* [PATCH] configure: Implement --enable-host-bind-now
@ 2022-02-10 16:50 Marek Polacek
0 siblings, 0 replies; 11+ messages in thread
From: Marek Polacek @ 2022-02-10 16:50 UTC (permalink / raw)
To: GCC Patches; +Cc: Alexandre Oliva, Paolo Bonzini, Joseph Myers, Jakub Jelinek
As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening. BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.
This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
Bootstrapped/regtested on x86_64-pc-linux-gnu (with the option enabled vs
not enabled). I suppose this is GCC 13 material, but maybe I'll get some
comments anyway.
c++tools/ChangeLog:
* configure.ac (--enable-host-bind-now): New check.
* configure: Regenerate.
gcc/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Add
-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
* configure: Regenerate.
* doc/install.texi: Document --enable-host-bind-now.
lto-plugin/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Link with
-z,now.
* configure: Regenerate.
---
c++tools/configure | 11 +++++++++++
c++tools/configure.ac | 7 +++++++
gcc/configure | 20 ++++++++++++++++++--
gcc/configure.ac | 13 ++++++++++++-
gcc/doc/install.texi | 6 ++++++
lto-plugin/configure | 20 ++++++++++++++++++--
lto-plugin/configure.ac | 11 +++++++++++
7 files changed, 83 insertions(+), 5 deletions(-)
diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
GREP
CXXCPP
LD_PICFLAG
+enable_host_bind_now
PICFLAG
MAINTAINER
CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
enable_checking
enable_default_pie
enable_host_pie
+enable_host_bind_now
with_gcc_major_version_only
'
ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
yes,no,all,none,release.
--enable-default-pie enable Position Independent Executable as default
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
# Check if O_CLOEXEC is defined by fcntl
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 1e42689f2eb..d3f23f66f00 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])],
[PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
AC_SUBST(LD_PICFLAG)
# Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index bd4fe1fd6ca..70156b17a40 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
LD_PICFLAG
PICFLAG
enable_default_pie
+enable_host_bind_now
enable_host_pie
enable_host_shared
enable_plugin
@@ -1026,6 +1027,7 @@ enable_version_specific_runtime_libs
enable_plugin
enable_host_shared
enable_host_pie
+enable_host_bind_now
enable_libquadmath_support
with_linker_hash_style
with_diagnostics_color
@@ -1789,6 +1791,7 @@ Optional Features:
--enable-plugin enable plugin support
--enable-host-shared build host code as shared libraries
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
--disable-libquadmath-support
disable libquadmath support for Fortran
--enable-default-pie enable Position Independent Executable as default
@@ -19661,7 +19664,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19676 "configure"
+#line 19679 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -19767,7 +19770,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19782 "configure"
+#line 19785 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -32236,6 +32239,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
# Check whether --enable-libquadmath-support was given.
if test "${enable_libquadmath_support+set}" = set; then :
enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32422,6 +32433,8 @@ else
PICFLAG=
fi
+
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -32430,6 +32443,9 @@ else
LD_PICFLAG=
fi
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
diff --git a/gcc/configure.ac b/gcc/configure.ac
index dca995aeec7..6017bcbc8c6 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7497,6 +7497,12 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])])
AC_SUBST(enable_host_pie)
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
AC_ARG_ENABLE(libquadmath-support,
[AS_HELP_STRING([--disable-libquadmath-support],
[disable libquadmath support for Fortran])],
@@ -7638,6 +7644,8 @@ else
PICFLAG=
fi
+AC_SUBST([PICFLAG])
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -7646,7 +7654,10 @@ else
LD_PICFLAG=
fi
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
AC_SUBST([LD_PICFLAG])
# Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi
index 9747f832a75..b59af198d3e 100644
--- a/gcc/doc/install.texi
+++ b/gcc/doc/install.texi
@@ -1041,6 +1041,12 @@ protection against Return Oriented Programming (ROP) attacks.
in which case @option{-fPIC} is used when compiling, and @option{-pie} when
linking.
+@item --enable-host-bind-now
+Specify that the @emph{host} executables should be linked with the option
+@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
+symbols when the executables are started, and that in turn allows RELRO to
+mark the GOT read-only, resulting in better security.
