Guix: enable toolchain hardening by default #25484
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
This was referenced Jun 27, 2022
|
GUIX hashes x86: arm64: |
Guix builds on
|
|
Concept ACK on enabling hardening in the toolchain and libc where possible. This is no substitute for doing so in bitcoin's build itself (because it's still important when building manually), but is a good way for defense in depth. It also makes sure all dependencies are built with hardening. |
189045e to
0fe3917
Compare
Guix builds on
|
Guix builds on
|
But in #25437, you said the minimum was glibc 2.25...? Confused. |
I said 2.25 was the minimum for using |
|
Concept ACK |
|
Concept ACK Was able to find The gentoo repo serve as a good resource for evaluating future build changes like this along with debian's salsa. |
0fe3917 to
d340fc6
Compare
|
Rebased for #25639. Updated builds in description. |
Guix builds
|
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 13, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 13, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 13, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 19, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 31, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
May 31, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 3, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 6, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 7, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 8, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 10, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 11, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 11, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 11, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 19, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 20, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 20, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 20, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 20, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 21, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 22, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 25, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 25, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 27, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 27, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 28, 2023
kwvg
added a commit
to kwvg/dash
that referenced
this pull request
Jun 28, 2023
PastaPastaPasta
pushed a commit
to kwvg/dash
that referenced
this pull request
Jun 29, 2023
PastaPastaPasta
added a commit
to dashpay/dash
that referenced
this pull request
Jun 29, 2023
backport: merge bitcoin#25643, bitcoin#23583, bitcoin#23618, bitcoin#23603, bitcoin#23817, bitcoin#24520, bitcoin#24508, bitcoin#25639, bitcoin#26018, bitcoin#25437, bitcoin#25484, bitcoin#23585, bitcoin#24549, bitcoin#24733, bitcoin#21991, bitcoin#22526, bitcoin#25633, bitcoin#24597, bitcoin#24955, bitcoin#25099, bitcoin#24552, bitcoin#21851, bitcoin#25389, bitcoin#25357, partial bitcoin#22318 (guix backports: part 3)
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The GCC (10.3.0) and glibcs (2.24 and 2.27) we build both support configuration option for turning on hardening features by default.
For example, our GCC provides
--enable-default-pie:--enable-default-ssp:and
--enable-cetoptions:It also provides
--enable-standard-branch-protection, but we don't do that here, because we don't support building with it yet (#24123).You could verify the that the on-by-default pie flags are working by Guix building master + this change:
and verifying that the
PIEsecurity checks fail. Then, build this PR branch, + the same change, and checking that they still pass.A similar thing can be done with the stack-protector, i.e perform a Guix build, and observe the security checks failing after applying this diff to master:
Then check that a build doesn't fail when building this PR + that change. Although it should be noted that the security checks will pass for this + that change, even though the GCC option is for stack-protector-strong, rather than stack-protector-all. This is because our stack protector check is currently just for the presencse of the canary, and not a check that every function is instrumented.
For glibc, we enable
--enable-stack-protector=all(RISC-V only):and
--enable-bind-now:You could check that the stack-protector option is being used for the RISC-V builds, by comparing the contents of a function that comes from glibc, i.e
atexit, in a build of master:vs this PR:
Note that none of the above means we would actually remove the use of hardening flags from our configure.
Guix Build (x86_64):
Guix Build (arm64):