From patchwork Wed Jan 10 04:15:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Weber X-Patchwork-Id: 857928 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=busybox.net (client-ip=140.211.166.136; helo=silver.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zGbKZ4vLPz9sBZ for ; Wed, 10 Jan 2018 15:16:02 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id A4CD9303EA; Wed, 10 Jan 2018 04:15:57 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZEELM0hNkmfC; Wed, 10 Jan 2018 04:15:55 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by silver.osuosl.org (Postfix) with ESMTP id 3F9FC3022C; Wed, 10 Jan 2018 04:15:55 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id 42EF51C4111 for ; Wed, 10 Jan 2018 04:15:54 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 3F5CE8963F for ; Wed, 10 Jan 2018 04:15:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XNEAqU2vL9Yx for ; Wed, 10 Jan 2018 04:15:53 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from da1vs01.rockwellcollins.com (da1vs01.rockwellcollins.com [205.175.227.27]) by whitealder.osuosl.org (Postfix) with ESMTPS id 16A448950D for ; Wed, 10 Jan 2018 04:15:52 +0000 (UTC) Received: from ofwda1n02.rockwellcollins.com (HELO dtulimr01.rockwellcollins.com) ([205.175.227.14]) by da1vs01.rockwellcollins.com with ESMTP; 09 Jan 2018 22:15:51 -0600 X-Received: from largo.rockwellcollins.com (unknown [192.168.140.76]) by dtulimr01.rockwellcollins.com (Postfix) with ESMTP id BF0796021E; Tue, 9 Jan 2018 22:15:51 -0600 (CST) From: Matt Weber To: buildroot@buildroot.org Date: Tue, 9 Jan 2018 22:15:33 -0600 Message-Id: <1515557739-6027-2-git-send-email-matthew.weber@rockwellcollins.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1515557739-6027-1-git-send-email-matthew.weber@rockwellcollins.com> References: <1515557739-6027-1-git-send-email-matthew.weber@rockwellcollins.com> Subject: [Buildroot] [PATCH v3 2/8] security hardening: add RELFO, FORTIFY options X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.24 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" This enables a user to build a complete system using these options. It is important to note that not all packages will build correctly to start with. A good testing tool to check a target's elf files for compliance to an array of hardening techniques can be found here: https://github.com/slimm609/checksec.sh Signed-off-by: Matthew Weber --- Changes v2 -> v3 - Consolidated the way flags were set using CPPFLAGS (Arnout) - Removed fortran flag as not relevant for this feature (Arnout) - Added BR2_TOOLCHAIN_USES_GLIBC and optimization level dependency v1 -> v2 - Cosmetic caps on titles --- Config.in | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++ package/Makefile.in | 46 +++++++++++++++++++++++------------ 2 files changed, 100 insertions(+), 15 deletions(-) diff --git a/Config.in b/Config.in index e7e5c2d..f57e2b6 100644 --- a/Config.in +++ b/Config.in @@ -734,6 +734,75 @@ endchoice comment "Stack Smashing Protection needs a toolchain w/ SSP" depends on !BR2_TOOLCHAIN_HAS_SSP +choice + bool "RELRO Protection" + depends on BR2_SHARED_LIBS + help + Enable a link-time protection know as RELRO (RELocation Read Only) + which helps to protect from certain type of exploitation techniques + altering the content of some ELF sections. + +config BR2_RELRO_NONE + bool "None" + help + Enables Relocation link-time protections. + +config BR2_RELRO_PARTIAL + bool "Partial" + help + This option makes the dynamic section not writeable after + initialization (with almost no performance penalty). + +config BR2_RELRO_FULL + bool "Full" + help + This option includes the partial configuration, but also + marks the GOT as read-only at the