From patchwork Mon May 18 13:50:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 1292543 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=8.43.85.97; helo=sourceware.org; envelope-from=libc-alpha-bounces@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=sourceware.org Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.a=rsa-sha256 header.s=default header.b=oLITxaSi; dkim-atps=neutral Received: from sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49QgRL1tMHz9sRK for ; Mon, 18 May 2020 23:51:42 +1000 (AEST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 53F1C388A816; Mon, 18 May 2020 13:51:38 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 53F1C388A816 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1589809898; bh=M6IkMFc5R2qRNQfSMLqRrFQAppHU4wlosRDWIPJ3Dus=; h=References:In-Reply-To:Date:Subject:To:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=oLITxaSi0qyYAXEYTgkWCYGJ+LACT0Fru37rYjpRT6ISJktZFCNuAlPNLVEXb36ge SH1phkT2u8qLioIT256btkPja2b0yAfXdoIxPfpASKyZqR5k55AZSWCOtXc5aUKyQA XNZSNQN1S+b+qDYKvRhLbtShokks3nwQX6OfkLR4= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-il1-x142.google.com (mail-il1-x142.google.com [IPv6:2607:f8b0:4864:20::142]) by sourceware.org (Postfix) with ESMTPS id 060AE388A816 for ; Mon, 18 May 2020 13:51:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 060AE388A816 Received: by mail-il1-x142.google.com with SMTP id 17so9891687ilj.3 for ; Mon, 18 May 2020 06:51:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=M6IkMFc5R2qRNQfSMLqRrFQAppHU4wlosRDWIPJ3Dus=; b=rVFfenM6Oxxjwu+X31EErVDDH5fWD/Tuaqm3v2NYOpzAS5tJKb+pJtm0FJzSTufjai h1C7X271TKZbDo7z45Sr7UVVme/raIhO+XHZ3vmmUZHfdypxQz1G368tGAgpW0Tk8QcZ 6mHDhMTmHjRCeJ6M2vuTHzYDoYXIYLwDKFIzyIYEYAcBCTwzTZth+k3RtP+NslT7Q05B G9/Iw7b/y87070eGG3DW3GV4cAh0O31Hml+sQuikt550TurL4mdsolOX4WLJcevMaxur Dr1FXDLfUUUHnkAtP7Cs4XFlMcrxJjiB1hZPKho6CqpgMNf+SZaQTnzjjkoGlfPC7r0z O8DQ== X-Gm-Message-State: AOAM5302n6sIeO5CalApMe0wGsejnG2oAuQxpTB6Ag2NI5hKVSusD7Oo 02QLmkQthXs1ayFCedOIKbcrO+uYna2MJJfp9sQ= X-Google-Smtp-Source: ABdhPJzs7vtcZ2JudmblwqEby2M2mKaMm0p9KnN42NKWkk/THgHywiRnprfwsmQSggGFAYVx+mn3Wz8SSIa8meWPorM= X-Received: by 2002:a92:d591:: with SMTP id a17mr17149397iln.13.1589809890389; Mon, 18 May 2020 06:51:30 -0700 (PDT) MIME-Version: 1.0 References: <20200428215243.236312-1-hjl.tools@gmail.com> <87ees6ggvk.fsf@mid.deneb.enyo.de> <616cfb77-3aa3-fcbb-dacf-a0abbec9393e@linaro.org> In-Reply-To: <616cfb77-3aa3-fcbb-dacf-a0abbec9393e@linaro.org> Date: Mon, 18 May 2020 06:50:54 -0700 Message-ID: Subject: V2 [PATCH] x86: Add --enable-cet=permissive To: Adhemerval Zanella X-Spam-Status: No, score=-10.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: "H.J. Lu via Libc-alpha" From: "H.J. Lu" Reply-To: "H.J. Lu" Cc: Florian Weimer , Adhemerval Zanella via Libc-alpha Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" On Wed, Apr 29, 2020 at 2:58 PM Adhemerval Zanella via Libc-alpha wrote: > > > > On 29/04/2020 17:46, Florian Weimer wrote: > > * Adhemerval Zanella via Libc-alpha: > > > >> On 28/04/2020 18:52, H.J. Lu via Libc-alpha wrote: > >>> When CET is enabled, it is an error to dlopen a non CET enabled shared > >>> library in CET enabled application. It may be desirable to make CET > >>> permissive, that is disable CET when dlopening a non CET enabled shared > >>> library. With the new --enable-cet=permissive configure option, CET is > >>> disabled when dlopening a non CET enabled shared library. > >> > >> Does not CET already provide a tunable to make it permissive? If