+
@item @anchor{with-gnu-as}--with-gnu-as
Specify that the compiler should assume that the
assembler it finds is the GNU assembler. However, this does not modify
diff --git a/lto-plugin/configure b/lto-plugin/configure
index 26aad9dd699..f8e29e92ed7 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -656,6 +656,7 @@ accel_dir_suffix
gcc_build_dir
CET_HOST_FLAGS
ac_lto_plugin_ldflags
+enable_host_bind_now
ac_lto_plugin_warn_cflags
EGREP
GREP
@@ -771,6 +772,7 @@ enable_maintainer_mode
with_libiberty
enable_dependency_tracking
enable_largefile
+enable_host_bind_now
enable_cet
with_gcc_major_version_only
enable_shared
@@ -1418,6 +1420,7 @@ Optional Features:
--disable-dependency-tracking
speeds up one-time build
--disable-largefile omit support for large files
+ --enable-host-bind-now link host code as BIND_NOW
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
@@ -5662,6 +5665,19 @@ if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
# Check whether --enable-cet was given.
if test "${enable_cet+set}" = set; then :
@@ -11981,7 +11997,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 11984 "configure"
+#line 12012 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12087,7 +12103,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12090 "configure"
+#line 12118 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 7e6f729e9dc..5d5fea8fe70 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
AC_SUBST(ac_lto_plugin_ldflags)
GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)
base-commit: bf799d3409cb9a189114a6c9ff5b7cd123915764
--
2.34.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-06-29 15:58 ` Martin Jambor
@ 2023-06-29 16:13 ` Marek Polacek
0 siblings, 0 replies; 11+ messages in thread
From: Marek Polacek @ 2023-06-29 16:13 UTC (permalink / raw)
To: Martin Jambor; +Cc: Eric Botcazou, GCC Patches
On Thu, Jun 29, 2023 at 05:58:22PM +0200, Martin Jambor wrote:
> Hi,
>
> On Tue, Jun 27 2023, Marek Polacek wrote:
> > On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> >> Hello,
> >>
> >> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> >> > As promised in the --enable-host-pie patch, this patch adds another
> >> > configure option, --enable-host-bind-now, which adds -z now when linking
> >> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
> >> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >> >
> >> > This option does not affect linking of target libraries; you can use
> >> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >> >
> >> > With this patch:
> >> > $ readelf -Wd cc1{,plus} | grep FLAGS
> >> > 0x000000000000001e (FLAGS) BIND_NOW
> >> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >> > 0x000000000000001e (FLAGS) BIND_NOW
> >> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >> >
> >> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >> >
> >> > c++tools/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check.
> >> > * configure: Regenerate.
> >> >
> >> > gcc/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check. Add
> >> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> >> > * configure: Regenerate.
> >> > * doc/install.texi: Document --enable-host-bind-now.
> >> >
> >> > lto-plugin/ChangeLog:
> >> >
> >> > * configure.ac (--enable-host-bind-now): New check. Link with
> >> > -z,now.
> >> > * configure: Regenerate.
> >>
> >> Our reconfiguration checking script complains about a missing hunk in
> >> lto-plugin/Makefile.in:
> >>
> >> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> >> index cb568e1e09f..f6f5b020ff5 100644
> >> --- a/lto-plugin/Makefile.in
> >> +++ b/lto-plugin/Makefile.in
> >> @@ -298,6 +298,7 @@ datadir = @datadir@
> >> datarootdir = @datarootdir@
> >> docdir = @docdir@
> >> dvidir = @dvidir@
> >> +enable_host_bind_now = @enable_host_bind_now@
> >> exec_prefix = @exec_prefix@
> >> gcc_build_dir = @gcc_build_dir@
> >> get_gcc_base_ver = @get_gcc_base_ver@
> >>
> >>
> >> I am somewhat puzzled why the line is not missing in any of the other
> >> Makefile.in files. Can you please check whether that is the only thing
> >> that is missing (assuming it is actually missing)?
> >
> > Arg, once again, I'm sorry. I don't know how this happened. It would
> > be trivial to fix it but since
> >
> > commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> > Author: Eric Botcazou <ebotcazou@adacore.com>
> > Date: Wed Jun 21 18:19:36 2023 +0200
> >
> > ada: Fix build of GNAT tools
> >
> > the build with Ada included fails with --enable-host-pie. So that needs
> > to be fixed first.
> >
> > Eric, I'm not asking you to fix that, but I'm curious, what did the
> > commit above fix? The patch looks correct; I'm just puzzled why I
> > hadn't seen any build failures.
> >
> > The --enable-host-pie patch has been a nightmare :(.
> >
>
> No worries, I can see how these things can easily get difficult.
>
> Unfortunately I won't have time to actually look at this in the next 2-3
> weeks, so I am inclined to just trust the verification script (which
> essentially runs autoconf/automake everywhere and then expects no diff)
> and commit the one-line change. What do you think, does that make sense
> (even without looking at why other Makefile.in files did not change)?
Yes please, go ahead with the one line change meanwhile. Thanks!
