Skip to content

Commit 00ba3ba

Browse files
davidgumbergdavidgumberg
committed
build: Drop option for disabling hardening
Building unhardened executables is not a supported use case that should be maintained and those that want unhardened executables can still override them by appending disable flags. For example: cmake -B build -DAPPEND_CPPFLAGS='-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -fno-stack-protector -fcf-protection=none -fno-stack-clash-protection' -DAPPEND_LDFLAGS='-Wl,-z,lazy -Wl,-z,norelro -Wl,-z,noseparate-code'
1 parent f57db75 commit 00ba3ba

File tree

2 files changed

+59
-64
lines changed

2 files changed

+59
-64
lines changed

‎CMakeLists.txt

Lines changed: 59 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,6 @@ if(WITH_BDB)
128128
endif()
129129
cmake_dependent_option(BUILD_WALLET_TOOL "Build bitcoin-wallet tool." ${BUILD_TESTS} "ENABLE_WALLET" OFF)
130130

131-
option(ENABLE_HARDENING "Attempt to harden the resulting executables." ON)
132131
option(REDUCE_EXPORTS "Attempt to reduce exported symbols in the resulting executables." OFF)
133132
option(WERROR "Treat compiler warnings as errors." OFF)
134133
option(WITH_CCACHE "Attempt to use ccache for compiling." ON)
@@ -481,75 +480,73 @@ try_append_cxx_flags("-fmacro-prefix-map=A=B" TARGET core_interface SKIP_LINK
481480
# -fstack-reuse=none for all gcc builds. (Only gcc understands this flag).
482481
try_append_cxx_flags("-fstack-reuse=none" TARGET core_interface)
483482

484-
if(ENABLE_HARDENING)
485-
add_library(hardening_interface INTERFACE)
486-
target_link_libraries(core_interface INTERFACE hardening_interface)
487-
if(MSVC)
488-
try_append_linker_flag("/DYNAMICBASE" TARGET hardening_interface)
489-
try_append_linker_flag("/HIGHENTROPYVA" TARGET hardening_interface)
490-
try_append_linker_flag("/NXCOMPAT" TARGET hardening_interface)
491-
else()
483+
add_library(hardening_interface INTERFACE)
484+
target_link_libraries(core_interface INTERFACE hardening_interface)
485+
if(MSVC)
486+
try_append_linker_flag("/DYNAMICBASE" TARGET hardening_interface)
487+
try_append_linker_flag("/HIGHENTROPYVA" TARGET hardening_interface)
488+
try_append_linker_flag("/NXCOMPAT" TARGET hardening_interface)
489+
else()
492490

493-
# _FORTIFY_SOURCE requires that there is some level of optimization,
494-
# otherwise it does nothing and just creates a compiler warning.
495-
try_append_cxx_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
496-
RESULT_VAR cxx_supports_fortify_source
497-
SOURCE "int main() {
498-
# if !defined __OPTIMIZE__ || __OPTIMIZE__ <= 0
499-
#error
500-
#endif
501-
}"
491+
# _FORTIFY_SOURCE requires that there is some level of optimization,
492+
# otherwise it does nothing and just creates a compiler warning.
493+
try_append_cxx_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
494+
RESULT_VAR cxx_supports_fortify_source
495+
SOURCE "int main() {
496+
# if !defined __OPTIMIZE__ || __OPTIMIZE__ <= 0
497+
#error
498+
#endif
499+
}"
500+
)
501+
if(cxx_supports_fortify_source)
502+
target_compile_options(hardening_interface INTERFACE
503+
-U_FORTIFY_SOURCE
504+
-D_FORTIFY_SOURCE=3
502505
)
503-
if(cxx_supports_fortify_source)
504-
target_compile_options(hardening_interface INTERFACE
505-
-U_FORTIFY_SOURCE
506-
-D_FORTIFY_SOURCE=3
507-
)
508-
endif()
509-
unset(cxx_supports_fortify_source)
510-
511-
try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface SKIP_LINK)
512-
try_append_cxx_flags("-fstack-protector-all" TARGET hardening_interface)
513-
try_append_cxx_flags("-fcf-protection=full" TARGET hardening_interface)
506+
endif()
507+
unset(cxx_supports_fortify_source)
514508

515-
if(MINGW)
516-
# stack-clash-protection is a no-op for Windows.
517-
# See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details.
518-
else()
519-
try_append_cxx_flags("-fstack-clash-protection" TARGET hardening_interface)
520-
endif()
509+
try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface SKIP_LINK)
510+
try_append_cxx_flags("-fstack-protector-all" TARGET hardening_interface)
511+
try_append_cxx_flags("-fcf-protection=full" TARGET hardening_interface)
521512

522-
if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
523-
if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
524-
try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK)
525-
else()
526-
try_append_cxx_flags("-mbranch-protection=standard" TARGET hardening_interface SKIP_LINK)
527-
endif()
528-
endif()
513+
if(MINGW)
514+
# stack-clash-protection is a no-op for Windows.
515+
# See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details.
516+
else()
517+
try_append_cxx_flags("-fstack-clash-protection" TARGET hardening_interface)
518+
endif()
529519

