build: add -mbranch-protection=bti (aarch64) to hardening flags
#28459
Conversation
|
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers. Code CoverageFor detailed information about the code coverage, see the test coverage report. ReviewsSee the guideline for information on the review process.
If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update. ConflictsReviewers, this pull request conflicts with the following ones:
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first. |
|
Is there a way to check the resulted binaries that the applied flag actually has effect? |
|
Concept ACK. Discussed briefly with @TheCharlatan this morning.
From lwn "The idea is simple enough: if BTI is enabled, the first instruction encountered after an indirect jump must be a special BTI instruction." Sounds like it should be testable with an asm dump. |
|
Not a requirement for us to add a test (we can just inspect any values directly), but I've opened an issue upstream with LIEF, for slightly improved support for these aarch64 note properties: lief-project/LIEF#975. |
3045d0a to
8f48576
Compare
-mbranch-protection=bti for aarch64 Darwin-mbranch-protection=bti (aarch64) to hardening flags
-mbranch-protection=bti (aarch64) to hardening flags -mbranch-protection=bti (aarch64) to hardening flags
8f48576 to
fd5f9cb
Compare
This is a simpler (less hardening) version of bitcoin#24123. Scoped to aarch64 to avoid unused command line option warnings when building on x86_64. Related to bitcoin#19075.
fd5f9cb to
61a6c3b
Compare
|
utACK 61a6c3b |
…o hardening flags 61a6c3b build: add `-mbranch-protection=bti` to aarch64 hardening flags (fanquake) Pull request description: This is a simpler (less hardening) version of bitcoin#24123. You can inspect binaries using `readelf -n`, and look for BTI in a `.note.gnu.property`. i.e ```bash readelf -n src/bitcoin-cli Displaying notes found in: .note.gnu.property Owner Data size Description GNU 0x00000010NT_GNU_PROPERTY_TYPE_0 Properties: AArch64 feature: BTI ``` Related to bitcoin#19075. ACKs for top commit: TheCharlatan: utACK 61a6c3b Tree-SHA512: 64504de44e91d853165daf4111dca905d8eb9ef3f4bfb0d447c677b02c9100dbd56f13e6fe6539fb06c2343a094229591ac5d1bd9e184b32b512c0ac3f9bac36
5335e45 contrib: add macho branch protection check (fanquake) Pull request description: Followup to #28459. Add a sanity check that `bti` instructions are present in the arm macho binary, similar to our x86_64 check for control flow. Could do something similar for aarch64 linux in future, and maybe could use lief-project/LIEF#975. ACKs for top commit: TheCharlatan: ACK 5335e45 Tree-SHA512: 6cc8721209fe07fe07f0524ef6f114004e2b98844f73d31ff16547f7055c7cb4a5609480058c45ede21b457b2dea5357f1475eaa5063ea1f9772aa260f49039b
This is a simpler (less hardening) version of #24123.
You can inspect binaries using
readelf -n, and look for BTI in a.note.gnu.property. i.ereadelf -n src/bitcoin-cli Displaying notes found in: .note.gnu.property Owner Data size Description GNU 0x00000010 NT_GNU_PROPERTY_TYPE_0 Properties: AArch64 feature: BTIRelated to #19075.