I've opened PR110467 for the build problem.
Marek
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-06-27 15:31 ` Marek Polacek
2023-06-27 15:50 ` Iain Sandoe
2023-06-27 17:06 ` Eric Botcazou
@ 2023-06-29 15:58 ` Martin Jambor
2023-06-29 16:13 ` Marek Polacek
2 siblings, 1 reply; 11+ messages in thread
From: Martin Jambor @ 2023-06-29 15:58 UTC (permalink / raw)
To: Marek Polacek, Eric Botcazou; +Cc: GCC Patches
Hi,
On Tue, Jun 27 2023, Marek Polacek wrote:
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>>
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>> > As promised in the --enable-host-pie patch, this patch adds another
>> > configure option, --enable-host-bind-now, which adds -z now when linking
>> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
>> > allows the GOT to be marked RO; this prevents GOT modification attacks.
>> >
>> > This option does not affect linking of target libraries; you can use
>> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>> >
>> > With this patch:
>> > $ readelf -Wd cc1{,plus} | grep FLAGS
>> > 0x000000000000001e (FLAGS) BIND_NOW
>> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>> > 0x000000000000001e (FLAGS) BIND_NOW
>> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>> >
>> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>> >
>> > c++tools/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check.
>> > * configure: Regenerate.
>> >
>> > gcc/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check. Add
>> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>> > * configure: Regenerate.
>> > * doc/install.texi: Document --enable-host-bind-now.
>> >
>> > lto-plugin/ChangeLog:
>> >
>> > * configure.ac (--enable-host-bind-now): New check. Link with
>> > -z,now.
>> > * configure: Regenerate.
>>
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>>
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>> datarootdir = @datarootdir@
>> docdir = @docdir@
>> dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>> exec_prefix = @exec_prefix@
>> gcc_build_dir = @gcc_build_dir@
>> get_gcc_base_ver = @get_gcc_base_ver@
>>
>>
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files. Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
>
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
>
> The --enable-host-pie patch has been a nightmare :(.
>
No worries, I can see how these things can easily get difficult.
Unfortunately I won't have time to actually look at this in the next 2-3
weeks, so I am inclined to just trust the verification script (which
essentially runs autoconf/automake everywhere and then expects no diff)
and commit the one-line change. What do you think, does that make sense
(even without looking at why other Makefile.in files did not change)?
Thanks,
Martin
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-06-27 15:31 ` Marek Polacek
2023-06-27 15:50 ` Iain Sandoe
@ 2023-06-27 17:06 ` Eric Botcazou
2023-06-29 15:58 ` Martin Jambor
2 siblings, 0 replies; 11+ messages in thread
From: Eric Botcazou @ 2023-06-27 17:06 UTC (permalink / raw)
To: Marek Polacek; +Cc: Martin Jambor, gcc-patches, GCC Patches
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
The GNAT tools were failing to build for a compiler configured with --disable-
host-pie --enable-default-pie.
--
Eric Botcazou
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-06-27 15:31 ` Marek Polacek
@ 2023-06-27 15:50 ` Iain Sandoe
2023-06-27 17:06 ` Eric Botcazou
2023-06-29 15:58 ` Martin Jambor
2 siblings, 0 replies; 11+ messages in thread
From: Iain Sandoe @ 2023-06-27 15:50 UTC (permalink / raw)
To: Eric Botcazou; +Cc: Martin Jambor, GCC Patches, Marek Polacek
> On 27 Jun 2023, at 16:31, Marek Polacek via Gcc-patches <gcc-patches@gcc.gnu.org> wrote:
>
> On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
>> Hello,
>>
>> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
>>> As promised in the --enable-host-pie patch, this patch adds another
>>> configure option, --enable-host-bind-now, which adds -z now when linking
>>> the compiler executables in order to extend hardening. BIND_NOW with RELRO
>>> allows the GOT to be marked RO; this prevents GOT modification attacks.
>>>
>>> This option does not affect linking of target libraries; you can use
>>> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>>>
>>> With this patch:
>>> $ readelf -Wd cc1{,plus} | grep FLAGS
>>> 0x000000000000001e (FLAGS) BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>>> 0x000000000000001e (FLAGS) BIND_NOW
>>> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>>>
>>> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>>>
>>> c++tools/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check.
>>> * configure: Regenerate.
>>>
>>> gcc/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check. Add
>>> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
>>> * configure: Regenerate.
>>> * doc/install.texi: Document --enable-host-bind-now.
>>>
>>> lto-plugin/ChangeLog:
>>>
>>> * configure.ac (--enable-host-bind-now): New check. Link with
>>> -z,now.
>>> * configure: Regenerate.
