Skip to content

Commit 678348d

Browse files
dongcarlfanquake
dongcarl
authored and
fanquake
committed
guix: Patch binutils to add security-related disable flags
We use these flags in our test-security-check make target, but they are only available because debian patches them in. We can patch them in for our Guix builds so that we can check the sanity of our security/symbol checking suite before running them.
1 parent 9fdc8af commit 678348d

File tree

2 files changed

+176
-1
lines changed

2 files changed

+176
-1
lines changed

‎contrib/guix/manifest.scm

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@ http://www.linuxfromscratch.org/hlfs/view/development/chapter05/gcc-pass1.html"
8080
(("-rpath=") "-rpath-link="))
8181
#t))))))))
8282

83+
(define (make-binutils-with-mingw-w64-disable-flags xbinutils)
84+
(package-with-extra-patches xbinutils
85+
(search-our-patches "binutils-mingw-w64-disable-flags.patch")))
86+
8387
(define (make-cross-toolchain target
8488
base-gcc-for-libc
8589
base-kernel-headers
@@ -168,7 +172,7 @@ desirable for building Bitcoin Core release binaries."
168172

169173
(define (make-mingw-pthreads-cross-toolchain target)
170174
"Create a cross-compilation toolchain package for TARGET"
171-
(let* ((xbinutils (cross-binutils target))
175+
(let* ((xbinutils (make-binutils-with-mingw-w64-disable-flags (cross-binutils target)))
172176
(pthreads-xlibc mingw-w64-x86_64-winpthreads)
173177
(pthreads-xgcc (make-gcc-with-pthreads
174178
(cross-gcc target

