From patchwork Fri Sep 7 14:03:11 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Magnus Granberg X-Patchwork-Id: 182402 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) by ozlabs.org (Postfix) with SMTP id 857FF2C009D for ; Sat, 8 Sep 2012 00:51:00 +1000 (EST) Comment: DKIM? See http://www.dkim.org DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=gcc.gnu.org; s=default; x=1347634260; h=Comment: DomainKey-Signature:Received:Received:Received:Received:From:To: Subject:Date:Message-ID:User-Agent:MIME-Version:Content-Type: Content-Transfer-Encoding:Mailing-List:Precedence:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:Sender: Delivered-To; bh=+YTC8zmtxT3zou6MleecbOR7QLg=; b=cj02pvepjvb8gZl 8pJfwAa3Qm4DvULgdyiCIt/zKMFTDfUAff6L7yO1Bq2cBpiwnnGF/ca8WCuUN0aw uRWEPVWZFs8RR6jc3Z08rd/jD7lqiiWWdTnP6Sb5YUK0cvGrrqOxqO+qBcmFWk7Q xeuZvYv44DuhFQTnnRGD5PXB2BeQ= Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gcc.gnu.org; h=Received:Received:X-SWARE-Spam-Status:X-Spam-Check-By:Received:Received:From:To:Subject:Date:Message-ID:User-Agent:MIME-Version:Content-Type:Content-Transfer-Encoding:X-IsSubscribed:Mailing-List:Precedence:List-Id:List-Unsubscribe:List-Archive:List-Post:List-Help:Sender:Delivered-To; b=CdcgBBd+ElDuHTuHOlC1ZdEFy/Dr2hTgtSzxrM3KEoT5alns2pRMXz1JCM9pOQ k84sSTmlBwkuZUQGT16CdqbNlWw2nFYGc4c2bNd5NQyU1HKBQR41YUZwZfoZhqGA CTJydnondem4Pvxmez5HqqhRq45E6mZYG1FC+5OTnAs04=; Received: (qmail 26581 invoked by alias); 7 Sep 2012 14:50:16 -0000 Received: (qmail 26350 invoked by uid 22791); 7 Sep 2012 14:50:10 -0000 X-SWARE-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL, BAYES_00, KHOP_RCVD_UNTRUST, RCVD_IN_DNSWL_HI, RCVD_IN_HOSTKARMA_W, RP_MATCHES_RCVD, TW_GC X-Spam-Check-By: sourceware.org Received: from smtp.gentoo.org (HELO smtp.gentoo.org) (140.211.166.183) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Fri, 07 Sep 2012 14:49:50 +0000 Received: from laptop1.gw.ume.nu (ip1-67.bon.riksnet.se [77.110.8.67]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: zorry) by smtp.gentoo.org (Postfix) with ESMTPSA id 90CA333D1B5 for ; Fri, 7 Sep 2012 14:49:49 +0000 (UTC) From: Magnus Granberg To: gcc-patches@gcc.gnu.org Subject: [PATCH 1-2/12 ] New configure option --enable-espf=(all|ssp|pie|no) Date: Fri, 07 Sep 2012 16:03:11 +0200 Message-ID: <1847698.P25PdQuT3z@laptop1.gw.ume.nu> User-Agent: KMail/4.8.3 (Linux/3.3.0-hardened; KDE/4.8.3; x86_64; ; ) MIME-Version: 1.0 X-IsSubscribed: yes Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Delivered-To: mailing list gcc-patches@gcc.gnu.org Hi This new configure option will add some preprocessor, compiler or link command options as default. The default options will be -D_FORTIFY_SOURCE, -Wformat, - Wformat-security, -fPIE -pie and -fstack-protector. Depending on what is passed to --enable-espf=, ssp, pie, no, or all of them, will be turned on or off. Enable Stack protector, Position independent executable and Fortify_source is abbreviated as "espf". Gentoo (Hardened) uses all the options by default and Ubuntu use some of them as defaut. It have been testing on 86_64-unknown- linux-gnu and 20120902 snapshot. I will add more target when tested. Patch: configure.ac.patch Add the new confiure options and add some new checks. Patch: