mirrors/bitcoin
1
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2024-11-20 10:38:42 +01:00
Code Issues Projects Releases Wiki Activity
71f96c274f
bitcoin/contrib/devtools/test-security-check.py

153 lines
10 KiB
Python
Raw Normal View History

[contrib] convert test-security-check to python3
2018-04-13 17:37:53 +02:00
#!/usr/bin/env python3
scripted-diff: Bump copyright headers -BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: - 2021: f47dda2c58b5d8d623e0e7ff4e74bc352dfa83d7 - 2020: fa0074e2d82928016a43ca408717154a1c70a4db - 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2022-12-25 00:49:50 +01:00
# Copyright (c) 2015-2022 The Bitcoin Core developers
[copyright] add MIT License copyright header to remaining Python files
2016-09-11 23:32:22 +02:00
# Distributed under the MIT software license, see the accompanying
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
'''
Test script for security-check.py
'''
lint: stop ignoring LIEF imports Type stubs are now available as of 0.13.0. See https://github.com/lief-project/LIEF/issues/650.
2023-04-21 11:28:53 +02:00
import lief
test: Cleanup test files in test-{security,symbol}-check.py
2021-03-13 17:27:11 +01:00
import os
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
import subprocess
import unittest
devtools: Improve *-check.py tool detection This is important to make sure that we're not testing tools different from the one we're building with. Introduce determine_wellknown_cmd, which encapsulates how we should handle well-known tools specification (IFS splitting, env override, etc.).
2021-01-21 19:52:40 +01:00
from utils import determine_wellknown_cmd
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
def write_testcode(filename):
Explicitly specify encoding when opening text files in Python code
2018-06-12 17:49:20 +02:00
with open(filename, 'w', encoding="utf8") as f:
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
f.write('''
#include <stdio.h>
int main()
{
printf("the quick brown fox jumps over the lazy god\\n");
return 0;
}
''')
test: Cleanup test files in test-{security,symbol}-check.py
2021-03-13 17:27:11 +01:00
def clean_files(source, executable):
os.remove(source)
os.remove(executable)
script, test: add missing python type annotations Fix warnings for these files when ./test/lint/lint-python.py is run using mypy 0.991 (released 11/2022) and later: "By default the bodies of untyped functions are not checked, consider using --check-untyped-defs [annotation-unchecked]" For details, see: https://mypy-lang.blogspot.com/2022/11/mypy-0990-released.html
2023-06-29 23:41:27 +02:00
def call_security_check(cc: str, source: str, executable: str, options) -> tuple:
test-*-check: Pass in *FLAGS and compile with them These test-*-check scripts should compile "test" binaries in a way that is as close to what autotools would do, since the goal is to make sure that if we run the *-check script, they can correctly detect flaws in binaries which are compiled by our autotools-based system. Therefore, we should emulate what happens when the binary is linked in autotools, meaning that for C binaries, we need to supply the CFLAGS, CPPFLAGS, and LDFLAGS flags in that order. Note to future developers: perhaps it'd be nice to have these test-*-check scripts be part of configure.ac to avoid having to manually replicate autoconf-like behaviour every time we find a discrepancy. Of course, that would also mean you'd have to write more m4...
2021-10-01 02:17:53 +02:00
# This should behave the same as AC_TRY_LINK, so arrange well-known flags
# in the same order as autoconf would.
#
# See the definitions for ac_link in autoconf's lib/autoconf/c.m4 file for
# reference.
test: use built-in collection types for type hints (Python 3.9 / PEP 585) Since Python 3.9, type hinting has become a little less awkward, as for collection types one doesn't need to import the corresponding capitalized types (`Dict`, `List`, `Set`, `Tuple`, ...) anymore, but can use the built-in types directly. [1] [2] This commit applies the replacement for all Python scripts (i.e. in the contrib and test folders) for the basic types: - typing.Dict -> dict - typing.List -> list - typing.Set -> set - typing.Tuple -> tuple [1] https://docs.python.org/3.9/whatsnew/3.9.html#type-hinting-generics-in-standard-collections [2] https://peps.python.org/pep-0585/#implementation for a list of type
2023-10-25 00:55:17 +02:00
env_flags: list[str] = []
test-*-check: Pass in *FLAGS and compile with them These test-*-check scripts should compile "test" binaries in a way that is as close to what autotools would do, since the goal is to make sure that if we run the *-check script, they can correctly detect flaws in binaries which are compiled by our autotools-based system. Therefore, we should emulate what happens when the binary is linked in autotools, meaning that for C binaries, we need to supply the CFLAGS, CPPFLAGS, and LDFLAGS flags in that order. Note to future developers: perhaps it'd be nice to have these test-*-check scripts be part of configure.ac to avoid having to manually replicate autoconf-like behaviour every time we find a discrepancy. Of course, that would also mean you'd have to write more m4...