cost of initialization time + during program loading, i.e every time an executable is started. + +endchoice + +comment "RELocation Read Only (RELRO) needs shared libraries" + depends on !BR2_SHARED_LIBS + +choice + bool "Buffer-overflow Detection (FORTIFY_SOURCE)" + depends on BR2_TOOLCHAIN_USES_GLIBC + help + Enable the _FORTIFY_SOURCE macro which introduces additional + checks to detect buffer-overflows in the following standard library + functions: memcpy, mempcpy, memmove, memset, strcpy, stpcpy, + strncpy, strcat, strncat, sprintf, vsprintf, snprintf, vsnprintf, + gets. + + NOTE: This feature requires an optimization level of s/1/2/3/g + + Support for this feature has been present since GCC 4.x. + +config BR2_FORTIFY_SOURCE_NONE + bool "None" + help + Enables additional checks to detect buffer-overflows. + +config BR2_FORTIFY_SOURCE_1 + bool "Conservative" + help + This option sets _FORTIFY_SOURCE set to 1 and only introduces + checks that shouldn't change the behavior of conforming programs. + Adds checks at compile-time only. + +config BR2_FORTIFY_SOURCE_2 + bool "Aggressive" + help + This option sets _FORTIFY_SOURCES set to 2 and some more checking + is added, but some conforming programs might fail. + Also adds checks at run-time (detected buffer overflow terminates + the program) + +endchoice + +comment "Fortify Source needs a GLIBC toolchain" + depends on !BR2_TOOLCHAIN_USES_GLIBC endmenu source "toolchain/Config.in" diff --git a/package/Makefile.in b/package/Makefile.in index a1a5316..84d4f0c 100644 --- a/package/Makefile.in +++ b/package/Makefile.in @@ -138,11 +138,41 @@ ifeq ($(BR2_DEBUG_3),y) TARGET_DEBUGGING = -g3 endif +TARGET_CFLAGS_RELRO = -Wl,-z,relro +TARGET_CFLAGS_RELRO_FULL = -Wl,-z,now $(TARGET_CFLAGS_RELRO) + +TARGET_LDFLAGS = $(call qstrip,$(BR2_TARGET_LDFLAGS)) + +ifeq ($(BR2_SSP_REGULAR),y) +TARGET_CPPFLAGS += -fstack-protector +else ifeq ($(BR2_SSP_STRONG),y) +TARGET_CPPFLAGS += -fstack-protector-strong +else ifeq ($(BR2_SSP_ALL),y) +TARGET_CPPFLAGS += -fstack-protector-all +endif + +ifeq ($(BR2_RELRO_PARTIAL),y) +TARGET_CPPFLAGS += $(TARGET_CFLAGS_RELRO) +TARGET_LDFLAGS += $(TARGET_CFLAGS_RELRO) +else ifeq ($(BR2_RELRO_FULL),y) +TARGET_CPPFLAGS += -fPIE $(TARGET_CFLAGS_RELRO_FULL) +TARGET_LDFLAGS += -pie +endif + +ifneq ($(BR2_OPTIMIZE_S)$(BR2_OPTIMIZE_0)$(BR2_OPTIMIZE_1)$(BR2_OPTIMIZE_2)$(BR2_OPTIMIZE_G),) +ifeq ($(BR2_FORTIFY_SOURCE_1),y) +TARGET_CPPFLAGS += -D_FORTIFY_SOURCE=1 +else ifeq ($(BR2_FORTIFY_SOURCE_2),y) +TARGET_CPPFLAGS += -D_FORTIFY_SOURCE=2 +endif +else +$(error BR2_FORTIFY_SOURCE_# requires optimization level s/1/2/3/g) +endif + TARGET_CPPFLAGS += -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 TARGET_CFLAGS = $(TARGET_CPPFLAGS) $(TARGET_ABI) $(TARGET_OPTIMIZATION) $(TARGET_DEBUGGING) TARGET_CXXFLAGS = $(TARGET_CFLAGS) TARGET_FCFLAGS = $(TARGET_ABI) $(TARGET_OPTIMIZATION) $(TARGET_DEBUGGING) -TARGET_LDFLAGS = $(call qstrip,$(BR2_TARGET_LDFLAGS)) ifeq ($(BR2_BINFMT_FLAT),y) TARGET_CFLAGS += $(if $($(PKG)_FLAT_STACKSIZE),-Wl$(comma)-elf2flt=-s$($(PKG)_FLAT_STACKSIZE),\ @@ -167,20 +197,6 @@ TARGET_FCFLAGS += -msep-data TARGET_CXXFLAGS += -msep-data endif -ifeq ($(BR2_SSP_REGULAR),y) -TARGET_CFLAGS += -fstack-protector -TARGET_CXXFLAGS += -fstack-protector -TARGET_FCFLAGS += -fstack-protector -else ifeq ($(BR2_SSP_STRONG),y) -TARGET_CFLAGS += -fstack-protector-strong -TARGET_CXXFLAGS += -fstack-protector-strong -TARGET_FCFLAGS += -fstack-protector-strong -else ifeq ($(BR2_SSP_ALL),y) -TARGET_CFLAGS += -fstack-protector-all -TARGET_CXXFLAGS += -fstack-protector-all -TARGET_FCFLAGS += -fstack-protector-all -endif - ifeq ($(BR2_TOOLCHAIN_BUILDROOT),y) TARGET_CROSS = $(HOST_DIR)/bin/$(GNU_TARGET_NAME)- else