From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id B0399385802E for ; Thu, 10 Feb 2022 16:50:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org B0399385802E Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-15-4KdZ5HW8N3aJu_DmV8xgiA-1; Thu, 10 Feb 2022 11:50:14 -0500 X-MC-Unique: 4KdZ5HW8N3aJu_DmV8xgiA-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0CEC183DD22; Thu, 10 Feb 2022 16:50:13 +0000 (UTC) Received: from pdp-11.redhat.com (unknown [10.22.32.153]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5D7CF7744B; Thu, 10 Feb 2022 16:50:12 +0000 (UTC) From: Marek Polacek To: GCC Patches Cc: Alexandre Oliva , Paolo Bonzini , Joseph Myers , Jakub Jelinek Subject: [PATCH] configure: Implement --enable-host-bind-now Date: Thu, 10 Feb 2022 11:50:09 -0500 Message-Id: <20220210165009.580897-1-polacek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" X-Spam-Status: No, score=-13.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Feb 2022 16:50:20 -0000 As promised in the --enable-host-pie patch, this patch adds another configure option, --enable-host-bind-now, which adds -z now when linking the compiler executables in order to extend hardening. BIND_NOW with RELRO allows the GOT to be marked RO; this prevents GOT modification attacks. This option does not affect linking of target libraries; you can use LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW. Bootstrapped/regtested on x86_64-pc-linux-gnu (with the option enabled vs not enabled). I suppose this is GCC 13 material, but maybe I'll get some comments anyway. c++tools/ChangeLog: * configure.ac (--enable-host-bind-now): New check. * configure: Regenerate. gcc/ChangeLog: * configure.ac (--enable-host-bind-now): New check. Add -Wl,-z,now to LD_PICFLAG if --enable-host-bind-now. * configure: Regenerate. * doc/install.texi: Document --enable-host-bind-now. lto-plugin/ChangeLog: * configure.ac (--enable-host-bind-now): New check. Link with -z,now. * configure: Regenerate. --- c++tools/configure | 11 +++++++++++ c++tools/configure.ac | 7 +++++++ gcc/configure | 20 ++++++++++++++++++-- gcc/configure.ac | 13 ++++++++++++- gcc/doc/install.texi | 6 ++++++ lto-plugin/configure | 20 ++++++++++++++++++-- lto-plugin/configure.ac | 11 +++++++++++ 7 files changed, 83 insertions(+), 5 deletions(-) diff --git a/c++tools/configure b/c++tools/configure index 88087009383..006efe07b35 100755 --- a/c++tools/configure +++ b/c++tools/configure @@ -628,6 +628,7 @@ EGREP GREP CXXCPP LD_PICFLAG +enable_host_bind_now PICFLAG MAINTAINER CXX_AUX_TOOLS @@ -702,6 +703,7 @@ enable_maintainer_mode enable_checking enable_default_pie enable_host_pie +enable_host_bind_now with_gcc_major_version_only ' ac_precious_vars='build_alias @@ -1336,6 +1338,7 @@ Optional Features: yes,no,all,none,release. --enable-default-pie enable Position Independent Executable as default --enable-host-pie build host code as PIE + --enable-host-bind-now link host code as BIND_NOW Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] @@ -3007,6 +3010,14 @@ fi +# Enable --enable-host-bind-now +# Check whether --enable-host-bind-now was given. +if test "${enable_host_bind_now+set}" = set; then : + enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now" +fi + + + # Check if O_CLOEXEC is defined by fcntl diff --git a/c++tools/configure.ac b/c++tools/configure.ac index 1e42689f2eb..d3f23f66f00 100644 --- a/c++tools/configure.ac +++ b/c++tools/configure.ac @@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie, [build host code as PIE])], [PICFLAG=-fPIE; LD_PICFLAG=-pie], []) AC_SUBST(PICFLAG) + +# Enable --enable-host-bind-now +AC_ARG_ENABLE(host-bind-now, +[AS_HELP_STRING([--enable-host-bind-now], + [link host code as BIND_NOW])], +[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], []) +AC_SUBST(enable_host_bind_now) AC_SUBST(LD_PICFLAG) # Check if O_CLOEXEC is defined by fcntl diff --git a/gcc/configure b/gcc/configure index bd4fe1fd6ca..70156b17a40 100755 --- a/gcc/configure +++ b/gcc/configure @@ -635,6 +635,7 @@ CET_HOST_FLAGS LD_PICFLAG PICFLAG enable_default_pie +enable_host_bind_now enable_host_pie enable_host_shared enable_plugin @@ -1026,6 +1027,7 @@ enable_version_specific_runtime_libs enable_plugin enable_host_shared enable_host_pie +enable_host_bind_now enable_libquadmath_support with_linker_hash_style with_diagnostics_color @@ -1789,6 +1791,7 @@ Optional Features: --enable-plugin enable plugin support --enable-host-shared build host code as shared libraries --enable-host-pie build host code as PIE + --enable-host-bind-now link host code as BIND_NOW --disable-libquadmath-support disable libquadmath support for Fortran --enable-default-pie enable Position Independent Executable as default @@ -19661,7 +19664,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 19676 "configure" +#line 19679 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -19767,7 +19770,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 19782 "configure" +#line 19785 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -32236,6 +32239,14 @@ fi +# Enable --enable-host-bind-now +# Check whether --enable-host-bind-now was given. +if test "${enable_host_bind_now+set}" = set; then : + enableval=$enable_host_bind_now; +fi + + + # Check whether --enable-libquadmath-support was given. if test "${enable_libquadmath_support+set}" = set; then : enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval @@ -32422,6 +32433,8 @@ else PICFLAG= fi + + if test x$enable_host_pie = xyes; then LD_PICFLAG=-pie elif test x$gcc_cv_no_pie = xyes; then @@ -32430,6 +32443,9 @@ else LD_PICFLAG= fi +if test x$enable_host_bind_now = xyes; then + LD_PICFLAG="$LD_PICFLAG -Wl,-z,now" +fi diff --git a/gcc/configure.ac b/gcc/configure.ac index dca995aeec7..6017bcbc8c6 100644 --- a/gcc/configure.ac +++ b/gcc/configure.ac @@ -7497,6 +7497,12 @@ AC_ARG_ENABLE(host-pie, [build host code as PIE])]) AC_SUBST(enable_host_pie) +# Enable --enable-host-bind-now +AC_ARG_ENABLE(host-bind-now, +[AS_HELP_STRING([--enable-host-bind-now], + [link host code as BIND_NOW])]) +AC_SUBST(enable_host_bind_now) + AC_ARG_ENABLE(libquadmath-support, [AS_HELP_STRING([--disable-libquadmath-support], [disable libquadmath support for Fortran])], @@ -7638,6 +7644,8 @@ else PICFLAG= fi +AC_SUBST([PICFLAG]) + if test x$enable_host_pie = xyes; then LD_PICFLAG=-pie elif test x$gcc_cv_no_pie = xyes; then @@ -7646,7 +7654,10 @@ else LD_PICFLAG= fi -AC_SUBST([PICFLAG]) +if test x$enable_host_bind_now = xyes; then + LD_PICFLAG="$LD_PICFLAG -Wl,-z,now" +fi + AC_SUBST([LD_PICFLAG]) # Enable Intel CET on Intel CET enabled host if jit is enabled. diff --git a/gcc/doc/install.texi b/gcc/doc/install.texi index 9747f832a75..b59af198d3e 100644 --- a/gcc/doc/install.texi +++ b/gcc/doc/install.texi @@ -1041,6 +1041,12 @@ protection against Return Oriented Programming (ROP) attacks. in which case @option{-fPIC} is used when compiling, and @option{-pie} when linking. +@item --enable-host-bind-now +Specify that the @emph{host} executables should be linked with the option +@option{-Wl,-z,now}, which means that the dynamic linker will resolve all +symbols when the executables are started, and that in turn allows RELRO to +mark the GOT read-only, resulting in better security. + @item @anchor{with-gnu-as}--with-gnu-as Specify that the compiler should assume that the assembler it finds is the GNU assembler. However, this does not modify diff --git a/lto-plugin/configure b/lto-plugin/configure index 26aad9dd699..f8e29e92ed7 100755 --- a/lto-plugin/configure +++ b/lto-plugin/configure @@ -656,6 +656,7 @@ accel_dir_suffix gcc_build_dir CET_HOST_FLAGS ac_lto_plugin_ldflags +enable_host_bind_now ac_lto_plugin_warn_cflags EGREP GREP @@ -771,6 +772,7 @@ enable_maintainer_mode with_libiberty enable_dependency_tracking enable_largefile +enable_host_bind_now enable_cet with_gcc_major_version_only enable_shared @@ -1418,6 +1420,7 @@ Optional Features: --disable-dependency-tracking speeds up one-time build --disable-largefile omit support for large files + --enable-host-bind-now link host code as BIND_NOW --enable-cet enable Intel CET in host libraries [default=auto] --enable-shared[=PKGS] build shared libraries [default=yes] --enable-static[=PKGS] build static libraries [default=yes] @@ -5662,6 +5665,19 @@ if test "x$have_static_libgcc" = xyes; then ac_lto_plugin_ldflags="-Wc,-static-libgcc" fi +# Enable --enable-host-bind-now +# Check whether --enable-host-bind-now was given. +if test "${enable_host_bind_now+set}" = set; then : + enableval=$enable_host_bind_now; +fi + + + +if test x$enable_host_bind_now = xyes; then + ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now" +fi + + # Check whether --enable-cet was given. if test "${enable_cet+set}" = set; then : @@ -11981,7 +11997,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 11984 "configure" +#line 12012 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -12087,7 +12103,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 12090 "configure" +#line 12118 "configure" #include "confdefs.h" #if HAVE_DLFCN_H diff --git a/lto-plugin/configure.ac b/lto-plugin/configure.ac index 7e6f729e9dc..5d5fea8fe70 100644 --- a/lto-plugin/configure.ac +++ b/lto-plugin/configure.ac @@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS" if test "x$have_static_libgcc" = xyes; then ac_lto_plugin_ldflags="-Wc,-static-libgcc" fi + +# Enable --enable-host-bind-now +AC_ARG_ENABLE(host-bind-now, +[AS_HELP_STRING([--enable-host-bind-now], + [link host code as BIND_NOW])]) +AC_SUBST(enable_host_bind_now) + +if test x$enable_host_bind_now = xyes; then + ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now" +fi + AC_SUBST(ac_lto_plugin_ldflags) GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) base-commit: bf799d3409cb9a189114a6c9ff5b7cd123915764 -- 2.34.1