>>
>> Our reconfiguration checking script complains about a missing hunk in
>> lto-plugin/Makefile.in:
>>
>> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
>> index cb568e1e09f..f6f5b020ff5 100644
>> --- a/lto-plugin/Makefile.in
>> +++ b/lto-plugin/Makefile.in
>> @@ -298,6 +298,7 @@ datadir = @datadir@
>> datarootdir = @datarootdir@
>> docdir = @docdir@
>> dvidir = @dvidir@
>> +enable_host_bind_now = @enable_host_bind_now@
>> exec_prefix = @exec_prefix@
>> gcc_build_dir = @gcc_build_dir@
>> get_gcc_base_ver = @get_gcc_base_ver@
>>
>>
>> I am somewhat puzzled why the line is not missing in any of the other
>> Makefile.in files. Can you please check whether that is the only thing
>> that is missing (assuming it is actually missing)?
>
> Arg, once again, I'm sorry. I don't know how this happened. It would
> be trivial to fix it but since
>
> commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
> Author: Eric Botcazou <ebotcazou@adacore.com>
> Date: Wed Jun 21 18:19:36 2023 +0200
>
> ada: Fix build of GNAT tools
>
> the build with Ada included fails with --enable-host-pie. So that needs
> to be fixed first.
>
> Eric, I'm not asking you to fix that, but I'm curious, what did the
> commit above fix? The patch looks correct; I'm just puzzled why I
> hadn't seen any build failures.
I am also curious as to why we do not need some logic to do a similar job
in gcc-interface/Make-lang.in:
ifeq ($(STAGE1),True)
ADA_INCLUDES=$(COMMON_ADA_INCLUDES)
adalib=$(dir $(shell $(CC) -print-libgcc-file-name))adalib
GNATLIB=$(adalib)/$(if $(wildcard $(adalib)/libgnat.a), libgnat.a,libgnat.so) $(STAGE1_LIBS)
else
^^^ I would expect us to need to switch to libgnat_pic.a when we are building a PIE exe.
Iain
> The --enable-host-pie patch has been a nightmare :(.
>
> Marek
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-06-27 11:39 ` Martin Jambor
@ 2023-06-27 15:31 ` Marek Polacek
2023-06-27 15:50 ` Iain Sandoe
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: Marek Polacek @ 2023-06-27 15:31 UTC (permalink / raw)
To: Martin Jambor, Eric Botcazou; +Cc: GCC Patches
On Tue, Jun 27, 2023 at 01:39:16PM +0200, Martin Jambor wrote:
> Hello,
>
> On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> > As promised in the --enable-host-pie patch, this patch adds another
> > configure option, --enable-host-bind-now, which adds -z now when linking
> > the compiler executables in order to extend hardening. BIND_NOW with RELRO
> > allows the GOT to be marked RO; this prevents GOT modification attacks.
> >
> > This option does not affect linking of target libraries; you can use
> > LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
> >
> > With this patch:
> > $ readelf -Wd cc1{,plus} | grep FLAGS
> > 0x000000000000001e (FLAGS) BIND_NOW
> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> > 0x000000000000001e (FLAGS) BIND_NOW
> > 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> >
> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
> >
> > c++tools/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check.
> > * configure: Regenerate.
> >
> > gcc/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check. Add
> > -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> > * configure: Regenerate.
> > * doc/install.texi: Document --enable-host-bind-now.
> >
> > lto-plugin/ChangeLog:
> >
> > * configure.ac (--enable-host-bind-now): New check. Link with
> > -z,now.
> > * configure: Regenerate.
>
> Our reconfiguration checking script complains about a missing hunk in
> lto-plugin/Makefile.in:
>
> diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
> index cb568e1e09f..f6f5b020ff5 100644
> --- a/lto-plugin/Makefile.in
> +++ b/lto-plugin/Makefile.in
> @@ -298,6 +298,7 @@ datadir = @datadir@
> datarootdir = @datarootdir@
> docdir = @docdir@
> dvidir = @dvidir@
> +enable_host_bind_now = @enable_host_bind_now@
> exec_prefix = @exec_prefix@
> gcc_build_dir = @gcc_build_dir@
> get_gcc_base_ver = @get_gcc_base_ver@
>
>
> I am somewhat puzzled why the line is not missing in any of the other
> Makefile.in files. Can you please check whether that is the only thing
> that is missing (assuming it is actually missing)?
Arg, once again, I'm sorry. I don't know how this happened. It would
be trivial to fix it but since
commit 4a48a38fa99f067b8f3a3d1a5dc7a1e602db351f
Author: Eric Botcazou <ebotcazou@adacore.com>
Date: Wed Jun 21 18:19:36 2023 +0200
ada: Fix build of GNAT tools
the build with Ada included fails with --enable-host-pie. So that needs
to be fixed first.
