From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) by sourceware.org (Postfix) with ESMTPS id 8A46F386F816 for ; Tue, 28 Apr 2020 21:52:46 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 8A46F386F816 Received: by mail-pl1-x62d.google.com with SMTP id w3so19326plz.5 for ; Tue, 28 Apr 2020 14:52:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=S6U9b28Ls4yUC6mYqGdL60eyDqc8g1NUyUb0JOqknmw=; b=WuAsLa5ruOMeiU12YmEK921DH28fKmzhFV1r4SiKzMcGHX0xlwfDZFHMO5bMU70LE3 hcaL+DiE/doIThsuDmXSMOp3I15Qow1XfoJnXbWZM7yWED1bOeD+ZIRHylKbqnAmLkKu O6WAUU9Php4YijWleZqAQoOLA7X0X/XVhwga3hTeGmx777jd5JA7iNzU+rQdof5i3Tkp IKkdgsmjUJ1p485OfPgY152pi+2pow1T1VYMH4GiPmep3LRa+AfYo7dJxRiN86iZIzqz fzJHOeS7mHtC9ToeHlNZolvpBTrae6LgOYWb6nxNsk1yX+D/CpWrU8LWpu7sRP0Xe949 7tWQ== X-Gm-Message-State: AGi0PuYmZ4OaX4tWLT3bvIDj/pKWuH0NZKGYz5DSSSsRFKEqzMZM8u+r f1TeN5aqBjTkhv0t1lSYi4FtuUt2 X-Google-Smtp-Source: APiQypLY4361lLeLL/t/BKDKkHkCGbrE2MTPIdTB/9Gj4QQNGFEU9BIZm3PIDCv+Loz2LYXGOEap7Q== X-Received: by 2002:a17:90b:3017:: with SMTP id hg23mr7913155pjb.150.1588110765449; Tue, 28 Apr 2020 14:52:45 -0700 (PDT) Received: from gnu-cfl-2.localdomain (c-69-181-90-243.hsd1.ca.comcast.net. [69.181.90.243]) by smtp.gmail.com with ESMTPSA id i128sm15792765pfc.149.2020.04.28.14.52.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2020 14:52:44 -0700 (PDT) Received: from gnu-cfl-2.localdomain (localhost [IPv6:::1]) by gnu-cfl-2.localdomain (Postfix) with ESMTP id AF402C04D8; Tue, 28 Apr 2020 14:52:43 -0700 (PDT) From: "H.J. Lu" To: libc-alpha@sourceware.org Subject: [PATCH 3/3] x86: Add --enable-cet=permissive Date: Tue, 28 Apr 2020 14:52:43 -0700 Message-Id: <20200428215243.236312-4-hjl.tools@gmail.com> X-Mailer: git-send-email 2.25.4 In-Reply-To: <20200428215243.236312-1-hjl.tools@gmail.com> References: <20200428215243.236312-1-hjl.tools@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-25.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Apr 2020 21:52:50 -0000 When CET is enabled, it is an error to dlopen a non CET enabled shared library in CET enabled application. It may be desirable to make CET permissive, that is disable CET when dlopening a non CET enabled shared library. With the new --enable-cet=permissive configure option, CET is disabled when dlopening a non CET enabled shared library. Add DEFAULT_DL_X86_FEATURE_1_1 to config.h.in: /* The default value of _dl_x86_feature_1[1]. */ #define DEFAULT_DL_X86_FEATURE_1_1 0 --enable-cet changes it to /* The default value of _dl_x86_feature_1[1]. */ #define DEFAULT_DL_X86_FEATURE_1_1 ((CET_ELF_PROPERTY << CET_IBT_SHIFT) | (CET_ELF_PROPERTY << CET_SHSTK_SHIFT)) enables CET features based on ELF property note. --enable-cet=permissive it to /* The default value of _dl_x86_feature_1[1]. */ #define DEFAULT_DL_X86_FEATURE_1_1 ((CET_PERMISSIVE << CET_IBT_SHIFT) | (CET_PERMISSIVE << CET_SHSTK_SHIFT)) which enable CET features permissively. Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive. --- INSTALL | 26 +++++++++++++++----------- config.h.in | 3 +++ manual/install.texi | 12 ++++++++---- sysdeps/unix/sysv/linux/x86/Makefile | 2 +- sysdeps/x86/Makefile | 18 +++++++++++++----- sysdeps/x86/configure | 21 +++++++++++---------- sysdeps/x86/configure.ac | 19 +++++++++---------- sysdeps/x86/dl-procruntime.c | 5 +++++ sysdeps/x86/tst-cet-legacy-5.c | 25 +++++++++++++++++-------- sysdeps/x86/tst-cet-legacy-6.c | 25 +++++++++++++++++-------- 10 files changed, 99 insertions(+), 57 deletions(-) diff --git a/INSTALL b/INSTALL index 242cb06f91..397537d189 100644 --- a/INSTALL +++ b/INSTALL @@ -123,20 +123,24 @@ if 'CFLAGS' is specified it must enable optimization. For example: executables (PIE) by default. '--enable-cet' +'--enable-cet=permissive' Enable Intel Control-flow Enforcement Technology (CET) support. - When the GNU C Library is built with '--enable-cet', the resulting - library is protected with indirect branch tracking (IBT) and shadow - stack (SHSTK). When CET is enabled, the GNU C Library is - compatible with all existing executables and shared libraries. - This feature is currently supported on i386, x86_64 and x32 with - GCC 8 and binutils 2.29 or later. Note that when CET is enabled, - the GNU C Library requires CPUs capable of multi-byte NOPs, like - x86-64 processors as well as Intel Pentium Pro or newer. + When the GNU C Library is built with '--enable-cet' or + '--enable-cet=permissive', the resulting library is protected with + indirect branch tracking (IBT) and shadow stack (SHSTK). When CET + is enabled, the GNU C Library is compatible with all existing + executables and shared libraries. This feature is currently + supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or + later. Note that when CET is enabled, the GNU C Library requires + CPUs capable of multi-byte NOPs, like x86-64 processors as well as + Intel Pentium Pro or newer. With '--enable-cet', it is an error to + dlopen a non CET enabled shared library in CET enabled application. + With '--enable-cet=permissive', CET is disabled when dlopening a + non CET enabled shared library in CET enabled application. NOTE: '--enable-cet' has been tested for i686, x86_64 and x32 on - non-CET processors. '--enable-cet' has been tested for x86_64 and - x32 on CET SDVs, but Intel CET support hasn't been validated for - i686. + non-CET processors. '--enable-cet' has been tested for i686, + x86_64 and x32 on CET processors. '--disable-profile' Don't build libraries with profiling information. You may want to diff --git a/config.h.in b/config.h.in index dea43df438..93cda8838c 100644 --- a/config.h.in +++ b/config.h.in @@ -262,4 +262,7 @@ in i386 6 argument syscall issue). */ #define CAN_USE_REGISTER_ASM_EBP 0 +/* The default value of _dl_x86_feature_1[1]. */ +#define DEFAULT_DL_X86_FEATURE_1_1 0 + #endif diff --git a/manual/install.texi b/manual/install.texi index 71bf47cac6..f1359526d7 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -152,20 +152,24 @@ PIE. This option also implies that glibc programs and tests are created as dynamic position independent executables (PIE) by default. @item --enable-cet +@itemx --enable-cet=permissive Enable Intel Control-flow Enforcement Technology (CET) support. When -@theglibc{} is