Re: [PATCH] Add _FORTIFY_SOURCE implementation documentation [BZ #28998]

[Siddhesh Poyarekar <siddhesh@sourceware.org>]

On 2022-12-22 08:35, Florian Weimer via Libc-alpha wrote:
> * Siddhesh Poyarekar:
> 
>> +The @code{_FORTIFY_SOURCE} macro may be defined by users to control
>> +hardening of calls into some functions in @theglibc{}.  This feature
>> +needs a compiler that supports either the @code{__builtin_object_size}
>> +or the @code{__builtin_dynamic_object_size} builtin functions.  When the
>> +macro is defined, it enables code that validates access to buffers that
>> +are passed to some functions in @theglibc to determine if they
>> +are safe.  If the compiler is able to deduce the size of the buffer
>> +passed to the function call but the call cannot be determined as safe,
>> +it is replaced by a call to its hardened variant that does the access
>> +validation at runtime.  At runtime, if the access validation check for
>> +the buffer fails, the program will terminate with a @code{SIGABRT}
>> +signal.
> 
> This doesn't really cover %n checks and the open checks, so it's
> slightly misleading.

How about the following then; I've mentioned %n in the description for 
level 2 so I'm only trying to provide a high level summary here:

"""
If the compiler is able to deduce the size of the buffer passed to the 
function call but the call cannot be determined as safe, it is replaced 
by a call to its hardened variant that performs additional safety checks 
at runtime.  At runtime, if those safety checks fail, the program will 
terminate with a @code{SIGABRT} signal.
"""

>> +The following functions are fortified in @theglibc{}:
>> +
>> +@itemize @bullet
>> +@item @code{asprintf}: Replaced with @code{__asprintf_chk}.
>> +
>> +@item @code{confstr}: Replaced with @code{__confstr_chk}.
> 
> Can we auto-generate this?
> 
> It is incomplete.  __open_2, __open64_2 and the *at variants are
> missing.  FD_SET, FD_CLR, FD_ISSET, too.

I did auto-generate this list from the entry points in debug/* so it got 
__fdelt_chk, which is the underlying function for the FD_* macros and 
not the macros themselves.  The open* calls got missed because they're 
not in debug.

We could rearrange these entry points to all be in one place in, e.g. 
fortify/ instead of debug/ and then auto-generate from there?  However 
maybe that's a good exercise for the next release and for now, hack 
together the list so that we have documentation.  I don't think I can do 
the refactoring before the freeze.

Thanks,
Sid