Eric, I'm not asking you to fix that, but I'm curious, what did the
commit above fix? The patch looks correct; I'm just puzzled why I
hadn't seen any build failures.
The --enable-host-pie patch has been a nightmare :(.
Marek
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-05-16 15:37 Marek Polacek
2023-05-19 21:29 ` Jeff Law
@ 2023-06-27 11:39 ` Martin Jambor
2023-06-27 15:31 ` Marek Polacek
1 sibling, 1 reply; 11+ messages in thread
From: Martin Jambor @ 2023-06-27 11:39 UTC (permalink / raw)
To: Marek Polacek; +Cc: GCC Patches
Hello,
On Tue, May 16 2023, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening. BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> c++tools/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check.
> * configure: Regenerate.
>
> gcc/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Add
> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> * configure: Regenerate.
> * doc/install.texi: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Link with
> -z,now.
> * configure: Regenerate.
Our reconfiguration checking script complains about a missing hunk in
lto-plugin/Makefile.in:
diff --git a/lto-plugin/Makefile.in b/lto-plugin/Makefile.in
index cb568e1e09f..f6f5b020ff5 100644
--- a/lto-plugin/Makefile.in
+++ b/lto-plugin/Makefile.in
@@ -298,6 +298,7 @@ datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
+enable_host_bind_now = @enable_host_bind_now@
exec_prefix = @exec_prefix@
gcc_build_dir = @gcc_build_dir@
get_gcc_base_ver = @get_gcc_base_ver@
I am somewhat puzzled why the line is not missing in any of the other
Makefile.in files. Can you please check whether that is the only thing
that is missing (assuming it is actually missing)?
Thanks,
Martin
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2023-05-16 15:37 Marek Polacek
@ 2023-05-19 21:29 ` Jeff Law
2023-06-27 11:39 ` Martin Jambor
1 sibling, 0 replies; 11+ messages in thread
From: Jeff Law @ 2023-05-19 21:29 UTC (permalink / raw)
To: Marek Polacek, GCC Patches
On 5/16/23 09:37, Marek Polacek via Gcc-patches wrote:
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening. BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> With this patch:
> $ readelf -Wd cc1{,plus} | grep FLAGS
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> c++tools/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check.
> * configure: Regenerate.
>
> gcc/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Add
> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> * configure: Regenerate.
> * doc/install.texi: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Link with
> -z,now.
> * configure: Regenerate.
OK
jeff
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH] configure: Implement --enable-host-bind-now
@ 2023-05-16 15:37 Marek Polacek
2023-05-19 21:29 ` Jeff Law
2023-06-27 11:39 ` Martin Jambor
0 siblings, 2 replies; 11+ messages in thread
From: Marek Polacek @ 2023-05-16 15:37 UTC (permalink / raw)
To: GCC Patches
As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening. BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.
This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
With this patch:
$ readelf -Wd cc1{,plus} | grep FLAGS
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
c++tools/ChangeLog:
* configure.ac (--enable-host-bind-now): New check.
* configure: Regenerate.
gcc/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Add
-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
* configure: Regenerate.
* doc/install.texi: Document --enable-host-bind-now.
lto-plugin/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Link with
-z,now.
* configure: Regenerate.
diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
GREP
CXXCPP
LD_PICFLAG
+enable_host_bind_now
PICFLAG
MAINTAINER
CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
enable_checking
enable_default_pie
enable_host_pie
+enable_host_bind_now
with_gcc_major_version_only
'
ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
yes,no,all,none,release.
--enable-default-pie enable Position Independent Executable as default
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
# Check if O_CLOEXEC is defined by fcntl
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 44dfaccbbfa..c2a16601425 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])],
[PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
AC_SUBST(LD_PICFLAG)
# Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index 629446ecf3b..6d847c60024 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
LD_PICFLAG
PICFLAG
enable_default_pie
+enable_host_bind_now
enable_host_pie
enable_host_shared
enable_plugin
@@ -1031,6 +1032,7 @@ enable_version_specific_runtime_libs
enable_plugin
enable_host_shared
enable_host_pie
+enable_host_bind_now
enable_libquadmath_support
with_linker_hash_style
with_diagnostics_color
@@ -1794,6 +1796,7 @@ Optional Features:
--enable-plugin enable plugin support
--enable-host-shared build host code as shared libraries
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
--disable-libquadmath-support
disable libquadmath support for Fortran
--enable-default-pie enable Position Independent Executable as default
@@ -19852,7 +19855,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19867 "configure"
+#line 19870 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -19958,7 +19961,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19973 "configure"
+#line 19976 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -32105,6 +32108,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