530-
try_append_linker_flag("-Wl,--enable-reloc-section" TARGET hardening_interface)
531-
try_append_linker_flag("-Wl,--dynamicbase" TARGET hardening_interface)
532-
try_append_linker_flag("-Wl,--nxcompat" TARGET hardening_interface)
533-
try_append_linker_flag("-Wl,--high-entropy-va" TARGET hardening_interface)
534-
try_append_linker_flag("-Wl,-z,relro" TARGET hardening_interface)
535-
try_append_linker_flag("-Wl,-z,now" TARGET hardening_interface)
536-
# TODO: This can be dropped once Bitcoin Core no longer supports
537-
# NetBSD 10.0 or if upstream fix is backported.
538-
# NetBSD's dynamic linker ld.elf_so < 11.0 supports exactly 2
539-
# `PT_LOAD` segments and binaries linked with `-z separate-code`
540-
# have 4 `PT_LOAD` segments.
541-
# Relevant discussions:
542-
# - https://github.com/bitcoin/bitcoin/pull/28724#issuecomment-2589347934
543-
# - https://mail-index.netbsd.org/tech-userlevel/2023/01/05/msg013666.html
544-
if(CMAKE_SYSTEM_NAME STREQUAL "NetBSD" AND CMAKE_SYSTEM_VERSION VERSION_LESS 11.0)
545-
try_append_linker_flag("-Wl,-z,noseparate-code" TARGET hardening_interface)
546-
else()
547-
try_append_linker_flag("-Wl,-z,separate-code" TARGET hardening_interface)
548-
endif()
520+
if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
549521
if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
550-
try_append_linker_flag("-Wl,-fixup_chains" TARGET hardening_interface)
522+
try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK)
523+
else()
524+
try_append_cxx_flags("-mbranch-protection=standard" TARGET hardening_interface SKIP_LINK)
551525
endif()
552526
endif()
527+
528+
try_append_linker_flag("-Wl,--enable-reloc-section" TARGET hardening_interface)
529+
try_append_linker_flag("-Wl,--dynamicbase" TARGET hardening_interface)
530+
try_append_linker_flag("-Wl,--nxcompat" TARGET hardening_interface)
531+
try_append_linker_flag("-Wl,--high-entropy-va" TARGET hardening_interface)
532+
try_append_linker_flag("-Wl,-z,relro" TARGET hardening_interface)
533+
try_append_linker_flag("-Wl,-z,now" TARGET hardening_interface)
534+
# TODO: This can be dropped once Bitcoin Core no longer supports
535+
# NetBSD 10.0 or if upstream fix is backported.
536+
# NetBSD's dynamic linker ld.elf_so < 11.0 supports exactly 2
537+
# `PT_LOAD` segments and binaries linked with `-z separate-code`
538+
# have 4 `PT_LOAD` segments.
539+
# Relevant discussions:
540+
# - https://github.com/bitcoin/bitcoin/pull/28724#issuecomment-2589347934
541+
# - https://mail-index.netbsd.org/tech-userlevel/2023/01/05/msg013666.html
542+
if(CMAKE_SYSTEM_NAME STREQUAL "NetBSD" AND CMAKE_SYSTEM_VERSION VERSION_LESS 11.0)
543+
try_append_linker_flag("-Wl,-z,noseparate-code" TARGET hardening_interface)
544+
else()
545+
try_append_linker_flag("-Wl,-z,separate-code" TARGET hardening_interface)
546+
endif()
547+
if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
548+
try_append_linker_flag("-Wl,-fixup_chains" TARGET hardening_interface)
549+
endif()
553550
endif()
554551

555552
if(REDUCE_EXPORTS)
@@ -684,7 +681,6 @@ message("Cross compiling ....................... ${cross_status}")
684681
message("C++ compiler .......................... ${CMAKE_CXX_COMPILER_ID} ${CMAKE_CXX_COMPILER_VERSION}, ${CMAKE_CXX_COMPILER}")
685682
include(FlagsSummary)
686683
flags_summary()
687-
message("Attempt to harden executables ......... ${ENABLE_HARDENING}")
688684
message("Treat compiler warnings as errors ..... ${WERROR}")
689685
message("Use ccache for compiling .............. ${WITH_CCACHE}")
690686
message("\n")

‎CMakePresets.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@
7777
"BUILD_UTIL_CHAINSTATE": "ON",
7878
"BUILD_WALLET_TOOL": "ON",
7979
"ENABLE_EXTERNAL_SIGNER": "ON",
80-
"ENABLE_HARDENING": "ON",
8180
"ENABLE_WALLET": "ON",
8281
"WARN_INCOMPATIBLE_BDB": "OFF",
8382
"WITH_BDB": "ON",

0 commit comments

Comments
 (0)