Add hardening options to CFLAGS by default if they are available. (#15087)
* Enable SSP if available. * Add control flow protection options. * Add -D_FORTIFY_SOURCE option if supported. * Add stack-clash-protection option if supported. * Further build flags cleanup.
Austin S. Hemmelgarn committed
Jun 28, 2023 at 07:55 UTC
bb2135702b0ef443c617cceadec7b8422360035f
6 files changed
+86
-10
build_external/clean-install-arch-debug.Dockerfile
+2
-2
@@ -45,8 +45,8 @@ RUN rm -rf autom4te.cache
45
RUN rm -rf .git/
46
RUN find . -type f >/opt/netdata/manifest
47
48
-RUN CFLAGS="-Og -g -ggdb -Wall -Wextra -Wformat-signedness -fstack-protector-all -DNETDATA_INTERNAL_CHECKS=1\
49
- -D_FORTIFY_SOURCE=2 -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --require-cloud --disable-lto
48
+RUN CFLAGS="-Og -g -ggdb -Wall -Wextra -Wformat-signedness -DNETDATA_INTERNAL_CHECKS=1\
49
+ -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --require-cloud --disable-lto
50
51
RUN ln -sf /dev/stdout /var/log/netdata/access.log
52
RUN ln -sf /dev/stdout /var/log/netdata/debug.log
build_external/clean-install-arch-extras.Dockerfile
+2
-2
@@ -45,8 +45,8 @@ RUN rm -rf autom4te.cache
45
RUN rm -rf .git/
46
RUN find . -type f >/opt/netdata/manifest
47
48
-RUN CFLAGS="-Og -g -ggdb -Wall -Wextra -Wformat-signedness -fstack-protector-all -DNETDATA_INTERNAL_CHECKS=1\
49
- -D_FORTIFY_SOURCE=2 -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --require-cloud --disable-lto
48
+RUN CFLAGS="-Og -g -ggdb -Wall -Wextra -Wformat-signedness -DNETDATA_INTERNAL_CHECKS=1\
49
+ -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --require-cloud --disable-lto
50
51
RUN ln -sf /dev/stdout /var/log/netdata/access.log
52
RUN ln -sf /dev/stdout /var/log/netdata/debug.log
build_external/clean-install-arch.Dockerfile
+2
-2
@@ -44,8 +44,8 @@ RUN rm -rf autom4te.cache
44
RUN rm -rf .git/
45
RUN find . -type f >/opt/netdata/manifest
46
47
-RUN CFLAGS="-O1 -ggdb -Wall -Wextra -Wformat-signedness -fstack-protector-all -DNETDATA_INTERNAL_CHECKS=1\
48
- -D_FORTIFY_SOURCE=2 -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --disable-lto
47
+RUN CFLAGS="-O1 -ggdb -Wall -Wextra -Wformat-signedness -DNETDATA_INTERNAL_CHECKS=1\
48
+ -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --disable-lto
49
50
RUN ln -sf /dev/stdout /var/log/netdata/access.log
51
RUN ln -sf /dev/stdout /var/log/netdata/debug.log
build_external/clean-install.Dockerfile
+2
-2
@@ -26,8 +26,8 @@ RUN rm -rf autom4te.cache
26
RUN rm -rf .git/
27
RUN find . -type f >/opt/netdata/manifest
28
29
-RUN CFLAGS="-O1 -ggdb -Wall -Wextra -Wformat-signedness -fstack-protector-all -DNETDATA_INTERNAL_CHECKS=1\
30
- -D_FORTIFY_SOURCE=2 -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --disable-lto
29
+RUN CFLAGS="-O1 -ggdb -Wall -Wextra -Wformat-signedness -DNETDATA_INTERNAL_CHECKS=1\
30
+ -DNETDATA_VERIFY_LOCKS=1 ${EXTRA_CFLAGS}" ./netdata-installer.sh --disable-lto
31
32
RUN ln -sf /dev/stdout /var/log/netdata/access.log
33
RUN ln -sf /dev/stdout /var/log/netdata/debug.log
configure.ac
+77
-1
@@ -377,6 +377,82 @@ AM_CONDITIONAL([MACOS], [test "${build_target}" = "macos"])
377
AM_CONDITIONAL([LINUX], [test "${build_target}" = "linux"])
378
AC_MSG_RESULT([Host OS: ${build_target}])
379
380
+# -----------------------------------------------------------------------------
381
+# hardening
382
+
383
+HARDENING_CFLAGS=""
384
+
385
+if ! echo "${originalCFLAGS}" | grep -q '-fstack-protector'; then
386
+ AX_CHECK_COMPILE_FLAG(
387
+ [-fstack-protector-strong],
388
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -fstack-protector-strong"],
389
+ [AX_CHECK_COMPILE_FLAG(
390
+ [-fstack-protector],
391
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -fstack-protector"],
392
+ ,
393
+ [-Werror],
394
+ )],
395
+ [-Werror],
396
+ )
397
+fi
398
+
399
+if ! echo "${originalCFLAGS}" | grep -q '-fno-stack-clash-protection'; then
400
+ AX_CHECK_COMPILE_FLAG(
401
+ [-fstack-clash-protection],
402
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -fstack-clash-protection"],
403
+ ,
404
+ [-Werror],
405
+ )
406
+fi
407
+
408
+if ! echo "${originalCFLAGS}" | grep -q '-fcf-protection'; then
409
+ AX_CHECK_COMPILE_FLAG(
410
+ [-fcf-protection=full],
411
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -fcf-protection=full"],
412
+ ,
413
+ [-Werror],
414
+ )
415
+fi
416
+
417
+if ! echo "${originalCFLAGS}" | grep -q '-mbranch-protection'; then
418
+ AX_CHECK_COMPILE_FLAG(
419
+ [-mbranch-protection=standard],
420
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -mbranch-protection=standard"],
421
+ ,
422
+ [-Werror],
423
+ )
424
+fi
425
+
426
+if ! echo "${originalCFLAGS}" | grep -q '-D_FORTIFY_SOURCE'; then
427
+ # This complex set of checks is needed because there is no clean
428
+ # way to verify _FORTIFY_SOURCE support without having to check for
429
+ # the required compiler builtins.