# Check whether --enable-libquadmath-support was given.
if test "${enable_libquadmath_support+set}" = set; then :
enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32291,6 +32302,8 @@ else
PICFLAG=
fi
+
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -32299,6 +32312,9 @@ else
LD_PICFLAG=
fi
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
diff --git a/gcc/configure.ac b/gcc/configure.ac
index 9c69a55668e..f0d56e0eaf0 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7427,6 +7427,12 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])])
AC_SUBST(enable_host_pie)
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
AC_ARG_ENABLE(libquadmath-support,
[AS_HELP_STRING([--disable-libquadmath-support],
[disable libquadmath support for Fortran])],
@@ -7568,6 +7574,8 @@ else
PICFLAG=
fi
+AC_SUBST([PICFLAG])
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -7576,7 +7584,10 @@ else
LD_PICFLAG=
fi
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
AC_SUBST([LD_PICFLAG])
# Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi
index 2248308dbdf..a840d36bd6d 100644
--- a/gcc/doc/install.texi
+++ b/gcc/doc/install.texi
@@ -1092,6 +1092,12 @@ protection against Return Oriented Programming (ROP) attacks.
in which case @option{-fPIC} is used when compiling, and @option{-pie} when
linking.
+@item --enable-host-bind-now
+Specify that the @emph{host} executables should be linked with the option
+@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
+symbols when the executables are started, and that in turn allows RELRO to
+mark the GOT read-only, resulting in better security.
+
@item @anchor{with-gnu-as}--with-gnu-as
Specify that the compiler should assume that the
assembler it finds is the GNU assembler. However, this does not modify
diff --git a/lto-plugin/configure b/lto-plugin/configure
index d522bd24c95..3467defd416 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -663,6 +663,7 @@ accel_dir_suffix
gcc_build_dir
CET_HOST_FLAGS
ac_lto_plugin_ldflags
+enable_host_bind_now
ac_lto_plugin_warn_cflags
EGREP
GREP
@@ -778,6 +779,7 @@ enable_maintainer_mode
with_libiberty
enable_dependency_tracking
enable_largefile
+enable_host_bind_now
enable_cet
with_gcc_major_version_only
enable_shared
@@ -1425,6 +1427,7 @@ Optional Features:
--disable-dependency-tracking
speeds up one-time build
--disable-largefile omit support for large files
+ --enable-host-bind-now link host code as BIND_NOW
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
@@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
# Check whether --enable-cet was given.
if test "${enable_cet+set}" = set; then :
@@ -12134,7 +12150,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12137 "configure"
+#line 12165 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12240,7 +12256,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12243 "configure"
+#line 12271 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 0a7202782ae..84f2a60b480 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
AC_SUBST(ac_lto_plugin_ldflags)
GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] configure: Implement --enable-host-bind-now
2022-11-11 2:53 Marek Polacek
@ 2022-11-20 15:09 ` Jeff Law
0 siblings, 0 replies; 11+ messages in thread
From: Jeff Law @ 2022-11-20 15:09 UTC (permalink / raw)
To: Marek Polacek, GCC Patches; +Cc: oliva, Joseph Myers
On 11/10/22 19:53, Marek Polacek via Gcc-patches wrote:
> This is a rebased version of the patch I posted in February:
> <https://gcc.gnu.org/pipermail/gcc-patches/2022-February/590201.html>.
>
> Fortunately it is much simpler than the patch implementing --enable-host-pie.
> I've converted the install.texi part into configuration.rst, otherwise
> there are no changes to the original version.
>
> With --enable-host-bind-now --enable-host-pie:
> $ readelf -Wd ./gcc/cc1 ./gcc/cc1plus | grep FLAGS
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
> 0x000000000000001e (FLAGS) BIND_NOW
> 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
>
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
>
> -- >8 --
>
> As promised in the --enable-host-pie patch, this patch adds another
> configure option, --enable-host-bind-now, which adds -z now when linking
> the compiler executables in order to extend hardening. BIND_NOW with RELRO
> allows the GOT to be marked RO; this prevents GOT modification attacks.
>
> This option does not affect linking of target libraries; you can use
> LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
>
> c++tools/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check.
> * configure: Regenerate.
>
> gcc/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Add
> -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
> * configure: Regenerate.
> * doc/install/configuration.rst: Document --enable-host-bind-now.
>
> lto-plugin/ChangeLog:
>
> * configure.ac (--enable-host-bind-now): New check. Link with
> -z,now.
