From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bee.birch.relay.mailchannels.net (bee.birch.relay.mailchannels.net [23.83.209.14]) by sourceware.org (Postfix) with ESMTPS id 755183858284; Thu, 22 Dec 2022 12:56:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 755183858284 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=gotplt.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gotplt.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id C43C36C2067; Thu, 22 Dec 2022 12:56:15 +0000 (UTC) Received: from pdx1-sub0-mail-a306.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 566656C1F59; Thu, 22 Dec 2022 12:56:15 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1671713775; a=rsa-sha256; cv=none; b=RAXVxgYZdewgks431RnJnn9gDsHxz64O0JwCSD14BLfzv8BBgGcKWr5LlzZ9PCkn/LP0QW ODjVKPmc8IAB8sogr/1jOXdxQcJmyauTeCKuVWmXXaQOLuTtMVGnHhIMsGz5pxW0Xx/r5W uFtC6TpmRcAydMmsfxI00uw4eEpk3g7lz6NqCp8ntaShxJFU3XWMehC+No7rvjIGsCS16I 66UkwbEeifU/qu24bbmCBTS+JfhcLgAM4U7bbLemWY+y71VQT+no3OlB71T0HzaECXb9pX CD13gG2jFFM1QuN2bMM2jKX9yhdRTmnChDgIqKqlQccAaUlDQQ+ygIP3ShVhcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1671713775; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=51ZjgjbOqGl/SoyU/Xu4uugVpDVZ3RokxnoyjT5JaPk=; b=WryJwP7HwT1+f2w+HNmhbgJ+bLTWT4gK+1JezNK04ddriF+AJHhJ92qRR/VuA5DS4N4p2A bzThJyyYPfQG+auNIw2WO/rrjwAj3dfeR7SwgpRlRxeVtu8rU6Jq3f6U5+s0pXCgF3AP5Y nQqNnbanI+FMLfkNCzAqoQJcypfG/WJdhG5oKVFXN9I26Vug1XgDuORoShU4GFh1iWTkVG YCGsq2spPkAnvotKlkobwhRWfzIdzJ/lGX84ez+k4p/ZJdezL1jFaqAExpdLcTXXoPkYg5 mVXEtw2alqSZ5F4qM0T2axpKNPRl99JfDPN/nDYWb2d/bDG3qsYm7fJLd9wgnA== ARC-Authentication-Results: i=1; rspamd-698c4479bb-lphfv; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@gotplt.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Thoughtful-Befitting: 539c146b1e67921d_1671713775638_2508351194 X-MC-Loop-Signature: 1671713775638:3117911529 X-MC-Ingress-Time: 1671713775638 Received: from pdx1-sub0-mail-a306.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.107.134.72 (trex/6.7.1); Thu, 22 Dec 2022 12:56:15 +0000 Received: from [192.168.0.182] (bras-base-toroon4834w-grc-23-76-68-24-147.dsl.bell.ca [76.68.24.147]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a306.dreamhost.com (Postfix) with ESMTPSA id 4Nd9Kp5pDvzHZ; Thu, 22 Dec 2022 04:56:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gotplt.org; s=dreamhost; t=1671713775; bh=51ZjgjbOqGl/SoyU/Xu4uugVpDVZ3RokxnoyjT5JaPk=; h=Date:Subject:To:Cc:From:Content-Type:Content-Transfer-Encoding; b=DQi3TCko0TEnunWPFiXPjMuq2yvjD7T8X3nfDStO050581UMCf1iOptEdWwHZL7ET JuPABEg0T/Jbw8gKVq+rB+7Q9/4/CuyMO92IrALcIoL2KX/cZH4A301xeVPjrA/QHI fuhXlnyb2uhNaLZnpKlvj2b0YEH4swh0nT5Qs044slR1LtWTzToSOYgPgf4dP23D5M EMtWnCpjpmkOK55M1SbKydamC/mDPm0epwBlTM3yyMRAj4JL8o8W4zvEwp/7jbkfu5 G9qk6tSdVg4YNIVLOZcyyXUC1EP9e/0X7E12z4b2W/8Qmqj2YHxsRa2McbVGAuwAEX xUK2w9p0LO3JQ== Message-ID: Date: Thu, 22 Dec 2022 07:56:13 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.5.0 Subject: Re: [PATCH] Add _FORTIFY_SOURCE implementation documentation [BZ #28998] Content-Language: en-US To: Siddhesh Poyarekar , libc-alpha@sourceware.org Cc: fweimer@redhat.com References: <20221215162506.1802077-1-siddhesh@sourceware.org> From: Siddhesh Poyarekar In-Reply-To: <20221215162506.1802077-1-siddhesh@sourceware.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-3037.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Ping! Any further comments other than the redundant 'See' Andreas noted? Thanks, Sid On 2022-12-15 11:25, Siddhesh Poyarekar via Libc-alpha wrote: > There have been multiple requests to provide more detail on how the > _FORTIFY_SOURCE macro works, so this patch adds a new node in the > Library Maintenance section that does this. A lot of the description is > implementation detail, which is why I put this in the appendix and not > in the main documentation. > > Resolves: BZ #28998. > Signed-off-by: Siddhesh Poyarekar > --- > manual/creature.texi | 4 +- > manual/maint.texi | 191 +++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 194 insertions(+), 1 deletion(-) > > diff --git