From patchwork Sun Jan 11 10:34:19 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alessandro Di Federico X-Patchwork-Id: 427454 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from arrakis.dune.hu (arrakis.dune.hu [78.24.191.176]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id AE10714017D for ; Sun, 11 Jan 2015 21:34:23 +1100 (AEDT) Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id A5D52284526; Sun, 11 Jan 2015 11:32:01 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on arrakis.dune.hu X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,T_DKIM_INVALID, T_RP_MATCHES_RCVD autolearn=unavailable version=3.3.2 Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id 417D02801E8 for ; Sun, 11 Jan 2015 11:31:54 +0100 (CET) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_FROM_MX=-3.1; rate: -7.6 Received: from clearmind.me (clearmind.me [178.32.49.9]) by arrakis.dune.hu (Postfix) with ESMTPS for ; Sun, 11 Jan 2015 11:31:53 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=clearmind.me; s=dkim; h=Sender:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:To:From:Date; bh=heSZ0M/+BO6OwiZQAXI06VtSe3GBPbQdMLsy8/nbo1k=; b=nzQZPi9Xn17+/tDBDJ5cZg34dclcBvts2FP3LzoDbcw87fRkea/QC8rr1yYzC6o9Qr3PXN+wkDVILlIcLyu4baJSOgAfTe9xgSBmmoNrMYrE677AWBGkf4zE48gILAAAh5ypzsn143qV0GW3gzBa2nbbsfgMkyywS84sQe29jLc=; Date: Sun, 11 Jan 2015 11:34:19 +0100 From: Alessandro Di Federico To: openwrt-devel@lists.openwrt.org MIME-Version: 1.0 Message-Id: Subject: [OpenWrt-Devel] [PATCH] Support for building an hardened OpenWRT X-BeenThere: openwrt-devel@lists.openwrt.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: OpenWrt Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openwrt-devel-bounces@lists.openwrt.org Sender: "openwrt-devel" From: Alessandro Di Federico Introduce configuration options to build an "hardened" OpenWRT. Options to enable Stack-Smashing Protection, FORTIFY_SOURCE and RELRO have been introduced. uClibc makefile now automatically detects if SSP support is necessary. hostapd makefile has been fixed to use "^" as sed separator since using a comma was problematic when using "-Wl,-z,now" and the like in TARGET_CFLAGS. Currently enabling SSP on user space depends on enabling SSP kernel side, this is due to the fact that TARGET_CFLAGS are used to build kernel modules (at least). Suggestions on how to avoid this are welcome. Using "select" instead of "depends on" doesn't seem to work with choice entries. Tested with a lantiq (WBMR) router, GCC 4.8, uClibc and a subset of the available packages. Needs to be tested with GCC 4.9 and the remaining packages. PIE not currently included. Signed-off-by: Alessandro Di Federico --- config/Config-build.in | 88 +++++++++++++++++++++++++++---- include/package.mk | 36 +++++++++++++ package/network/services/hostapd/Makefile | 2 +- toolchain/uClibc/common.mk | 1 + 4 files changed, 117 insertions(+), 10 deletions(-) diff --git a/config/Config-build.in b/config/Config-build.in index 89cf964..a0c30a6 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -97,15 +97,6 @@ menu "Global build settings" If you are unsure, select N. - config PKG_CHECK_FORMAT_SECURITY - bool - prompt "Enable gcc format-security" - default n - help - Add -Wformat -Werror=format-security to the CFLAGS. You can disable - this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package - Makefile. - config PKG_BUILD_USE_JOBSERVER bool prompt "Use top-level make jobserver for packages" @@ -216,4 +207,83 @@ menu "Global build settings" bool "libstdc++" endchoice + comment "Hardening build options" + + config PKG_CHECK_FORMAT_SECURITY + bool + prompt "Enable gcc format-security" + default n + help + Add -Wformat -Werror=format-security to the CFLAGS. You can disable + this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package + Makefile. + + choice + prompt "User space Stack-Smashing Protection" + default PKG_CC_STACKPROTECTOR_NONE + help + Enable GCC Stack Smashing Protection (SSP) for userspace applications + config PKG_CC_STACKPROTECTOR_NONE + bool "None" + config PKG_CC_STACKPROTECTOR_REGULAR + bool "Regular" + select SSP_SUPPORT + depends on KERNEL_CC_STACKPROTECTOR_REGULAR + config PKG_CC_STACKPROTECTOR_STRONG + depends on GCC_VERSION_4_9_LINARO + select SSP_SUPPORT + depends on KERNEL_CC_STACKPROTECTOR_STRONG + bool "Strong" + endchoice + + choice + prompt "Kernel space Stack-Smashing Protection" + default KERNEL_CC_STACKPROTECTOR_NONE + help + Enable GCC Stack-Smashing Protection (SSP) for the kernel + config KERNEL_CC_STACKPROTECTOR_NONE + bool "None" + config KERNEL_CC_STACKPROTECTOR_REGULAR + bool "Regular" + config KERNEL_CC_STACKPROTECTOR_STRONG + depends on GCC_VERSION_4_9_LINARO + bool "Strong" + endchoice + + choice + prompt "Enable buffer-overflows detction (FORTIFY_SOURCE)" + help + Enable the _FORTIFY_SOURCE macro which introduces additional + checks to detect buffer-overflows in the following standard library + functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy, + strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf, + gets. "Conservative" (_FORTIFY_SOURCE set to 1) only introduces + checks that sholdn't change the behavior of conforming programs, + while "aggressive" (_FORTIFY_SOURCES set to 2) some more checking is + added, but some conforming programs might fail. + config PKG_FORTIFY_SOURCE_NONE + bool "None" + config PKG_FORTIFY_SOURCE_1 + bool "Conservative" + config PKG_FORTIFY_SOURCE_2 + bool "Aggressive" + endchoice + + choice + prompt "Enable RELRO protection" + help + Enable a link-time protection know as RELRO (Relocation Read Only) + which helps to protect from certain type of exploitation techniques + altering the content of some ELF sections. "Partial" RELRO makes the + .dynamic section not writeable after initialization, introducing + almost no performance penalty, while "full" RELRO also marks the GOT + as read-only at the cost of initializing all of it at startup. + config PKG_RELRO_NONE + bool "None" + config PKG_RELRO_PARTIAL + bool "Partial" + config PKG_RELRO_FULL + bool "Full" + endchoice + endmenu diff --git a/include/package.mk b/include/package.mk index a1b90da..2c34a58 100644 --- a/include/package.mk +++ b/include/package.mk @@ -15,6 +15,12 @@ PKG_MD5SUM ?= unknown PKG_BUILD_PARALLEL ?= PKG_USE_MIPS16 ?= 1 PKG_CHECK_FORMAT_SECURITY ?= 1 +PKG_CC_STACKPROTECTOR_REGULAR ?= 1 +PKG_CC_STACKPROTECTOR_STRONG ?= 1 +PKG_FORTIFY_SOURCE_1 ?= 1 +PKG_FORTIFY_SOURCE_2 ?= 1 +PKG_RELRO_PARTIAL ?= 1 +PKG_RELRO_FULL ?= 1 ifneq ($(CONFIG_PKG_BUILD_USE_JOBSERVER),) MAKE_J:=$(if $(MAKE_JOBSERVER),$(MAKE_JOBSERVER) -j) @@ -39,6 +45,36 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY TARGET_CFLAGS += -Wformat -Werror=format-security endif endif +ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR + ifeq ($(strip $(PKG_CC_STACKPROTECTOR_REGULAR)),1) + TARGET_CFLAGS += -fstack-protector + endif +endif +ifdef CONFIG_PKG_CC_STACKPROTECTOR_STRONG + ifeq ($(strip $(PKG_CC_STACKPROTECTOR_STRONG)),1) + TARGET_CFLAGS += -fstack-protector-strong + endif +endif +ifdef CONFIG_PKG_FORTIFY_SOURCE_1 + ifeq ($(strip $(PKG_FORTIFY_SOURCE_1)),1) + TARGET_CFLAGS += -D_FORTIFY_SOURCE=1 + endif +endif +ifdef CONFIG_PKG_FORTIFY_SOURCE_2 + ifeq ($(strip $(PKG_FORTIFY_SOURCE_2)),1) + TARGET_CFLAGS += -D_FORTIFY_SOURCE=2 + endif +endif +ifdef CONFIG_PKG_RELRO_PARTIAL + ifeq ($(strip $(PKG_RELRO_PARTIAL)),1) + TARGET_CFLAGS += -Wl,-z,relro + endif +endif +ifdef CONFIG_PKG_RELRO_FULL + ifeq ($(strip $(PKG_RELRO_FULL)),1) + TARGET_CFLAGS += -Wl,-z,now -Wl,-z,relro + endif +endif include $(INCLUDE_DIR)/prereq.mk include $(INCLUDE_DIR)/host.mk diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile index 19d536e..6bdf534 100644 --- a/package/network/services/hostapd/Makefile +++ b/package/network/services/hostapd/Makefile @@ -294,7 +294,7 @@ define Build/Compile/wpad echo ` \ $(call Build/RunMake,hostapd,-s MULTICALL=1 dump_cflags); \ $(call Build/RunMake,wpa_supplicant,-s MULTICALL=1 dump_cflags) | \ - sed -e 's,-n ,,g' -e 's,$(TARGET_CFLAGS),,' \ + sed -e 's,-n ,,g' -e 's^$(TARGET_CFLAGS)^^' \ ` > $(PKG_BUILD_DIR)/.cflags +$(call Build/RunMake,hostapd, \ CFLAGS="$$$$(cat $(PKG_BUILD_DIR)/.cflags)" \ diff --git a/toolchain/uClibc/common.mk b/toolchain/uClibc/common.mk index e507dc6..435e4c2 100644 --- a/toolchain/uClibc/common.mk +++ b/toolchain/uClibc/common.mk @@ -80,6 +80,7 @@ define Host/Configure -e 's,^.*UCLIBC_HAS_SHADOW.*,UCLIBC_HAS_SHADOW=$(if $(CONFIG_SHADOW_PASSWORDS),y,n),g' \ -e 's,^.*UCLIBC_HAS_LOCALE.*,UCLIBC_HAS_LOCALE=$(if $(CONFIG_BUILD_NLS),y,n),g' \ -e 's,^.*UCLIBC_BUILD_ALL_LOCALE.*,UCLIBC_BUILD_ALL_LOCALE=$(if $(CONFIG_BUILD_NLS),y,n),g' \ + -e 's,^.*UCLIBC_HAS_SSP.*,UCLIBC_HAS_SSP=$(if $(or $(CONFIG_PKG_CC_STACKPROTECTOR_REGULAR),$(CONFIG_PKG_CC_STACKPROTECTOR_STRONG)),y,n),g' \ $(HOST_BUILD_DIR)/.config.new cmp -s $(HOST_BUILD_DIR)/.config.new $(HOST_BUILD_DIR)/.config.last || { \ cp $(HOST_BUILD_DIR)/.config.new $(HOST_BUILD_DIR)/.config && \