2021-10-01 02:17:53 +02:00
for var in ['CFLAGS', 'CPPFLAGS', 'LDFLAGS']:
env_flags += filter(None, os.environ.get(var, '').split(' '))
subprocess.run([*cc,source,'-o',executable] + env_flags + options, check=True)
scripted-diff: Use new python 3.7 keywords -BEGIN VERIFY SCRIPT- sed -i 's/universal_newlines/text/g' $(git grep -l universal_newlines) -END VERIFY SCRIPT-
2023-01-17 21:46:35 +01:00
p = subprocess.run([os.path.join(os.path.dirname(__file__), 'security-check.py'), executable], stdout=subprocess.PIPE, text=True)
test: use subprocess.run() in test-security-check.py
2020-05-15 04:52:20 +02:00
return (p.returncode, p.stdout.rstrip())
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
scripts: add CONTROL_FLOW to ELF security checks
2021-10-15 07:41:49 +02:00
def get_arch(cc, source, executable):
subprocess.run([*cc, source, '-o', executable], check=True)
binary = lief.parse(executable)
arch = binary.abstract.header.architecture
os.remove(executable)
return arch
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
class TestSecurityChecks(unittest.TestCase):
def test_ELF(self):
source = 'test1.c'
executable = 'test1'
devtools: Improve *-check.py tool detection This is important to make sure that we're not testing tools different from the one we're building with. Introduce determine_wellknown_cmd, which encapsulates how we should handle well-known tools specification (IFS splitting, env override, etc.).
2021-01-21 19:52:40 +01:00
cc = determine_wellknown_cmd('CC', 'gcc')
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
write_testcode(source)
scripts: add CONTROL_FLOW to ELF security checks
2021-10-15 07:41:49 +02:00
arch = get_arch(cc, source, executable)
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
scripts: add CONTROL_FLOW to ELF security checks
2021-10-15 07:41:49 +02:00
if arch == lief.ARCHITECTURES.X86:
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE NX RELRO Canary CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE RELRO Canary CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE RELRO CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
(1, executable+': failed RELRO CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
(1, executable+': failed separate_code CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
(1, executable+': failed CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code', '-fcf-protection=full']),
(0, ''))
else:
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE NX RELRO Canary'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE RELRO Canary'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
(1, executable+': failed PIE RELRO'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
(1, executable+': failed RELRO'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
(1, executable+': failed separate_code'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
(0, ''))
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
test: Cleanup test files in test-{security,symbol}-check.py
2021-03-13 17:27:11 +01:00
clean_files(source, executable)
scripts: rename test_64bit_PE to test_PE
2020-03-26 04:37:32 +01:00
def test_PE(self):
tests: Add test for 64-bit PE, modify 32-bit test results 9a75d29b6f0d6c4834e451b0fae2200786655a35 change the error result from `PIE` to `DYNAMIC_BASE`. And there are no test for 64-bit, so I made one
2018-04-26 18:43:01 +02:00
source = 'test1.c'
executable = 'test1.exe'
devtools: Improve *-check.py tool detection This is important to make sure that we're not testing tools different from the one we're building with. Introduce determine_wellknown_cmd, which encapsulates how we should handle well-known tools specification (IFS splitting, env override, etc.).
