m4/hardening.m4 - main - githubmirror/sudo

m4/hardening.m4
197 строк8 KB
Todd C. Miller
hardening.m4: check for -fcf-protection=return on 32-bit x86
04 сен 2025, 17:21
04 сен 2025, 17:215ea92e4
dnl
dnl https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
dnl
AC_DEFUN([SUDO_CHECK_HARDENING], [
    if test "$enable_hardening" != "no"; then
	#
	# Attempt to use _FORTIFY_SOURCE with sprintf.  If the headers support
	# it but libc does not, __sprintf_chk should be an undefined symbol.
	# Some systems warn about using a value of _FORTIFY_SOURCE > 2.
	#
	O_CPPFLAGS="$CPPFLAGS"
	AC_CACHE_CHECK([supported _FORTIFY_SOURCE level],
	    [sudo_cv_fortify_source_level],
	    [
		AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
		AX_APPEND_FLAG([-D_FORTIFY_SOURCE=3], [CPPFLAGS])
		AC_LINK_IFELSE([
		    AC_LANG_PROGRAM(
			[[#include <stdio.h>]],
			[[char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];]]
		    )], [
			sudo_cv_fortify_source_level=3
		    ], [
			# Try again with -D_FORTIFY_SOURCE=2
			CPPFLAGS="$O_CPPFLAGS"
			AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
			AX_APPEND_FLAG([-D_FORTIFY_SOURCE=2], [CPPFLAGS])
			AC_LINK_IFELSE([
			    AC_LANG_PROGRAM(
				[[#include <stdio.h>]],
				[[char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];]]
			    )], [
				sudo_cv_fortify_source_level=2
			    ], [
				sudo_cv_fortify_source_level=none
			    ]
			)
		    ]
		)
	    ]
	)
	CPPFLAGS="$O_CPPFLAGS"
	if test "$sudo_cv_fortify_source_level" != none; then
	    AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
	    AX_APPEND_FLAG([-D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level], [CPPFLAGS])
	fi

	dnl
	dnl The following tests rely on AC_LANG_WERROR.
	dnl
	if test -n "$GCC" -a "$enable_ssp" != "no"; then
	    AC_CACHE_CHECK([for compiler stack protector support],
		[sudo_cv_var_stack_protector],
		[
		    # Avoid CFLAGS since the compiler might optimize away our
		    # test.  We don't want CPPFLAGS or LIBS to interfere with
		    # the test but keep LDFLAGS as it may have an rpath needed
		    # to find the ssp lib.
		    _CPPFLAGS="$CPPFLAGS"
		    _CFLAGS="$CFLAGS"
		    _LDFLAGS="$LDFLAGS"
		    _LIBS="$LIBS"
		    CPPFLAGS=
		    LIBS=

		    sudo_cv_var_stack_protector="-fstack-protector-strong"
		    CFLAGS="$sudo_cv_var_stack_protector"
		    LDFLAGS="$_LDFLAGS $sudo_cv_var_stack_protector"
		    AC_LINK_IFELSE([
			AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
			[[char buf[1024]; buf[1023] = '\0';]])
		    ], [], [
			sudo_cv_var_stack_protector="-fstack-protector-all"
			CFLAGS="$sudo_cv_var_stack_protector"
			LDFLAGS="$_LDFLAGS $sudo_cv_var_stack_protector"
			AC_LINK_IFELSE([
			    AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
			    [[char buf[1024]; buf[1023] = '\0';]])
			], [], [
			    sudo_cv_var_stack_protector="-fstack-protector"
			    CFLAGS="$sudo_cv_var_stack_protector"
			    LDFLAGS="$_LDFLAGS $sudo_cv_var_stack_protector"
			    AC_LINK_IFELSE([
				AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
				[[char buf[1024]; buf[1023] = '\0';]])
			    ], [], [
				sudo_cv_var_stack_protector=no
			    ])
			])
		    ])
		    CPPFLAGS="$_CPPFLAGS"
		    CFLAGS="$_CFLAGS"
		    LDFLAGS="$_LDFLAGS"
		    LIBS="$_LIBS"
		]
	    )
	    if test X"$sudo_cv_var_stack_protector" != X"no"; then
		HARDENING_CFLAGS="$sudo_cv_var_stack_protector"
		HARDENING_LDFLAGS="-Wc,$sudo_cv_var_stack_protector"
	    fi
	fi

	# The gcc front-end may accept -fstack-clash-protection even if the
	# machine-specific code does not support it.  We use a test program
	# with a large stack allocation to try to cause the compiler to
	# insert the stack clash protection code, or fail if not supported.
	if test -n "$GCC"; then
	    AC_CACHE_CHECK([whether C compiler supports -fstack-clash-protection],
		[sudo_cv_check_cflags___fstack_clash_protection],
		[
		    _CFLAGS="$CFLAGS"
		    CFLAGS="$CFLAGS -fstack-clash-protection"
		    AC_COMPILE_IFELSE([
			AC_LANG_SOURCE([[int main(int argc, char *argv[]) { char buf[16384], *src = argv[0], *dst = buf; while ((*dst++ = *src++) != '\0') { continue; } return buf[argc]; }]])
		    ], [sudo_cv_check_cflags___fstack_clash_protection=yes], [sudo_cv_check_cflags___fstack_clash_protection=no])
		    CFLAGS="$_CFLAGS"
		]
	    )
	    if test X"$sudo_cv_check_cflags___fstack_clash_protection" = X"yes"; then
		AX_CHECK_LINK_FLAG([-fstack-clash-protection], [
		    AX_APPEND_FLAG([-fstack-clash-protection], [HARDENING_CFLAGS])
		    AX_APPEND_FLAG([-Wc,-fstack-clash-protection], [HARDENING_LDFLAGS])
		])
	    fi