the idea > >> is to enable as de-facto for a distro bootstrap, why not make it default > >> then? > > > > We currently do not have a way to set a tunable for SUID binaries. > > > > This means that it would be necessary to disable CET at the kernel or > > hypervisor level if the system depends on pre-CET NSS or PAM modules > > for its operation (or something else which is ultimately > > dlopen-based). > > Doesn't disable CET on some modules defeat the very security effort? If so, > why should it be a build option on glibc? I consider it as a transitional build option for OSVs. OSV should use it only as the last resort. I expect we will remove this option a few years from now when all major pieces of OS are CET enabled. Here is the updated patch against today's master. Thanks. From 03f28ce66d85455a328681bbd25a33a20977e989 Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Mon, 27 Apr 2020 15:44:07 -0700 Subject: [PATCH] x86: Add --enable-cet=permissive When CET is enabled, it is an error to dlopen a non CET enabled shared library in CET enabled application. It may be desirable to make CET permissive, that is disable CET when dlopening a non CET enabled shared library. With the new --enable-cet=permissive configure option, CET is disabled when dlopening a non CET enabled shared library. Add DEFAULT_DL_X86_CET_CONTROL to config.h.in: /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_elf_property which enable CET features based on ELF property note. --enable-cet=permissive it to /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_permissive which enable CET features permissively. Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive. --- INSTALL | 26 +++++++++++++++----------- config.h.in | 3 +++ manual/install.texi | 12 ++++++++---- sysdeps/unix/sysv/linux/x86/Makefile | 2 +- sysdeps/x86/Makefile | 18 +++++++++++++----- sysdeps/x86/configure | 21 +++++++++++---------- sysdeps/x86/configure.ac | 19 +++++++++---------- sysdeps/x86/dl-procruntime.c | 4 ++-- sysdeps/x86/tst-cet-legacy-5.c | 25 +++++++++++++++++-------- sysdeps/x86/tst-cet-legacy-6.c | 25 +++++++++++++++++-------- 10 files changed, 96 insertions(+), 59 deletions(-) diff --git a/INSTALL b/INSTALL index b7676d1c9f..62e78725f5 100644 --- a/INSTALL +++ b/INSTALL @@ -123,20 +123,24 @@ if 'CFLAGS' is specified it must enable optimization. For example: executables (PIE) by default. '--enable-cet' +'--enable-cet=permissive' Enable Intel Control-flow Enforcement Technology (CET) support. - When the GNU C Library is built with '--enable-cet', the resulting - library is protected with indirect branch tracking (IBT) and shadow - stack (SHSTK). When CET is enabled, the GNU C Library is - compatible with all existing executables and shared libraries. - This feature is currently supported on i386, x86_64 and x32 with - GCC 8 and binutils 2.29 or later. Note that when CET is enabled, - the GNU C Library requires CPUs capable of multi-byte NOPs, like - x86-64 processors as well as Intel Pentium Pro or newer. + When the GNU C Library is built with '--enable-cet' or + '--enable-cet=permissive', the resulting library is protected with + indirect branch tracking (IBT) and shadow stack (SHSTK). When CET + is enabled, the GNU C Library is compatible with all existing + executables and shared libraries. This feature is currently + supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or + later. Note that when CET is enabled, the GNU C Library requires + CPUs capable of multi-byte NOPs, like x86-64 processors