> * configure: Regenerate.
> ---
OK. Glad to see this finally get to resolution. While I'm largely in
agreement with Jakub that PIE doesn't provide a major security benefit
for the compiler, it seems better to not have the compiler be special
WRT security options.
Jeff
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH] configure: Implement --enable-host-bind-now
@ 2022-11-11 2:53 Marek Polacek
2022-11-20 15:09 ` Jeff Law
0 siblings, 1 reply; 11+ messages in thread
From: Marek Polacek @ 2022-11-11 2:53 UTC (permalink / raw)
To: GCC Patches; +Cc: oliva, Joseph Myers
This is a rebased version of the patch I posted in February:
<https://gcc.gnu.org/pipermail/gcc-patches/2022-February/590201.html>.
Fortunately it is much simpler than the patch implementing --enable-host-pie.
I've converted the install.texi part into configuration.rst, otherwise
there are no changes to the original version.
With --enable-host-bind-now --enable-host-pie:
$ readelf -Wd ./gcc/cc1 ./gcc/cc1plus | grep FLAGS
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
0x000000000000001e (FLAGS) BIND_NOW
0x000000006ffffffb (FLAGS_1) Flags: NOW PIE
Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?
-- >8 --
As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening. BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.
This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.
c++tools/ChangeLog:
* configure.ac (--enable-host-bind-now): New check.
* configure: Regenerate.
gcc/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Add
-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
* configure: Regenerate.
* doc/install/configuration.rst: Document --enable-host-bind-now.
lto-plugin/ChangeLog:
* configure.ac (--enable-host-bind-now): New check. Link with
-z,now.
* configure: Regenerate.
---
c++tools/configure | 11 +++++++++++
c++tools/configure.ac | 7 +++++++
gcc/configure | 20 ++++++++++++++++++--
gcc/configure.ac | 13 ++++++++++++-
gcc/doc/install/configuration.rst | 7 +++++++
lto-plugin/configure | 20 ++++++++++++++++++--
lto-plugin/configure.ac | 11 +++++++++++
7 files changed, 84 insertions(+), 5 deletions(-)
diff --git a/c++tools/configure b/c++tools/configure
index 88087009383..006efe07b35 100755
--- a/c++tools/configure
+++ b/c++tools/configure
@@ -628,6 +628,7 @@ EGREP
GREP
CXXCPP
LD_PICFLAG
+enable_host_bind_now
PICFLAG
MAINTAINER
CXX_AUX_TOOLS
@@ -702,6 +703,7 @@ enable_maintainer_mode
enable_checking
enable_default_pie
enable_host_pie
+enable_host_bind_now
with_gcc_major_version_only
'
ac_precious_vars='build_alias
@@ -1336,6 +1338,7 @@ Optional Features:
yes,no,all,none,release.
--enable-default-pie enable Position Independent Executable as default
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@@ -3007,6 +3010,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
+
+
# Check if O_CLOEXEC is defined by fcntl
diff --git a/c++tools/configure.ac b/c++tools/configure.ac
index 1e42689f2eb..d3f23f66f00 100644
--- a/c++tools/configure.ac
+++ b/c++tools/configure.ac
@@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])],
[PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
AC_SUBST(PICFLAG)
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])],
+[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
+AC_SUBST(enable_host_bind_now)
AC_SUBST(LD_PICFLAG)
# Check if O_CLOEXEC is defined by fcntl
diff --git a/gcc/configure b/gcc/configure
index 3e303f7e5bd..fb88e41f712 100755
--- a/gcc/configure
+++ b/gcc/configure
@@ -635,6 +635,7 @@ CET_HOST_FLAGS
LD_PICFLAG
PICFLAG
enable_default_pie
+enable_host_bind_now
enable_host_pie
enable_host_shared
enable_plugin
@@ -1030,6 +1031,7 @@ enable_version_specific_runtime_libs
enable_plugin
enable_host_shared
enable_host_pie
+enable_host_bind_now
enable_libquadmath_support
with_linker_hash_style
with_diagnostics_color
@@ -1793,6 +1795,7 @@ Optional Features:
--enable-plugin enable plugin support
--enable-host-shared build host code as shared libraries
--enable-host-pie build host code as PIE
+ --enable-host-bind-now link host code as BIND_NOW
--disable-libquadmath-support
disable libquadmath support for Fortran
--enable-default-pie enable Position Independent Executable as default
@@ -19764,7 +19767,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19779 "configure"
+#line 19782 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -19870,7 +19873,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 19885 "configure"
+#line 19888 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -32012,6 +32015,14 @@ fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