Makefile.in.patch Will add -fno-stack-protector, -fno-PIE to needed flags and pass enable-espf to the testsuite. Gentoo Hardened project Magnus Granberg Changelog 2012-08-24 Magnus Granberg Kees Cook gcc/doc/ * invoke.texi Add notes to -Wformat, -Wformat-security, -O2, -fstack-protector, -fPIE and -pie for espf. * install.texi Add new configure options 2012-08-26 Magnus Granberg Kees Cook gcc/testsuite * gcc.dg/charset/builtin2.c Add -Wno-format when effective_target is espf. * gcc.dg/format/format.exp Likewise. * gcc.dg/pr30473.c Likewise. * gcc.dg/pr38902.c Likewise. * gcc.dg/ipa/ipa-sra-1.c Likewise. * gcc.dg/torture/tls/tls-test.c Likewise. * g++.dg/abi/pragma-pack1.C Likewise. * g++.dg/cpp0x/constexpr-tuple.C Likewise. * lib/target-supports.exp Add check_effective_target_espf. * gcc.c-torture/execute/memset-1.x New file * gcc.c-torture/execute/vprintf-chk-1.x Likewise. * gcc.c-torture/execute/vfprintf-chk-1.x Likewise. * gcc.dg/stack-usage-1.c Add -fno-stack-protector when effective_target is espf. * gcc.dg/superblock.c Likewise. * gcc.dg/20021014-1.c Add -fno-PIE when effective_target is espf. * gcc.dg/nest.c Likewise. * gcc.dg/nested-func-4.c Likewise. * gcc.dg/pr32450.c Likewise. * gcc.dg/pr43643.c Likewise. * g++.dg/other/anon5.C Likewise. * g++.old-deja/g++.law/profile1.C Likewise. * gcc.dg/tree-ssa/ssa-store-ccp-3.c Skip the test. 2012-08-27 Magnus Granberg Kees Cook gcc/testsuite/ PR 39537 * g++.dg/ext/align1.C Remove printf * g++.old-deja/g++.law/operators28.C Fix format-string/type. * gcc.dg/torture/matrix-2.c Likewise. * gcc.dg/packed-vla.c Likewise. * g++.dg/opt/alias2.C Likewise. * g++.old-deja/g++.abi/vbase1.C Likewise. * g++.old-deja/g++.brendan/template8.C Likewise. * g++.old-deja/g++.eh/ptr1.C Likewise. * g++.old-deja/g++.jason/access23.C Likewise. * g++.old-deja/g++.law/cvt8.C Likewise. * g++.old-deja/g++.mike/net35.C Likewise. * g++.old-deja/g++.mike/offset1.C Likewise. * g++.old-deja/g++.mike/p12306.C Likewise. * g++.old-deja/g++.mike/p3579.C Likewise. * g++.old-deja/g++.mike/p3708a.C Likewise. * g++.old-deja/g++.mike/p3708b.C Likewise. * g++.old-deja/g++.mike/p3708.C Likewise. * g++.old-deja/g++.mike/p646.C Likewise. * g++.old-deja/g++.mike/p710.C Likewise. * g++.old-deja/g++.mike/p789a.C Likewise. * g++.old-deja/g++.mike/pmf2.C Likewise. * g++.old-deja/g++.mike/temp.C Likewise. * g++.old-deja/g++.other/temporary1.C Likewise. * g++.old-deja/g++.other/virtual8.C Likewise. * g++.old-deja/g++.pt/memtemp23.C Likewise. * g++.old-deja/g++.pt/memtemp24.C Likewise. * g++.old-deja/g++.pt/memtemp25.C Likewise. * g++.old-deja/g++.pt/memtemp26.C Likewise. * g++.old-deja/g++.pt/t39.C Likewise. * g++.old-deja/g++.robertl/eb17.C Likewise. --- a/Makefile.in 2012-01-02 11:59:04.000000000 +0100 +++ b/Makefile.in 2012-06-29 00:11:30.886010145 +0200 @@ -362,9 +362,17 @@ WINDRES_FOR_BUILD = @WINDRES_FOR_BUILD@ BUILD_PREFIX = @BUILD_PREFIX@ BUILD_PREFIX_1 = @BUILD_PREFIX_1@ +# Disable SSP on BOOT_CFLAGS, LIBCFLAGS and LIBCXXFLAGS +enable_espf = @enable_espf@ +ifeq ($(enable_espf),yes) +ESPF_NOSSP_CFLAGS = -fno-stack-protector +else +ESPF_NOSSP_CFLAGS= +endif + # Flags to pass to stage2 and later makes. They are defined # here so that they can be overridden by Makefile fragments. -BOOT_CFLAGS= -g -O2 +BOOT_CFLAGS= -g -O2 $(ESPF_NOSSP_CFLAGS) BOOT_LDFLAGS= BOOT_ADAFLAGS=-gnatpg -gnata @@ -410,9 +418,9 @@ GNATMAKE = @GNATMAKE@ CFLAGS = @CFLAGS@ LDFLAGS = @LDFLAGS@ -LIBCFLAGS = $(CFLAGS) +LIBCFLAGS = $(CFLAGS) $(ESPF_NOSSP_CFLAGS) CXXFLAGS = @CXXFLAGS@ -LIBCXXFLAGS = $(CXXFLAGS) -fno-implicit-templates +LIBCXXFLAGS = $(CXXFLAGS) -fno-implicit-templates $(ESPF_NOSSP_CFLAGS) GOCFLAGS = $(CFLAGS) TFLAGS = --- a/gcc/Makefile.in 2012-02-11 09:50:23.000000000 +0100 +++ b/gcc/Makefile.in 2012-06-29 00:07:45.230003420 +0200 @@ -973,14 +973,23 @@ LIBFUNCS_H = libfuncs.h $(HASHTAB_H) # cross compiler which does not use the native headers and libraries. INTERNAL_CFLAGS = -DIN_GCC @CROSS@ +# We don't want to compile the compiler with -fPIE, it make PCH fail. +enable_espf = @enable_espf@ +ifeq ($(enable_espf),yes) +ESPF_NOPIE_CFLAGS = -fno-PIE +else +ESPF_NOPIE_CFLAGS= +endif + # This is the variable actually used when we compile. If you change this, # you probably want to update BUILD_CFLAGS in configure.ac -ALL_CFLAGS = $(T_CFLAGS) $(CFLAGS-$@) \ +ALL_CFLAGS = $(ESPF_NOPIE_CFLAGS) $(T_CFLAGS) $(CFLAGS-$@) \ $(CFLAGS) $(INTERNAL_CFLAGS) $(COVERAGE_FLAGS) $(WARN_CFLAGS) @DEFS@ # The C++ version. -ALL_CXXFLAGS = $(T_CFLAGS) $(CFLAGS-$@) $(CXXFLAGS) $(INTERNAL_CFLAGS) \ - $(COVERAGE_FLAGS) $(NOEXCEPTION_FLAGS) $(WARN_CXXFLAGS) @DEFS@ +ALL_CXXFLAGS =$(ESPF_NOPIE_CFLAGS) $(T_CFLAGS) $(CFLAGS-$@) $(CXXFLAGS) \ + $(INTERNAL_CFLAGS) $(COVERAGE_FLAGS) $(NOEXCEPTION_FLAGS) \ + $(WARN_CXXFLAGS) @DEFS@ # Likewise. Put INCLUDES at the beginning: this way, if some autoconf macro # puts -I options in CPPFLAGS, our include files in the srcdir will always @@ -1815,6 +1824,7 @@ libgcc.mvars: config.status Makefile spe echo GCC_CFLAGS = '$(GCC_CFLAGS)' >> tmp-libgcc.mvars echo INHIBIT_LIBC_CFLAGS = '$(INHIBIT_LIBC_CFLAGS)' >> tmp-libgcc.mvars echo TARGET_SYSTEM_ROOT = '$(TARGET_SYSTEM_ROOT)' >> tmp-libgcc.mvars + echo enable_espf = '$(enable_espf)' >> tmp-libgcc.mvars mv tmp-libgcc.mvars libgcc.mvars @@ -4893,6 +4903,9 @@ site.exp: ./config.status Makefile @if test "@enable_lto@" = "yes" ; then \ echo "set ENABLE_LTO 1" >> ./site.tmp; \ fi + @if test "@enable_espf@" = "yes" ; then \ + echo "set ENABLE_ESPF 1" >> ./site.tmp; \ + fi # If newlib has been configured, we need to pass -B to gcc so it can find # newlib's crt0.o if it exists. This will cause a "path prefix not used" # message if it doesn't, but the testsuite is supposed to ignore the message - --- a/libgcc/Makefile.in 2011-11-22 04:01:02.000000000 +0100 +++ b/libgcc/Makefile.in 2012-06-29 00:15:04.534016511 +0200 @@ -275,11 +275,16 @@ override CFLAGS := $(filter-out -fprofil INTERNAL_CFLAGS = $(CFLAGS) $(LIBGCC2_CFLAGS) $(HOST_LIBGCC2_CFLAGS) \ $(INCLUDES) @set_have_cc_tls@ @set_use_emutls@ +ifeq ($(enable_espf),yes) +ESPF_NOPIE_CFLAGS = -fno-PIE +else +ESPF_NOPIE_CFLAGS= +endif # Options to use when compiling crtbegin/end. CRTSTUFF_CFLAGS = -O2 $(GCC_CFLAGS) $(INCLUDES) $(MULTILIB_CFLAGS) -g0 \ -finhibit-size-directive -fno-inline -fno-exceptions \ -fno-zero-initialized-in-bss -fno-toplevel-reorder -fno-tree-vectorize \ - -fno-stack-protector \ + -fno-stack-protector $(ESPF_NOPIE_CFLAGS) \ $(INHIBIT_LIBC_CFLAGS) # Extra flags to use when compiling crt{begin,end}.o.