as well as + Intel Pentium Pro or newer. With '--enable-cet', it is an error to + dlopen a non CET enabled shared library in CET enabled application. + With '--enable-cet=permissive', CET is disabled when dlopening a + non CET enabled shared library in CET enabled application. NOTE: '--enable-cet' has been tested for i686, x86_64 and x32 on - non-CET processors. '--enable-cet' has been tested for x86_64 and - x32 on CET SDVs, but Intel CET support hasn't been validated for - i686. + non-CET processors. '--enable-cet' has been tested for i686, + x86_64 and x32 on CET processors. '--disable-profile' Don't build libraries with profiling information. You may want to diff --git a/config.h.in b/config.h.in index dea43df438..a63b1cc939 100644 --- a/config.h.in +++ b/config.h.in @@ -262,4 +262,7 @@ in i386 6 argument syscall issue). */ #define CAN_USE_REGISTER_ASM_EBP 0 +/* The default value of x86 CET control. */ +#define DEFAULT_DL_X86_CET_CONTROL cet_elf_property + #endif diff --git a/manual/install.texi b/manual/install.texi index f6d9d92317..c1e49a94fe 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -152,20 +152,24 @@ PIE. This option also implies that glibc programs and tests are created as dynamic position independent executables (PIE) by default. @item --enable-cet +@itemx --enable-cet=permissive Enable Intel Control-flow Enforcement Technology (CET) support. When -@theglibc{} is built with @option{--enable-cet}, the resulting library +@theglibc{} is built with @option{--enable-cet} or +@option{--enable-cet=permissive}, the resulting library is protected with indirect branch tracking (IBT) and shadow stack (SHSTK)@. When CET is enabled, @theglibc{} is compatible with all existing executables and shared libraries. This feature is currently supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later. Note that when CET is enabled, @theglibc{} requires CPUs capable of multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or -newer. +newer. With @option{--enable-cet}, it is an error to dlopen a non CET +enabled shared library in CET enabled application. With +@option{--enable-cet=permissive}, CET is disabled when dlopening a +non CET enabled shared library in CET enabled application. NOTE: @option{--enable-cet} has been tested for i686, x86_64 and x32 on non-CET processors. @option{--enable-cet} has been tested for -x86_64 and x32 on CET SDVs, but Intel CET support hasn't been validated -for i686. +i686, x86_64 and x32 on CET processors. @item --disable-profile Don't build libraries with profiling information. You may want to use diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile index b23b532590..50fd018fa3 100644 --- a/sysdeps/unix/sysv/linux/x86/Makefile +++ b/sysdeps/unix/sysv/linux/x86/Makefile @@ -24,7 +24,7 @@ ifeq ($(subdir),setjmp) tests += tst-saved_mask-1 endif -ifeq ($(enable-cet),yes) +ifneq ($(enable-cet),no) ifeq ($(subdir),elf) tests += tst-cet-property-1 tst-cet-property-2 diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 4ffa699e5f..beab426f67 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -14,7 +14,7 @@ gen-as-const-headers += jmp_buf-ssp.sym sysdep_routines += __longjmp_cancel endif -ifeq ($(enable-cet),yes) +ifneq ($(enable-cet),no) ifeq ($(subdir),elf) sysdep-dl-routines += dl-cet @@ -42,13 +42,21 @@ CFLAGS-tst-cet-legacy-4.