‎contrib/guix/patches/binutils-mingw-w64-disable-flags.patch

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
Description: Add disable opposites to the security-related flags
2+
Author: Stephen Kitt <[email protected]>
3+
4+
This patch adds "no-" variants to disable the various security flags:
5+
"no-dynamicbase", "no-nxcompat", "no-high-entropy-va", "disable-reloc-section".
6+
7+
--- a/ld/emultempl/pe.em
8+
+++ b/ld/emultempl/pe.em
9+
@@ -259,9 +261,11 @@
10+
(OPTION_ENABLE_LONG_SECTION_NAMES + 1)
11+
/* DLLCharacteristics flags. */
12+
#define OPTION_DYNAMIC_BASE (OPTION_DISABLE_LONG_SECTION_NAMES + 1)
13+
-#define OPTION_FORCE_INTEGRITY (OPTION_DYNAMIC_BASE + 1)
14+
+#define OPTION_NO_DYNAMIC_BASE (OPTION_DYNAMIC_BASE + 1)
15+
+#define OPTION_FORCE_INTEGRITY (OPTION_NO_DYNAMIC_BASE + 1)
16+
#define OPTION_NX_COMPAT (OPTION_FORCE_INTEGRITY + 1)
17+
-#define OPTION_NO_ISOLATION (OPTION_NX_COMPAT + 1)
18+
+#define OPTION_NO_NX_COMPAT (OPTION_NX_COMPAT + 1)
19+
+#define OPTION_NO_ISOLATION (OPTION_NO_NX_COMPAT + 1)
20+
#define OPTION_NO_SEH (OPTION_NO_ISOLATION + 1)
21+
#define OPTION_NO_BIND (OPTION_NO_SEH + 1)
22+
#define OPTION_WDM_DRIVER (OPTION_NO_BIND + 1)
23+
@@ -271,6 +275,7 @@
24+
#define OPTION_NO_INSERT_TIMESTAMP (OPTION_INSERT_TIMESTAMP + 1)
25+
#define OPTION_BUILD_ID (OPTION_NO_INSERT_TIMESTAMP + 1)
26+
#define OPTION_ENABLE_RELOC_SECTION (OPTION_BUILD_ID + 1)
27+
+#define OPTION_DISABLE_RELOC_SECTION (OPTION_ENABLE_RELOC_SECTION + 1)
28+
29+
static void
30+
gld${EMULATION_NAME}_add_options
31+
@@ -342,8 +347,10 @@
32+
{"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
33+
{"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
34+
{"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
35+
+ {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
36+
{"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
37+
{"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
38+
+ {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
39+
{"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
40+
{"no-seh", no_argument, NULL, OPTION_NO_SEH},
41+
{"no-bind", no_argument, NULL, OPTION_NO_BIND},
42+
@@ -351,6 +358,7 @@
43+
{"tsaware", no_argument, NULL, OPTION_TERMINAL_SERVER_AWARE},
44+
{"build-id", optional_argument, NULL, OPTION_BUILD_ID},
45+
{"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION},
46+
+ {"disable-reloc-section", no_argument, NULL, OPTION_DISABLE_RELOC_SECTION},
47+
{NULL, no_argument, NULL, 0}
48+
};
49+
50+
@@ -485,9 +494,12 @@
51+
in object files\n"));
52+
fprintf (file, _(" --dynamicbase Image base address may be relocated using\n\
53+
address space layout randomization (ASLR)\n"));
54+
+ fprintf (file, _(" --no-dynamicbase Image base address may not be relocated\n"));
55+
fprintf (file, _(" --enable-reloc-section Create the base relocation table\n"));
56+
+ fprintf (file, _(" --disable-reloc-section Disable the base relocation table\n"));
57+
fprintf (file, _(" --forceinteg Code integrity checks are enforced\n"));
58+
fprintf (file, _(" --nxcompat Image is compatible with data execution prevention\n"));
59+
+ fprintf (file, _(" --no-nxcompat Image is not compatible with data execution prevention\n"));
60+
fprintf (file, _(" --no-isolation Image understands isolation but do not isolate the image\n"));
61+
fprintf (file, _(" --no-seh Image does not use SEH. No SE handler may\n\
62+
be called in this image\n"));
63+
@@ -862,12 +874,21 @@
64+
case OPTION_ENABLE_RELOC_SECTION:
65+
pe_dll_enable_reloc_section = 1;
66+
break;
67+
+ case OPTION_DISABLE_RELOC_SECTION:
68+
+ pe_dll_enable_reloc_section = 0;
69+
+ /* fall through */
70+
+ case OPTION_NO_DYNAMIC_BASE:
71+
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
72+
+ break;
73+
case OPTION_FORCE_INTEGRITY:
74+
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
75+
break;
76+
case OPTION_NX_COMPAT:
77+
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
78+
break;
79+
+ case OPTION_NO_NX_COMPAT:
80+
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
81+
+ break;
82+
case OPTION_NO_ISOLATION:
83+
pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
84+
break;
85+
--- a/ld/emultempl/pep.em
86+
+++ b/ld/emultempl/pep.em
87+
@@ -237,9 +240,12 @@
88+
OPTION_ENABLE_LONG_SECTION_NAMES,
89+
OPTION_DISABLE_LONG_SECTION_NAMES,
90+
OPTION_HIGH_ENTROPY_VA,
91+
+ OPTION_NO_HIGH_ENTROPY_VA,
92+
OPTION_DYNAMIC_BASE,
93+
+ OPTION_NO_DYNAMIC_BASE,
94+
OPTION_FORCE_INTEGRITY,
95+
OPTION_NX_COMPAT,
96+
+ OPTION_NO_NX_COMPAT,
97+
OPTION_NO_ISOLATION,
98+
OPTION_NO_SEH,
99+
OPTION_NO_BIND,
100+
@@ -248,7 +254,8 @@
101+
OPTION_NO_INSERT_TIMESTAMP,
102+
OPTION_TERMINAL_SERVER_AWARE,
103+
OPTION_BUILD_ID,
104+
- OPTION_ENABLE_RELOC_SECTION
105+
+ OPTION_ENABLE_RELOC_SECTION,
106+
+ OPTION_DISABLE_RELOC_SECTION
107+
};
108+
109+
static void
110+
@@ -315,9 +322,12 @@
111+
{"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
112+
{"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
113+
{"high-entropy-va", no_argument, NULL, OPTION_HIGH_ENTROPY_VA},
114+
+ {"no-high-entropy-va", no_argument, NULL, OPTION_NO_HIGH_ENTROPY_VA},
115+
{"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
116+
+ {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
117+
{"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
118+
{"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
119+
+ {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
120+
{"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
121+
{"no-seh", no_argument, NULL, OPTION_NO_SEH},
122+
{"no-bind", no_argument, NULL, OPTION_NO_BIND},
123+
@@ -327,6 +337,7 @@
124+
{"no-insert-timestamp", no_argument, NULL, OPTION_NO_INSERT_TIMESTAMP},
125+
{"build-id", optional_argument, NULL, OPTION_BUILD_ID},
126+
{"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION},
127+
+ {"disable-reloc-section", no_argument, NULL, OPTION_DISABLE_RELOC_SECTION},
128+
{NULL, no_argument, NULL, 0}
129+
};
130+
131+
@@ -448,11 +461,15 @@
132+
in object files\n"));
133+
fprintf (file, _(" --high-entropy-va Image is compatible with 64-bit address space\n\
134+
layout randomization (ASLR)\n"));
135+
+ fprintf (file, _(" --no-high-entropy-va Image is not compatible with 64-bit ASLR\n"));
136+
fprintf (file, _(" --dynamicbase Image base address may be relocated using\n\
137+
address space layout randomization (ASLR)\n"));
138+
+ fprintf (file, _(" --no-dynamicbase Image base address may not be relocated\n"));
139+
fprintf (file, _(" --enable-reloc-section Create the base relocation table\n"));
140+
+ fprintf (file, _(" --disable-reloc-section Disable the base relocation table\n"));
141+
fprintf (file, _(" --forceinteg Code integrity checks are enforced\n"));
142+
fprintf (file, _(" --nxcompat Image is compatible with data execution prevention\n"));
143+
+ fprintf (file, _(" --no-nxcompat Image is not compatible with data execution prevention\n"));
144+
fprintf (file, _(" --no-isolation Image understands isolation but do not isolate the image\n"));
145+
fprintf (file, _(" --no-seh Image does not use SEH; no SE handler may\n\
146+
be called in this image\n"));
147+
@@ -809,12 +826,24 @@
148+
case OPTION_ENABLE_RELOC_SECTION:
149+
pep_dll_enable_reloc_section = 1;
150+
break;
151+
+ case OPTION_DISABLE_RELOC_SECTION:
152+
+ pep_dll_enable_reloc_section = 0;
153+
+ /* fall through */
154+
+ case OPTION_NO_DYNAMIC_BASE:
155+
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
156+
+ /* fall through */
157+
+ case OPTION_NO_HIGH_ENTROPY_VA:
158+
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA;
159+
+ break;
160+
case OPTION_FORCE_INTEGRITY:
161+
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
162+
break;
163+
case OPTION_NX_COMPAT:
164+
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
165+
break;
166+
+ case OPTION_NO_NX_COMPAT:
167+
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
168+
+ break;
169+
case OPTION_NO_ISOLATION:
170+
pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
171+
break;

0 commit comments

Comments
 (0)