a/manual/creature.texi b/manual/creature.texi > index 530a02398e..c4f9d99469 100644 > --- a/manual/creature.texi > +++ b/manual/creature.texi > @@ -305,7 +305,9 @@ included. > If this macro is defined to @math{1}, security hardening is added to > various library functions. If defined to @math{2}, even stricter > checks are applied. If defined to @math{3}, @theglibc{} may also use > -checks that may have an additional performance overhead. > +checks that may have an additional performance overhead. See > +@xref{Source Fortification,,Fortification of function calls} for more > +information. > @end defvr > > @defvr Macro _DYNAMIC_STACK_SIZE_SOURCE > diff --git a/manual/maint.texi b/manual/maint.texi > index 49510db7bf..b99a951d3d 100644 > --- a/manual/maint.texi > +++ b/manual/maint.texi > @@ -5,6 +5,7 @@ > @menu > * Source Layout:: How to add new functions or header files > to the GNU C Library. > +* Source Fortification:: Fortification of function calls. > * Symbol handling:: How to handle symbols in the GNU C Library. > * Porting:: How to port the GNU C Library to > a new machine or operating system. > @@ -184,6 +185,196 @@ header file in the machine-specific directory, e.g., > @file{sysdeps/powerpc/sys/platform/ppc.h}. > > > +@node Source Fortification > +@appendixsec Fortification of function calls > + > +This section contains implementation details of @theglibc{} and may not > +remain stable across releases. > + > +The @code{_FORTIFY_SOURCE} macro may be defined by users to control > +hardening of calls into some functions in @theglibc{}. This feature > +needs a compiler that supports either the @code{__builtin_object_size} > +or the @code{__builtin_dynamic_object_size} builtin functions. When the > +macro is defined, it enables code that validates access to buffers that > +are passed to some functions in @theglibc to determine if they > +are safe. If the compiler is able to deduce the size of the buffer > +passed to the function call but the call cannot be determined as safe, > +it is replaced by a call to its hardened variant that does the access > +validation at runtime. At runtime, if the access validation check for > +the buffer fails, the program will terminate with a @code{SIGABRT} > +signal. > + > +@code{_FORTIFY_SOURCE} may be defined to one of the following values: > + > +@itemize @bullet > +@item @math{1}: This enables buffer bounds checking using the value > +returned by the @code{__builtin_object_size} compiler builtin function. > +If the function returns @code{(size_t) -1}, the function call is left > +untouched. > + > +@item @math{2}: This behaves like @math{1}, with the addition of some > +checks that may trap code that is conforming but unsafe, e.g. accepting > +@code{%n} only in read-only format strings. > + > +@item @math{3}: This enables buffer bounds checking using the value > +returned by the @code{__builtin_dynamic_object_size} compiler builtin > +function. If the function returns @code{(size_t) -1}, the function call > +is left untouched. Fortification at this level may have a impact on > +program performance if the function call that is fortified is frequently > +encountered and the size expression returned by > +@code{__builtin_dynamic_object_size} is complex. > +@end itemize > + > +The following functions are fortified in @theglibc{}: > + > +@itemize @bullet > +@item @code{asprintf}: Replaced with @code{__asprintf_chk}. > + > +@item @code{confstr}: Replaced with @code{__confstr_chk}. > + > +@item @code{dprintf}: Replaced with @code{__dprintf_chk}. > + > +@item @code{explicit_bzero}: Replaced with @code{__explicit_bzero_chk}. > + > +@item @code{fdelt}: Replaced with @code{__fdelt_chk}. > + > +@item @code{fgets}: Replaced with @code{__fgets_chk}. > + > +@item @code{fgetws}: Replaced with @code{__fgetws_chk}. > + > +@item @code{fprintf}: Replaced with @code{__fprintf_chk}. > + > +@item @code{fread}: Replaced with @code{__fread_chk}. > + > +@item @code{fwprintf}: Replaced with @code{__fwprintf_chk}. > + > +@item @code{getcwd}: Replaced with @code{__getcwd_chk}. > + > +@item @code{getdomainname}: Replaced with @code{__getdomainname_chk}. > + > +@item @code{getgroups}: Replaced with @code{__getgroups_chk}. > + > +@item @code{gethostname}: Replaced with @code{__gethostname_chk}. > + > +@item @code{gets}: Replaced with @code{__gets_chk}. > + > +@item @code{getwd}: Replaced with @code{__getwd_chk}. > + > +@item @code{longjmp}: Replaced with @code{__longjmp_chk}. > + > +@item @code{mbsnrtowcs}: Replaced with @code{__mbsnrtowcs_chk}. > + > +@item @code{mbsrtowcs}: Replaced with @code{__mbsrtowcs_chk}. > + > +@item @code{mbstowcs}: Replaced with @code{__mbstowcs_chk}. > + > +@item @code{memcpy}: Replaced with @code{__memcpy_chk}. > + > +@item @code{memmove}: Replaced with @code{__memmove_chk}. > + > +@item @code{mempcpy}: Replaced with @code{__mempcpy_chk}. > + > +@item @code{memset}: Replaced with @code{__memset_chk}. > + > +@item @code{obprintf}: Replaced with @code{__obprintf_chk}. > + > +@item @code{poll}: Replaced with @code{__poll_chk}. > + > +@item @code{ppoll}: Replaced with @code{__ppoll_chk}. > + > +@item @code{pread64}: Replaced with @code{__pread64_chk}. > + > +@item @code{pread}: Replaced with @code{__pread_chk}. > + > +@item @code{printf}: Replaced with @code{__printf_chk}. > + > +@item @code{read}: Replaced with @code{__read_chk}. > + > +@item @code{readlinkat}: Replaced with @code{__readlinkat_chk}. > + > +@item @code{readlink}: Replaced with @code{__readlink_chk}. > + > +@item @code{realpath}: Replaced with @code{__realpath_chk}. > + > +@item @code{recv}: Replaced with @code{__recv_chk}. > + > +@item @code{recvfrom}: Replaced with @code{__recvfrom_chk}. > + > +@item @code{snprintf}: Replaced with @code{__snprintf_chk}. > + > +@item @code{sprintf}: Replaced with @code{__sprintf_chk}. > + > +@item @code{stpcpy}: Replaced with @code{__stpcpy_chk}. > + > +@item @code{stpncpy}: Replaced with @code{__stpncpy_chk}. > + > +@item @code{strcat}: Replaced with @code{__strcat_chk}. > + > +@item @code{strcpy}: Replaced with @code{__strcpy_chk}. > + > +@item @code{strncat}: Replaced with @code{__strncat_chk}. > + > +@item @code{strncpy}: Replaced with @code{__strncpy_chk}. > + > +@item @code{swprintf}: Replaced with @code{__swprintf_chk}. > + > +@item @code{ttyname_r}: Replaced with @code{__ttyname_r_chk}. > + > +@item @code{vasprintf}: Replaced with @code{__vasprintf_chk}. > + > +@item @code{vdprintf}: Replaced with @code{__vdprintf_chk}. > + > +@item @code{vfprintf}: Replaced with @code{__vfprintf_chk}. > + > +@item @code{vfwprintf}: Replaced with @code{__vfwprintf_chk}. > + > +@item @code{vobprintf}: Replaced with @code{__vobprintf_chk}. > + > +@item @code{vprintf}: Replaced with @code{__vprintf_chk}. > + > +@item @code{vsnprintf}: Replaced with @code{__vsnprintf_chk}. > + > +@item @code{vsprintf}: Replaced with @code{__vsprintf_chk}. > + > +@item @code{vswprintf}: Replaced with @code{__vswprintf_chk}. > + > +@item @code{vwprintf}: Replaced with @code{__vwprintf_chk}. > + > +@item @code{wcpcpy}: Replaced with @code{__wcpcpy_chk}. > + > +@item @code{wcpncpy}: Replaced with @code{__wcpncpy_chk}. > + > +@item @code{wcrtomb}: Replaced with @code{__wcrtomb_chk}. > + > +@item @code{wcscat}: Replaced with @code{__wcscat_chk}. > + > +@item @code{wcscpy}: Replaced with @code{__wcscpy_chk}. > + > +@item @code{wcsncat}: Replaced with @code{__wcsncat_chk}. > + > +@item @code{wcsncpy}: Replaced with @code{__wcsncpy_chk}. > + > +@item @code{wcsnrtombs}: Replaced with @code{__wcsnrtombs_chk}. > + > +@item @code{wcsrtombs}: Replaced with @code{__wcsrtombs_chk}. > + > +@item @code{wcstombs}: Replaced with @code{__wcstombs_chk}. > + > +@item @code{wctomb}: Replaced with @code{__wctomb_chk}. > + > +@item @code{wmemcpy}: Replaced with @code{__wmemcpy_chk}. > + > +@item @code{wmemmove}: Replaced with @code{__wmemmove_chk}. > + > +@item @code{wmempcpy}: Replaced with @code{__wmempcpy_chk}. > + > +@item @code{wmemset}: Replaced with @code{__wmemset_chk}. > + > +@item @code{wprintf}: Replaced with @code{__wprintf_chk}. > + > +@end itemize > + > + > @node Symbol handling > @appendixsec Symbol handling in the GNU C Library >