430
+ AC_CHECK_DECLS(
431
+ [__builtin_constant_p, __builtin_object_size, __builtin___memcpy_chk, __builtin___memmove_chk, __builtin___mempcpy_chk,
432
+ __builtin___memset_chk, __builtin___snprintf_chk, __builtin___sprintf_chk, __builtin___stpcpy_chk, __builtin___strcat_chk,
433
+ __builtin___strcpy_chk, __builtin___strncat_chk, __builtin___strncpy_chk, __builtin___vsnprintf_chk, __builtin___vsprintf_chk],
434
+ [HAVE_FORTIFY_SOURCE=2]
435
+ )
436
+
437
+ if test "x${HAVE_FORTIFY_SOURCE}" = "x2"; then
438
+ AC_CHECK_DECL(
439
+ __builtin_dynamic_object_size,
440
+ [AX_CHECK_COMPILE_FLAG(
441
+ [-D_FORTIFY_SOURCE=3],
442
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -D_FORTIFY_SOURCE=3"],
443
+ ,
444
+ [-Werror],
445
+ )],
446
+ [AX_CHECK_COMPILE_FLAG(
447
+ [-D_FORTIFY_SOURCE=2],
448
+ [HARDENING_CFLAGS="${HARDENING_CFLAGS} -D_FORTIFY_SOURCE=2"],
449
+ ,
450
+ [-Werror],
451
+ )],
452
+ )
453
+ fi
454
+fi
455
+
456
# -----------------------------------------------------------------------------
457
# backtrace
458
@@ -1724,7 +1800,7 @@ CFLAGS="${originalCFLAGS} ${OPTIONAL_LTO_CFLAGS} ${OPTIONAL_PROTOBUF_CFLAGS} ${O
1800
${OPTIONAL_LIBCAP_CFLAGS} ${OPTIONAL_IPMIMONITORING_CFLAGS} ${OPTIONAL_CUPS_CFLAGS} ${OPTIONAL_XENSTAT_FLAGS} \
1801
${OPTIONAL_KINESIS_CFLAGS} ${OPTIONAL_PUBSUB_CFLAGS} ${OPTIONAL_PROMETHEUS_REMOTE_WRITE_CFLAGS} \
1802
${OPTIONAL_MONGOC_CFLAGS} ${LWS_CFLAGS} ${OPTIONAL_JSONC_STATIC_CFLAGS} ${OPTIONAL_YAML_STATIC_CFLAGS} ${OPTIONAL_BPF_CFLAGS} ${JUDY_CFLAGS} \
1727
- ${OPTIONAL_ACLK_CFLAGS} ${OPTIONAL_ML_CFLAGS} ${OPTIONAL_OS_DEP_CFLAGS} ${HTTPD_CFLAGS}"
1803
+ ${OPTIONAL_ACLK_CFLAGS} ${OPTIONAL_ML_CFLAGS} ${OPTIONAL_OS_DEP_CFLAGS} ${HTTPD_CFLAGS} ${HARDENING_CFLAGS}"
1804
1805
CXXFLAGS="${CFLAGS} ${OPTIONAL_KINESIS_CXXFLAGS} ${CPP_STD_FLAG}"
1806
packaging/makeself/jobs/70-netdata-git.install.sh
+1
-1
@@ -9,7 +9,7 @@ cd "${NETDATA_SOURCE_PATH}" || exit 1
9
if [ "${NETDATA_BUILD_WITH_DEBUG}" -eq 0 ]; then
10
export CFLAGS="-static -O2 -I/openssl-static/include -I/libnetfilter-acct-static/include/libnetfilter_acct -I/usr/include/libmnl -pipe"
11
else
12
- export CFLAGS="-static -O1 -pipe -ggdb -Wall -Wextra -Wformat-signedness -fstack-protector-all -D_FORTIFY_SOURCE=2 -DNETDATA_INTERNAL_CHECKS=1 -I/openssl-static/include -I/libnetfilter-acct-static/include/libnetfilter_acct -I/usr/include/libmnl"
12
+ export CFLAGS="-static -O1 -pipe -ggdb -Wall -Wextra -Wformat-signedness -DNETDATA_INTERNAL_CHECKS=1 -I/openssl-static/include -I/libnetfilter-acct-static/include/libnetfilter_acct -I/usr/include/libmnl"
13
fi
14
15
export LDFLAGS="-static -L/openssl-static/lib -L/libnetfilter-acct-static/lib -lnetfilter_acct -L/usr/lib -lmnl"