	    # Check for control-flow transfer instrumentation (Intel CET).
	    # Do not enable branch protection for 32-bit, since no 32-bit
	    # OS supports it and the generated ENDBR32 instructions have
	    # compatibility issues with some older i586/i686 compatible
	    # processors (e.g. Geode or Vortex).
	    AS_CASE([$host_cpu], [x86_64], [
		AX_CHECK_COMPILE_FLAG([-fcf-protection=full], [
		    AX_CHECK_LINK_FLAG([-fcf-protection=full], [
			AX_APPEND_FLAG([-fcf-protection=full], [HARDENING_CFLAGS])
			AX_APPEND_FLAG([-Wc,-fcf-protection=full], [HARDENING_LDFLAGS])
		    ])
		])
	    ], [i*86], [
		AX_CHECK_COMPILE_FLAG([-fcf-protection=return], [
		    AX_CHECK_LINK_FLAG([-fcf-protection=return], [
			AX_APPEND_FLAG([-fcf-protection=return], [HARDENING_CFLAGS])
			AX_APPEND_FLAG([-Wc,-fcf-protection=return], [HARDENING_LDFLAGS])
		    ])
		])
	    ])

	    #
	    # Check for branch protection against ROP and JOP attacks on
	    # AArch64 by using PAC and BTI.
	    #
	    AS_IF([test "$host_cpu" = "aarch64"], [
		AX_CHECK_COMPILE_FLAG([-mbranch-protection=standard], [
		    AX_CHECK_LINK_FLAG([-mbranch-protection=standard], [
			AX_APPEND_FLAG([-mbranch-protection=standard], [HARDENING_CFLAGS])
			AX_APPEND_FLAG([-Wc,-mbranch-protection=standard], [HARDENING_LDFLAGS])
		    ])
		])
	    ])

	    # Force retention of null pointer checks.
	    AX_CHECK_COMPILE_FLAG([-fno-delete-null-pointer-checks], [AX_APPEND_FLAG([-fno-delete-null-pointer-checks], [HARDENING_CFLAGS])])

	    # Guarantee zero initialization of padding bits in
	    # all automatic variable initializers.
	    AX_CHECK_COMPILE_FLAG([-fzero-init-padding-bits=all], [AX_APPEND_FLAG([-fzero-init-padding-bits=all], [HARDENING_CFLAGS])])

	    # Define behavior for signed integer and pointer overflow.
	    AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], [AX_APPEND_FLAG([-fno-strict-overflow], [HARDENING_CFLAGS])])

	    # Disable strict aliasing rules that allow the compiler to assume
	    # that two objects of different types may not use the same address.
	    AX_CHECK_COMPILE_FLAG([-fno-strict-aliasing], [AX_APPEND_FLAG([-fno-strict-aliasing], [HARDENING_CFLAGS])])

	    # Initialize automatic variables without an assignment to zero.
	    # This prevents uninitialized variables from having stack garbage.
	    AX_CHECK_COMPILE_FLAG([-ftrivial-auto-var-init=zero], [AX_APPEND_FLAG([-ftrivial-auto-var-init=zero], [HARDENING_CFLAGS])])
	fi

	# Linker-specific hardening for GNU ld and similar (gold, lld, etc).
	if test X"$with_gnu_ld" = X"yes"; then
	    # Mark relocation table entries resolved at load-time as read-only.
	    AX_CHECK_LINK_FLAG([-Wl,-z,relro], [AX_APPEND_FLAG([-Wl,-z,relro], [HARDENING_LDFLAGS])])

	    # Resolve all symbols when the program is started.
	    AX_CHECK_LINK_FLAG([-Wl,-z,now], [AX_APPEND_FLAG([-Wl,-z,now], [HARDENING_LDFLAGS])])

	    # Mark stack memory as non-executable.
	    AX_CHECK_LINK_FLAG([-Wl,-z,noexecstack], [AX_APPEND_FLAG([-Wl,-z,noexecstack], [HARDENING_LDFLAGS])])

	    # Only link libraries containing symbols that are actually used.
	    AX_CHECK_LINK_FLAG([-Wl,--as-needed], [AX_APPEND_FLAG([-Wl,--as-needed], [HARDENING_LDFLAGS])])

	    # Don't resolve symbols using transitive library dependencies.
	    # The binary must explicitly link against all of its dependencies.
	    AX_CHECK_LINK_FLAG([-Wl,--no-copy-dt-needed-entries], [AX_APPEND_FLAG([-Wl,--no-copy-dt-needed-entries], [HARDENING_LDFLAGS])])
	fi
    fi])