2021-01-21 19:52:40 +01:00
cc = determine_wellknown_cmd('CC', 'x86_64-w64-mingw32-gcc')
tests: Add test for 64-bit PE, modify 32-bit test results 9a75d29b6f0d6c4834e451b0fae2200786655a35 change the error result from `PIE` to `DYNAMIC_BASE`. And there are no test for 64-bit, so I made one
2018-04-26 18:43:01 +02:00
write_testcode(source)
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--disable-nxcompat','-Wl,--disable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE','-fno-stack-protector']),
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA NX RELOC_SECTION CONTROL_FLOW Canary'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--disable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE','-fstack-protector-all', '-lssp']),
scripts: test for PE control flow instrumentation
2021-05-17 05:58:45 +02:00
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA RELOC_SECTION CONTROL_FLOW'))
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-no-pie','-fno-PIE','-fstack-protector-all', '-lssp']),
scripts: test for PE control flow instrumentation
2021-05-17 05:58:45 +02:00
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA CONTROL_FLOW'))
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--disable-dynamicbase','-Wl,--disable-high-entropy-va','-pie','-fPIE','-fstack-protector-all', '-lssp']),
scripts: test for PE control flow instrumentation
2021-05-17 05:58:45 +02:00
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA CONTROL_FLOW')) # -pie -fPIE does nothing unless --dynamicbase is also supplied
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--disable-high-entropy-va','-pie','-fPIE','-fstack-protector-all', '-lssp']),
scripts: test for PE control flow instrumentation
2021-05-17 05:58:45 +02:00
(1, executable+': failed HIGH_ENTROPY_VA CONTROL_FLOW'))
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--high-entropy-va','-pie','-fPIE','-fstack-protector-all', '-lssp']),
scripts: test for PE control flow instrumentation
2021-05-17 05:58:45 +02:00
(1, executable+': failed CONTROL_FLOW'))
scripts: add PE Canary check to security-check
2023-01-06 11:21:17 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--high-entropy-va','-pie','-fPIE', '-fcf-protection=full','-fstack-protector-all', '-lssp']),
scripts: rename test_64bit_PE to test_PE
2020-03-26 04:37:32 +01:00
(0, ''))
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
test: Cleanup test files in test-{security,symbol}-check.py
2021-03-13 17:27:11 +01:00
clean_files(source, executable)
scripts: add MACHO tests to test-security-check.py
2020-03-24 05:37:57 +01:00
def test_MACHO(self):
source = 'test1.c'
executable = 'test1'
devtools: Improve *-check.py tool detection This is important to make sure that we're not testing tools different from the one we're building with. Introduce determine_wellknown_cmd, which encapsulates how we should handle well-known tools specification (IFS splitting, env override, etc.).
2021-01-21 19:52:40 +01:00
cc = determine_wellknown_cmd('CC', 'clang')
scripts: add MACHO tests to test-security-check.py
2020-03-24 05:37:57 +01:00
write_testcode(source)
contrib: support arm64 darwin in security checks
2022-01-11 14:18:24 +01:00
arch = get_arch(cc, source, executable)
if arch == lief.ARCHITECTURES.X86:
contrib: add macOS fixup_chains check to security-check Followup to #27676.
2023-06-29 12:09:18 +02:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-no_fixup_chains']),
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS PIE NX CONTROL_FLOW'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-fixup_chains']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed NOUNDEFS Canary PIE NX CONTROL_FLOW'))
contrib: add macOS fixup_chains check to security-check Followup to #27676.
2023-06-29 12:09:18 +02:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fstack-protector-all', '-Wl,-fixup_chains']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed NOUNDEFS PIE NX CONTROL_FLOW'))
contrib: add macOS fixup_chains check to security-check Followup to #27676.
2023-06-29 12:09:18 +02:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed NOUNDEFS PIE CONTROL_FLOW'))
contrib: add macOS fixup_chains check to security-check Followup to #27676.
2023-06-29 12:09:18 +02:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all', '-Wl,-fixup_chains']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed PIE CONTROL_FLOW'))
build: remove -bind_at_load usage This is deprecated on macOS: ```bash ld: warning: -bind_at_load is deprecated on macOS ``` and likely redundant anyways, given the behaviour of dyld3. Unfortunately libtool is still injecting a `-bind_at_load`: ```bash # Don't allow lazy linking, it breaks C++ global constructors # But is supposedly fixed on 10.4 or later (yay!). if test CXX = "$tagname"; then case ${MACOSX_DEPLOYMENT_TARGET-10.0} in 10.[0123]) func_append compile_command " $wl-bind_at_load" func_append finalize_command " $wl-bind_at_load" ;; esac fi ``` so this doesn't remove all the warnings, but removes us as a potential source of them. Note that anywhere the ld64 warnings are being emitted, we are already not adding this flag to our hardened ldflags, because of `-Wl,-fatal_warnings`.
