is a task about removing dependency on libgomp: #7689
|
May I ask, why hardening is disabled for ARM64 builds by default? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce cmake option ENABLE_HARDENING, which is TRUE by default for
regular and static builds. It passess compiler flags that harden Tarantool
(including the bundled libraries) against memory corruption attacks.
The following flags are passed:
-Wformat- Check calls to printf and scanf, etc., to make sure thatthe arguments supplied have types appropriate to the format string
specified.
-Wformat-security -Werror=format-security- Warn about uses of formatfunctions that represent possible security problems. And make the
warning into an error.
-fstack-protector-strong- Emit extra code to check for bufferoverflows, such as stack smashing attacks.
-fPIC- Generate position-independent code (PIC). It allows to takeadvantage of Address Space Layout Randomization (ASLR).
-z relro -z now- Resolve all dynamically linked functions at thebeginning of the execution, and then make the GOT read-only.
Also do not disable hardening for Debian and RPM-based Linux distros.
Closes #5372
Closes #7536