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-4a.c += -fcf-protection CFLAGS-tst-cet-legacy-4b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-4.c += -fcf-protection=none -CFLAGS-tst-cet-legacy-5a.c += -fcf-protection -CFLAGS-tst-cet-legacy-5b.c += -fcf-protection +CFLAGS-tst-cet-legacy-5a.c += -fcf-protection -mshstk +ifeq ($(enable-cet),permissive) +CPPFLAGS-tst-cet-legacy-5a.c += -DCET_IS_PERMISSIVE=1 +endif +CFLAGS-tst-cet-legacy-5b.c += -fcf-protection -mshstk +CPPFLAGS-tst-cet-legacy-5b.c += -DCET_DISABLED_BY_ENV=1 CFLAGS-tst-cet-legacy-mod-5a.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-mod-5b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-5c.c += -fcf-protection -CFLAGS-tst-cet-legacy-6a.c += -fcf-protection -CFLAGS-tst-cet-legacy-6b.c += -fcf-protection +CFLAGS-tst-cet-legacy-6a.c += -fcf-protection -mshstk +ifeq ($(enable-cet),permissive) +CPPFLAGS-tst-cet-legacy-6a.c += -DCET_IS_PERMISSIVE=1 +endif +CFLAGS-tst-cet-legacy-6b.c += -fcf-protection -mshstk +CPPFLAGS-tst-cet-legacy-6b.c += -DCET_DISABLED_BY_ENV=1 CFLAGS-tst-cet-legacy-mod-6a.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-mod-6b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-6c.c += -fcf-protection diff --git a/sysdeps/x86/configure b/sysdeps/x86/configure index b1ff281249..81cc4e80d6 100644 --- a/sysdeps/x86/configure +++ b/sysdeps/x86/configure @@ -1,7 +1,7 @@ # This file is generated from configure.ac by Autoconf. DO NOT EDIT! # Local configure fragment for sysdeps/x86. -if test x"$enable_cet" = xyes; then +if test $enable_cet != no; then # Check if CET can be enabled. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether CET can be enabled" >&5 $as_echo_n "checking whether CET can be enabled... " >&6; } @@ -27,17 +27,11 @@ EOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_available" >&5 $as_echo "$libc_cv_x86_cet_available" >&6; } - if test $libc_cv_x86_cet_available = yes; then - enable_cet=yes - else - if test x"$enable_cet" = xdefault; then - enable_cet=no - else - as_fn_error $? "$CC doesn't support CET" "$LINENO" 5 - fi + if test $libc_cv_x86_cet_available != yes; then + as_fn_error $? "$CC doesn't support CET" "$LINENO" 5 fi fi -if test $enable_cet = yes; then +if test $enable_cet != no; then # Check if assembler supports CET. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $AS supports CET" >&5 $as_echo_n "checking whether $AS supports CET... " >&6; } @@ -65,5 +59,12 @@ $as_echo "$libc_cv_x86_cet_as" >&6; } as_fn_error $? "$AS doesn't support CET" "$LINENO" 5 fi fi +if test $enable_cet = yes; then + $as_echo "#define DEFAULT_DL_X86_CET_CONTROL cet_elf_property" >>confdefs.h + +elif test $enable_cet = permissive; then + $as_echo "#define DEFAULT_DL_X86_CET_CONTROL cet_permissive" >>confdefs.h + +fi config_vars="$config_vars enable-cet = $enable_cet" diff --git a/sysdeps/x86/configure.ac b/sysdeps/x86/configure.ac index a909b073af..8f3e1191f6 100644 --- a/sysdeps/x86/configure.ac +++ b/sysdeps/x86/configure.ac @@ -1,7 +1,7 @@ GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory. # Local configure fragment for sysdeps/x86. -if test x"$enable_cet" = xyes; then +if test $enable_cet != no; then # Check if CET can be enabled. AC_CACHE_CHECK(whether CET can be enabled, libc_cv_x86_cet_available, [dnl @@ -16,17 +16,11 @@ EOF libc_cv_x86_cet_available=no fi rm -rf conftest*]) - if test $libc_cv_x86_cet_available = yes; then - enable_cet=yes - else - if test x"$enable_cet" = xdefault; then - enable_cet=no - else - AC_MSG_ERROR([$CC doesn't support CET]) - fi + if test $libc_cv_x86_cet_available != yes; then + AC_MSG_ERROR([$CC doesn't support CET]) fi fi -if test $enable_cet = yes; then +if test $enable_cet != no; then # Check if assembler supports CET. AC_CACHE_CHECK(whether $AS supports CET, libc_cv_x86_cet_as, [dnl @@ -43,4 +37,9 @@ EOF AC_MSG_ERROR([$AS doesn't support CET]) fi fi +if test $enable_cet = yes; then + AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_elf_property) +elif test $enable_cet = permissive; then + AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_permissive) +fi LIBC_CONFIG_VAR([enable-cet], [$enable_cet]) diff --git a/sysdeps/x86/dl-procruntime.c b/sysdeps/x86/dl-procruntime.c index 2c3e97952b..a3ec61b91e 100644 --- a/sysdeps/x86/dl-procruntime.c +++ b/sysdeps/x86/dl-procruntime.c @@ -65,8 +65,8 @@ PROCINFO_CLASS struct dl_x86_feature_control _dl_x86_feature_control # endif # ifndef PROCINFO_DECL = { - .ibt = cet_elf_property, - .shstk = cet_elf_property + .ibt = DEFAULT_DL_X86_CET_CONTROL, + .shstk = DEFAULT_DL_X86_CET_CONTROL, } # endif # if !defined SHARED || defined PROCINFO_DECL diff --git a/sysdeps/x86/tst-cet-legacy-5.c b/sysdeps/x86/tst-cet-legacy-5.c index e2e95b6749..007b30029b 100644 --- a/sysdeps/x86/tst-cet-legacy-5.c +++ b/sysdeps/x86/tst-cet-legacy-5.c @@ -22,6 +22,14 @@ #include #include #include +#include +#include + +#if defined CET_IS_PERMISSIVE || defined CET_DISABLED_BY_ENV +# define CET_MAYBE_DISABLED 1 +#else +# define CET_MAYBE_DISABLED 0 +#endif static void do_test_1 (const char *modname, bool fail) @@ -32,24 +40,25 @@ do_test_1 (const char *modname, bool fail) h = dlopen (modname, RTLD_LAZY); if (h == NULL) { + const char *err = dlerror (); if (fail) { - const char *err = dlerror (); if (strstr (err, "rebuild shared object with SHSTK support enabled") == NULL) - { - printf ("incorrect dlopen '%s' error: %s\n", modname, - err); - exit (1); - } + FAIL_EXIT1 ("incorrect dlopen '%s' error: %s\n", modname, err); return; } - printf ("cannot open '%s': %s\n", modname, dlerror ()); - exit (1); + FAIL_EXIT1 ("cannot open '%s': %s\n", modname, err); } + /* NB: dlopen should never fail on non-CET platforms. If SHSTK is + disabled, assuming IBT is also disabled. */ + bool cet_enabled = _get_ssp () != 0 && !CET_MAYBE_DISABLED; + if (fail && cet_enabled) + FAIL_EXIT1 ("dlopen should have failed\n"); + fp = dlsym (h, "test"); if (fp == NULL) { diff --git a/sysdeps/x86/tst-cet-legacy-6.c b/sysdeps/x86/tst-cet-legacy-6.c index bdbbb9075f..fdf798ee20 100644 --- a/sysdeps/x86/tst-cet-legacy-6.c +++ b/sysdeps/x86/tst-cet-legacy-6.c @@ -22,6 +22,14 @@ #include #include #include +#include +#include + +#if defined CET_IS_PERMISSIVE || defined CET_DISABLED_BY_ENV +# define CET_MAYBE_DISABLED 1 +#else +# define CET_MAYBE_DISABLED 0 +#endif static void do_test_1 (const char *modname, bool fail) @@ -32,24 +40,25 @@ do_test_1 (const char *modname, bool fail) h = dlopen (modname, RTLD_LAZY); if (h == NULL) { + const char *err = dlerror (); if (fail) { - const char *err = dlerror (); if (strstr (err, "rebuild shared object with SHSTK support enabled") == NULL) - { - printf ("incorrect dlopen '%s' error: %s\n", modname, - err); - exit (1); - } + FAIL_EXIT1 ("incorrect dlopen '%s' error: %s\n", modname, err); return; } - printf ("cannot open '%s': %s\n", modname, dlerror ()); - exit (1); + FAIL_EXIT1 ("cannot open '%s': %s\n", modname, err); } + /* NB: dlopen should never fail on non-CET platforms. If SHSTK is + disabled, assuming IBT is also disabled. */ + bool cet_enabled = _get_ssp () != 0 && !CET_MAYBE_DISABLED; + if (fail && cet_enabled) + FAIL_EXIT1 ("dlopen should have failed\n"); + fp = dlsym (h, "test"); if (fp == NULL) { -- 2.26.2