2023-10-31 16:08:47 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all', '-Wl,-fixup_chains']),
contrib: support arm64 darwin in security checks
2022-01-11 14:18:24 +01:00
(1, executable+': failed PIE CONTROL_FLOW'))
build: remove -bind_at_load usage This is deprecated on macOS: ```bash ld: warning: -bind_at_load is deprecated on macOS ``` and likely redundant anyways, given the behaviour of dyld3. Unfortunately libtool is still injecting a `-bind_at_load`: ```bash # Don't allow lazy linking, it breaks C++ global constructors # But is supposedly fixed on 10.4 or later (yay!). if test CXX = "$tagname"; then case ${MACOSX_DEPLOYMENT_TARGET-10.0} in 10.[0123]) func_append compile_command " $wl-bind_at_load" func_append finalize_command " $wl-bind_at_load" ;; esac fi ``` so this doesn't remove all the warnings, but removes us as a potential source of them. Note that anywhere the ld64 warnings are being emitted, we are already not adding this flag to our hardened ldflags, because of `-Wl,-fatal_warnings`.
2023-10-31 16:08:47 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
contrib: support arm64 darwin in security checks
2022-01-11 14:18:24 +01:00
(1, executable+': failed PIE'))
build: remove -bind_at_load usage This is deprecated on macOS: ```bash ld: warning: -bind_at_load is deprecated on macOS ``` and likely redundant anyways, given the behaviour of dyld3. Unfortunately libtool is still injecting a `-bind_at_load`: ```bash # Don't allow lazy linking, it breaks C++ global constructors # But is supposedly fixed on 10.4 or later (yay!). if test CXX = "$tagname"; then case ${MACOSX_DEPLOYMENT_TARGET-10.0} in 10.[0123]) func_append compile_command " $wl-bind_at_load" func_append finalize_command " $wl-bind_at_load" ;; esac fi ``` so this doesn't remove all the warnings, but removes us as a potential source of them. Note that anywhere the ld64 warnings are being emitted, we are already not adding this flag to our hardened ldflags, because of `-Wl,-fatal_warnings`.
2023-10-31 16:08:47 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-pie','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
contrib: support arm64 darwin in security checks
2022-01-11 14:18:24 +01:00
(0, ''))
else:
# arm64 darwin doesn't support non-PIE binaries, control flow or executable stacks
contrib: add macOS fixup_chains check to security-check Followup to #27676.
2023-06-29 12:09:18 +02:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-no_fixup_chains']),
contrib: add macho branch protection check
2024-01-03 18:16:16 +01:00
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS BRANCH_PROTECTION'))
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-fixup_chains', '-mbranch-protection=bti']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed NOUNDEFS Canary'))
contrib: add macho branch protection check
2024-01-03 18:16:16 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains', '-mbranch-protection=bti']),
contrib: remove macOS lazy_bind check In future, this will be replaced by a check for fixup_chains usage.
2023-05-31 15:32:10 +02:00
(1, executable+': failed NOUNDEFS'))
contrib: add macho branch protection check
2024-01-03 18:16:16 +01:00
self.assertEqual(call_security_check(cc, source, executable, ['-fstack-protector-all', '-Wl,-fixup_chains', '-mbranch-protection=bti']),
contrib: support arm64 darwin in security checks
2022-01-11 14:18:24 +01:00
(0, ''))
scripts: add MACHO tests to test-security-check.py
2020-03-24 05:37:57 +01:00
test: Cleanup test files in test-{security,symbol}-check.py
2021-03-13 17:27:11 +01:00
clean_files(source, executable)
devtools: Add security-check.py Perform the following ELF security checks: - PIE: Check for position independent executable (PIE), allowing for address space randomization - NX: Check that no sections are writable and executable (including the stack) - RELRO: Check for read-only relocations, binding at startup - Canary: Check for use of stack canary Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).
2015-10-19 14:53:56 +02:00
if __name__ == '__main__':
unittest.main()
Reference in New Issue Copy Permalink