built with @option{--enable-cet}, the resulting library +@theglibc{} is built with @option{--enable-cet} or +@option{--enable-cet=permissive}, the resulting library is protected with indirect branch tracking (IBT) and shadow stack (SHSTK)@. When CET is enabled, @theglibc{} is compatible with all existing executables and shared libraries. This feature is currently supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later. Note that when CET is enabled, @theglibc{} requires CPUs capable of multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or -newer. +newer. With @option{--enable-cet}, it is an error to dlopen a non CET +enabled shared library in CET enabled application. With +@option{--enable-cet=permissive}, CET is disabled when dlopening a +non CET enabled shared library in CET enabled application. NOTE: @option{--enable-cet} has been tested for i686, x86_64 and x32 on non-CET processors. @option{--enable-cet} has been tested for -x86_64 and x32 on CET SDVs, but Intel CET support hasn't been validated -for i686. +i686, x86_64 and x32 on CET processors. @item --disable-profile Don't build libraries with profiling information. You may want to use diff --git a/sysdeps/unix/sysv/linux/x86/Makefile b/sysdeps/unix/sysv/linux/x86/Makefile index b23b532590..50fd018fa3 100644 --- a/sysdeps/unix/sysv/linux/x86/Makefile +++ b/sysdeps/unix/sysv/linux/x86/Makefile @@ -24,7 +24,7 @@ ifeq ($(subdir),setjmp) tests += tst-saved_mask-1 endif -ifeq ($(enable-cet),yes) +ifneq ($(enable-cet),no) ifeq ($(subdir),elf) tests += tst-cet-property-1 tst-cet-property-2 diff --git a/sysdeps/x86/Makefile b/sysdeps/x86/Makefile index 4ffa699e5f..beab426f67 100644 --- a/sysdeps/x86/Makefile +++ b/sysdeps/x86/Makefile @@ -14,7 +14,7 @@ gen-as-const-headers += jmp_buf-ssp.sym sysdep_routines += __longjmp_cancel endif -ifeq ($(enable-cet),yes) +ifneq ($(enable-cet),no) ifeq ($(subdir),elf) sysdep-dl-routines += dl-cet @@ -42,13 +42,21 @@ CFLAGS-tst-cet-legacy-4.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-4a.c += -fcf-protection CFLAGS-tst-cet-legacy-4b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-4.c += -fcf-protection=none -CFLAGS-tst-cet-legacy-5a.c += -fcf-protection -CFLAGS-tst-cet-legacy-5b.c += -fcf-protection +CFLAGS-tst-cet-legacy-5a.c += -fcf-protection -mshstk +ifeq ($(enable-cet),permissive) +CPPFLAGS-tst-cet-legacy-5a.c += -DCET_IS_PERMISSIVE=1 +endif +CFLAGS-tst-cet-legacy-5b.c += -fcf-protection -mshstk +CPPFLAGS-tst-cet-legacy-5b.c += -DCET_DISABLED_BY_ENV=1 CFLAGS-tst-cet-legacy-mod-5a.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-mod-5b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-5c.c += -fcf-protection -CFLAGS-tst-cet-legacy-6a.c += -fcf-protection -CFLAGS-tst-cet-legacy-6b.c += -fcf-protection +CFLAGS-tst-cet-legacy-6a.c += -fcf-protection -mshstk +ifeq ($(enable-cet),permissive) +CPPFLAGS-tst-cet-legacy-6a.c += -DCET_IS_PERMISSIVE=1 +endif +CFLAGS-tst-cet-legacy-6b.c += -fcf-protection -mshstk +CPPFLAGS-tst-cet-legacy-6b.c += -DCET_DISABLED_BY_ENV=1 CFLAGS-tst-cet-legacy-mod-6a.c += -fcf-protection=branch CFLAGS-tst-cet-legacy-mod-6b.c += -fcf-protection CFLAGS-tst-cet-legacy-mod-6c.c += -fcf-protection diff --git a/sysdeps/x86/configure b/sysdeps/x86/configure index b1ff281249..ad4dd412b4 100644 --- a/sysdeps/x86/configure +++ b/sysdeps/x86/configure @@ -1,7 +1,7 @@ # This file is generated from configure.ac by Autoconf. DO NOT EDIT! # Local configure fragment for sysdeps/x86. -if test x"$enable_cet" = xyes; then +if test $enable_cet != no; then # Check if CET can be enabled. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether CET can be enabled" >&5 $as_echo_n "checking whether CET can be enabled... " >&6; } @@ -27,17 +27,11 @@ EOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_available" >&5 $as_echo "$libc_cv_x86_cet_available" >&6; } - if test $libc_cv_x86_cet_available = yes; then - enable_cet=yes - else - if test x"$enable_cet" = xdefault; then - enable_cet=no - else - as_fn_error $? "$CC doesn't support CET" "$LINENO" 5 - fi + if test $libc_cv_x86_cet_available != yes; then + as_fn_error $? "$CC doesn't support CET" "$LINENO" 5 fi fi -if test $enable_cet = yes; then +if test $enable_cet != no; then # Check if assembler supports CET. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $AS supports CET" >&5 $as_echo_n "checking whether $AS supports CET... " >&6; } @@ -65,5 +59,12 @@ $as_echo "$libc_cv_x86_cet_as" >&6; } as_fn_error $? "$AS doesn't support CET" "$LINENO" 5 fi fi +if test $enable_cet = yes; then + $as_echo "#define DEFAULT_DL_X86_FEATURE_1_1 ((CET_ELF_PROPERTY << CET_IBT_SHIFT) | (CET_ELF_PROPERTY << CET_SHSTK_SHIFT))" >>confdefs.h + +elif test $enable_cet = permissive; then + $as_echo "#define DEFAULT_DL_X86_FEATURE_1_1 ((CET_PERMISSIVE << CET_IBT_SHIFT) | (CET_PERMISSIVE << CET_SHSTK_SHIFT))" >>confdefs.h + +fi config_vars="$config_vars enable-cet = $enable_cet" diff --git a/sysdeps/x86/configure.ac b/sysdeps/x86/configure.ac index a909b073af..b3ab3c83d8 100644 --- a/sysdeps/x86/configure.ac +++ b/sysdeps/x86/configure.ac @@ -1,7 +1,7 @@ GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory. # Local configure fragment for sysdeps/x86. -if test x"$enable_cet" = xyes; then +if test $enable_cet != no; then # Check if CET can be enabled. AC_CACHE_CHECK(whether CET can be enabled, libc_cv_x86_cet_available, [dnl @@ -16,17 +16,11 @@ EOF libc_cv_x86_cet_available=no fi rm -rf conftest*]) - if test $libc_cv_x86_cet_available = yes; then - enable_cet=yes - else - if test x"$enable_cet" = xdefault; then - enable_cet=no - else - AC_MSG_ERROR([$CC doesn't support CET]) - fi + if test $libc_cv_x86_cet_available != yes; then + AC_MSG_ERROR([$CC doesn't support CET]) fi fi -if test $enable_cet = yes; then +if test $enable_cet != no; then # Check if assembler supports CET. AC_CACHE_CHECK(whether $AS supports CET, libc_cv_x86_cet_as, [dnl @@ -43,4 +37,9 @@ EOF AC_MSG_ERROR([$AS doesn't support CET]) fi fi +if test $enable_cet = yes; then + AC_DEFINE(DEFAULT_DL_X86_FEATURE_1_1, ((CET_ELF_PROPERTY << CET_IBT_SHIFT) | (CET_ELF_PROPERTY << CET_SHSTK_SHIFT))) +elif test $enable_cet = permissive; then + AC_DEFINE(DEFAULT_DL_X86_FEATURE_1_1, ((CET_PERMISSIVE << CET_IBT_SHIFT) | (CET_PERMISSIVE << CET_SHSTK_SHIFT))) +fi LIBC_CONFIG_VAR([enable-cet], [$enable_cet]) diff --git a/sysdeps/x86/dl-procruntime.c b/sysdeps/x86/dl-procruntime.c index 5e39a38133..d5be40294e 100644 --- a/sysdeps/x86/dl-procruntime.c +++ b/sysdeps/x86/dl-procruntime.c @@ -49,6 +49,11 @@ # else PROCINFO_CLASS unsigned int _dl_x86_feature_1[2] # endif +# ifndef PROCINFO_DECL += { + 0, DEFAULT_DL_X86_FEATURE_1_1 + } +# endif # if !defined SHARED || defined PROCINFO_DECL ; # else diff --git a/sysdeps/x86/tst-cet-legacy-5.c b/sysdeps/x86/tst-cet-legacy-5.c index e2e95b6749..007b30029b 100644 --- a/sysdeps/x86/tst-cet-legacy-5.c +++ b/sysdeps/x86/tst-cet-legacy-5.c @@ -22,6 +22,14 @@ #include #include #include +#include +#include + +#if defined CET_IS_PERMISSIVE || defined CET_DISABLED_BY_ENV +# define CET_MAYBE_DISABLED 1 +#else +# define CET_MAYBE_DISABLED 0 +#endif static void do_test_1 (const char *modname, bool fail) @@ -32,24 +40,25 @@ do_test_1 (const char *modname, bool fail) h = dlopen (modname, RTLD_LAZY); if (h == NULL) { + const char *err = dlerror (); if (fail) { - const char *err = dlerror (); if (strstr (err, "rebuild shared object with SHSTK support enabled") == NULL) - { - printf ("incorrect dlopen '%s' error: %s\n", modname, - err); - exit (1); - } + FAIL_EXIT1 ("incorrect dlopen '%s' error: %s\n", modname, err); return; } - printf ("cannot open '%s': %s\n", modname, dlerror ()); - exit (1); + FAIL_EXIT1 ("cannot open '%s': %s\n", modname, err); } + /* NB: dlopen should never fail on non-CET platforms. If SHSTK is + disabled, assuming IBT is also disabled. */ + bool cet_enabled = _get_ssp () != 0 && !CET_MAYBE_DISABLED; + if (fail && cet_enabled) + FAIL_EXIT1 ("dlopen should have failed\n"); + fp = dlsym (h, "test"); if (fp == NULL) { diff --git a/sysdeps/x86/tst-cet-legacy-6.c b/sysdeps/x86/tst-cet-legacy-6.c index bdbbb9075f..fdf798ee20 100644 --- a/sysdeps/x86/tst-cet-legacy-6.c +++ b/sysdeps/x86/tst-cet-legacy-6.c @@ -22,6 +22,14 @@ #include #include #include +#include +#include + +#if defined CET_IS_PERMISSIVE || defined CET_DISABLED_BY_ENV +# define CET_MAYBE_DISABLED 1 +#else +# define CET_MAYBE_DISABLED 0 +#endif static void do_test_1 (const char *modname, bool fail) @@ -32,24 +40,25 @@ do_test_1 (const char *modname, bool fail) h = dlopen (modname, RTLD_LAZY); if (h == NULL) { + const char *err = dlerror (); if (fail) { - const char *err = dlerror (); if (strstr (err, "rebuild shared object with SHSTK support enabled") == NULL) - { - printf ("incorrect dlopen '%s' error: %s\n", modname, - err); - exit (1); - } + FAIL_EXIT1 ("incorrect dlopen '%s' error: %s\n", modname, err); return; } - printf ("cannot open '%s': %s\n", modname, dlerror ()); - exit (1); + FAIL_EXIT1 ("cannot open '%s': %s\n", modname, err); } + /* NB: dlopen should never fail on non-CET platforms. If SHSTK is + disabled, assuming IBT is also disabled. */ + bool cet_enabled = _get_ssp () != 0 && !CET_MAYBE_DISABLED; + if (fail && cet_enabled) + FAIL_EXIT1 ("dlopen should have failed\n"); + fp = dlsym (h, "test"); if (fp == NULL) { -- 2.25.4