diff mbox series

gcc: powerpc32 transition to secureplt

Message ID 20200923152908.21153-1-matthew.weber@rockwellcollins.com
State Accepted
Headers show
Series gcc: powerpc32 transition to secureplt | expand

Commit Message

Matthew Weber Sept. 23, 2020, 3:29 p.m. UTC
PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
runtime code generation to generate the PLT stubs. Secure-PLT was
introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
Binutils 2.17), and is a more secure PLT format, using a read-only
linkage table, with the dynamic linker populating a non-executable
index table.

Ref to other distro/BSD transitions
https://patchwork.openembedded.org/patch/106621/
https://reviews.freebsd.org/D20598

Fixes a bug observed when creating SELinux policy where all apps
require execmem because the heap requires execute before this
change.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
---
 package/gcc/gcc.mk | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Thomas Petazzoni Sept. 23, 2020, 6:51 p.m. UTC | #1
On Wed, 23 Sep 2020 10:29:08 -0500
Matt Weber <matthew.weber@rockwellcollins.com> wrote:

> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
> runtime code generation to generate the PLT stubs. Secure-PLT was
> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
> Binutils 2.17), and is a more secure PLT format, using a read-only
> linkage table, with the dynamic linker populating a non-executable
> index table.
> 
> Ref to other distro/BSD transitions
> https://patchwork.openembedded.org/patch/106621/
> https://reviews.freebsd.org/D20598
> 
> Fixes a bug observed when creating SELinux policy where all apps
> require execmem because the heap requires execute before this
> change.
> 
> Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
> ---
>  package/gcc/gcc.mk | 7 +++++++
>  1 file changed, 7 insertions(+)

Applied to master, thanks.

Thomas
Matthew Weber Sept. 23, 2020, 7:01 p.m. UTC | #2
Peter,


On Wed, Sep 23, 2020 at 10:29 AM Matt Weber
<matthew.weber@rockwellcollins.com> wrote:
>
> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
> runtime code generation to generate the PLT stubs. Secure-PLT was
> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
> Binutils 2.17), and is a more secure PLT format, using a read-only
> linkage table, with the dynamic linker populating a non-executable
> index table.
>
> Ref to other distro/BSD transitions
> https://patchwork.openembedded.org/patch/106621/
> https://reviews.freebsd.org/D20598
>
> Fixes a bug observed when creating SELinux policy where all apps
> require execmem because the heap requires execute before this
> change.
>

This also applies to 2020.02.x and the previous release 2020.08.

Best Regards,
Matt
Peter Korsgaard Sept. 29, 2020, 7:09 p.m. UTC | #3
>>>>> "Matthew" == Matthew Weber <matthew.weber@rockwellcollins.com> writes:

 > Peter,
 > On Wed, Sep 23, 2020 at 10:29 AM Matt Weber
 > <matthew.weber@rockwellcollins.com> wrote:
 >> 
 >> PowerPC has two PLT models: BSS-PLT and Secure-PLT. BSS-PLT uses
 >> runtime code generation to generate the PLT stubs. Secure-PLT was
 >> introduced with GCC 4.1 and Binutils 2.17 (base has GCC 4.2.1 and
 >> Binutils 2.17), and is a more secure PLT format, using a read-only
 >> linkage table, with the dynamic linker populating a non-executable
 >> index table.
 >> 
 >> Ref to other distro/BSD transitions
 >> https://patchwork.openembedded.org/patch/106621/
 >> https://reviews.freebsd.org/D20598
 >> 
 >> Fixes a bug observed when creating SELinux policy where all apps
 >> require execmem because the heap requires execute before this
 >> change.
 >> 

 > This also applies to 2020.02.x and the previous release 2020.08.

Committed to 2020.02.x, 2020.05.x and 2020.08.x, thanks.
diff mbox series

Patch

diff --git a/package/gcc/gcc.mk b/package/gcc/gcc.mk
index b834269adc..df5bf22b96 100644
--- a/package/gcc/gcc.mk
+++ b/package/gcc/gcc.mk
@@ -223,6 +223,13 @@  HOST_GCC_COMMON_CONF_OPTS += \
 	--with-long-double-128
 endif
 
+# Set default to Secure-PLT to prevent run-time
+# generation of PLT stubs (supports RELRO and
+# SELinux non-exemem capabilities)
+ifeq ($(BR2_powerpc),y)
+HOST_GCC_COMMON_CONF_OPTS += --enable-secureplt
+endif
+
 # PowerPC64 big endian by default uses the elfv1 ABI, and PowerPC 64
 # little endian by default uses the elfv2 ABI. However, musl has
 # decided to use the elfv2 ABI for both, so we force the elfv2 ABI for