# Check whether --enable-libquadmath-support was given.
if test "${enable_libquadmath_support+set}" = set; then :
enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@@ -32198,6 +32209,8 @@ else
PICFLAG=
fi
+
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -32206,6 +32219,9 @@ else
LD_PICFLAG=
fi
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
diff --git a/gcc/configure.ac b/gcc/configure.ac
index 29eeed7e569..fd6deaf82c8 100644
--- a/gcc/configure.ac
+++ b/gcc/configure.ac
@@ -7411,6 +7411,12 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])])
AC_SUBST(enable_host_pie)
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
AC_ARG_ENABLE(libquadmath-support,
[AS_HELP_STRING([--disable-libquadmath-support],
[disable libquadmath support for Fortran])],
@@ -7552,6 +7558,8 @@ else
PICFLAG=
fi
+AC_SUBST([PICFLAG])
+
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@@ -7560,7 +7568,10 @@ else
LD_PICFLAG=
fi
-AC_SUBST([PICFLAG])
+if test x$enable_host_bind_now = xyes; then
+ LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
+fi
+
AC_SUBST([LD_PICFLAG])
# Enable Intel CET on Intel CET enabled host if jit is enabled.
diff --git a/gcc/doc/install/configuration.rst b/gcc/doc/install/configuration.rst
index c2a9680e1e5..2a541f90156 100644
--- a/gcc/doc/install/configuration.rst
+++ b/gcc/doc/install/configuration.rst
@@ -446,6 +446,13 @@ corresponding :option:`--without` option.
in which case :option:`-fPIC` is used when compiling, and :option:`-pie`
when linking.
+.. option:: --enable-host-bind-now
+
+ Specify that the *host* executables should be linked with the option
+ :option:`-Wl,-z,now`, which means that the dynamic linker will resolve all
+ symbols when the executables are started, and that in turn allows RELRO to
+ mark the GOT read-only, resulting in better security.
+
.. option:: --with-gnu-as
.. _with-gnu-as:
diff --git a/lto-plugin/configure b/lto-plugin/configure
index d522bd24c95..3467defd416 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -663,6 +663,7 @@ accel_dir_suffix
gcc_build_dir
CET_HOST_FLAGS
ac_lto_plugin_ldflags
+enable_host_bind_now
ac_lto_plugin_warn_cflags
EGREP
GREP
@@ -778,6 +779,7 @@ enable_maintainer_mode
with_libiberty
enable_dependency_tracking
enable_largefile
+enable_host_bind_now
enable_cet
with_gcc_major_version_only
enable_shared
@@ -1425,6 +1427,7 @@ Optional Features:
--disable-dependency-tracking
speeds up one-time build
--disable-largefile omit support for large files
+ --enable-host-bind-now link host code as BIND_NOW
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
@@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+# Enable --enable-host-bind-now
+# Check whether --enable-host-bind-now was given.
+if test "${enable_host_bind_now+set}" = set; then :
+ enableval=$enable_host_bind_now;
+fi
+
+
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
+
# Check whether --enable-cet was given.
if test "${enable_cet+set}" = set; then :
@@ -12134,7 +12150,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12137 "configure"
+#line 12165 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12240,7 +12256,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12243 "configure"
+#line 12271 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac
index 0a7202782ae..84f2a60b480 100644
--- a/lto-plugin/configure.ac
+++ b/lto-plugin/configure.ac
@@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
+
+# Enable --enable-host-bind-now
+AC_ARG_ENABLE(host-bind-now,
+[AS_HELP_STRING([--enable-host-bind-now],
+ [link host code as BIND_NOW])])
+AC_SUBST(enable_host_bind_now)
+
+if test x$enable_host_bind_now = xyes; then
+ ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
+fi
+
AC_SUBST(ac_lto_plugin_ldflags)
GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)
base-commit: 5c6546ca7d8cab1f1c129f5b55f709e2ceee0f94
prerequisite-patch-id: 312c7b6ec0b7c87f001758d071d26af5deae50c0
--
2.38.1
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2023-06-29 16:13 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-10 16:50 [PATCH] configure: Implement --enable-host-bind-now Marek Polacek
2022-11-11 2:53 Marek Polacek
2022-11-20 15:09 ` Jeff Law
2023-05-16 15:37 Marek Polacek
2023-05-19 21:29 ` Jeff Law
2023-06-27 11:39 ` Martin Jambor
2023-06-27 15:31 ` Marek Polacek
2023-06-27 15:50 ` Iain Sandoe
2023-06-27 17:06 ` Eric Botcazou
2023-06-29 15:58 ` Martin Jambor
2023-06-29 16:13 ` Marek Polacek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).