Skip to content

Commit a8bd0fe

Browse files
fanquakefanquake
committed
Merge bitcoin/bitcoin#27999: contrib: add macOS test for fixup_chains usage
7f96638 contrib: add macOS fixup_chains check to security-check (fanquake) 3dca683 build: support -no_fixup_chains in ld64 (fanquake) Pull request description: Followup to #27676, adding the check for chained fixups. Somewhat annoyingly, we have to patch support for `-no_fixup_chains` into ld64. As it doesn't seem to have been added [until a later version](https://github.com/apple-oss-distributions/ld64/blob/59a99ab60399c5e6c49e6945a9e1049c42b71135/src/ld/Options.cpp#L4172). Guix Build: ```bash 0e17d462808f86aa7157e27a957da88fd1adeb491ad6c01138aca93e5ad1d018 guix-build-7f96638723a0/output/arm64-apple-darwin/SHA256SUMS.part ceb208e6374f5d7367b73128e90ca6eaeea15d50c69e49c8cf75b47212525ad7 guix-build-7f96638723a0/output/arm64-apple-darwin/bitcoin-7f96638723a0-arm64-apple-darwin-unsigned.dmg e31663554cfde8a37a9f3438c9c895dde94b90ff87e28f12f78be71ef6421d93 guix-build-7f96638723a0/output/arm64-apple-darwin/bitcoin-7f96638723a0-arm64-apple-darwin-unsigned.tar.gz 68a7bbc42418641eab391a85725b5c2f3c46d38a7acc07e7a8cef98909be07ec guix-build-7f96638723a0/output/arm64-apple-darwin/bitcoin-7f96638723a0-arm64-apple-darwin.tar.gz 38d966ad93e7384f4f1ce16faded003a675ecce7be1987e6c4eee8e4b82c0432 guix-build-7f96638723a0/output/dist-archive/bitcoin-7f96638723a0.tar.gz 9d314f595d897a715a321a9fba0d552220fbd4bf69aff84eb8c0001cdb48234f guix-build-7f96638723a0/output/x86_64-apple-darwin/SHA256SUMS.part c218ebfd0e96348c4912e6d522492b621bb043ef45b75105ff1fde979d1004d0 guix-build-7f96638723a0/output/x86_64-apple-darwin/bitcoin-7f96638723a0-x86_64-apple-darwin-unsigned.dmg 1c5ff7fa82f5c76d7d8b9582ad5202f4a82a917102ecafdc3c1fb7b783f6bc3e guix-build-7f96638723a0/output/x86_64-apple-darwin/bitcoin-7f96638723a0-x86_64-apple-darwin-unsigned.tar.gz 15fb01e5afcc842db6a3e793b42c70c05ce07bec79e0d2d605e241901ff9f639 guix-build-7f96638723a0/output/x86_64-apple-darwin/bitcoin-7f96638723a0-x86_64-apple-darwin.tar.gz ``` ACKs for top commit: theuni: utACK 7f96638. hebasto: ACK 7f96638, I have reviewed the code and the patch, and they look OK. TheCharlatan: ACK 7f96638 Tree-SHA512: 7f94710460f54b2afe3c9f5d57107b71436c59b799b15f78e5e3011c3c4f6b23a3acc1008eccea9c22226a200774c82900bad6c6236ab6c5c48a17dec3f2d5a2
2 parents 3367e1c + 7f96638 commit a8bd0fe

File tree

4 files changed

+49
-12
lines changed

4 files changed

+49
-12
lines changed

‎contrib/devtools/security-check.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,12 @@ def check_MACHO_NOUNDEFS(binary) -> bool:
158158
'''
159159
return binary.header.has(lief.MachO.HEADER_FLAGS.NOUNDEFS)
160160

161+
def check_MACHO_FIXUP_CHAINS(binary) -> bool:
162+
'''
163+
Check for use of chained fixups.
164+
'''
165+
return binary.has_dyld_chained_fixups
166+
161167
def check_MACHO_Canary(binary) -> bool:
162168
'''
163169
Check for use of stack canary
@@ -208,6 +214,7 @@ def check_MACHO_control_flow(binary) -> bool:
208214
BASE_MACHO = [
209215
('NOUNDEFS', check_MACHO_NOUNDEFS),
210216
('Canary', check_MACHO_Canary),
217+
('FIXUP_CHAINS', check_MACHO_FIXUP_CHAINS),
211218
]
212219

213220
CHECKS = {

‎contrib/devtools/test-security-check.py

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -119,27 +119,31 @@ def test_MACHO(self):
119119
arch = get_arch(cc, source, executable)
120120

121121
if arch == lief.ARCHITECTURES.X86:
122-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector']),
122+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-no_fixup_chains']),
123+
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS PIE NX CONTROL_FLOW'))
124+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-fixup_chains']),
123125
(1, executable+': failed NOUNDEFS Canary PIE NX CONTROL_FLOW'))
124-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fstack-protector-all']),
126+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fstack-protector-all', '-Wl,-fixup_chains']),
125127
(1, executable+': failed NOUNDEFS PIE NX CONTROL_FLOW'))
126-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-fstack-protector-all']),
128+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains']),
127129
(1, executable+': failed NOUNDEFS PIE CONTROL_FLOW'))
128-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all']),
130+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all', '-Wl,-fixup_chains']),
129131
(1, executable+': failed PIE CONTROL_FLOW'))
130-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all']),
132+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-Wl,-fixup_chains']),
131133
(1, executable+': failed PIE CONTROL_FLOW'))
132-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full']),
134+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
133135
(1, executable+': failed PIE'))
134-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full']),
136+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
135137
(0, ''))
136138
else:
137139
# arm64 darwin doesn't support non-PIE binaries, control flow or executable stacks
138-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector']),
140+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-no_fixup_chains']),
141+
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS'))
142+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-fixup_chains']),
139143
(1, executable+': failed NOUNDEFS Canary'))
140-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fstack-protector-all']),
144+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains']),
141145
(1, executable+': failed NOUNDEFS'))
142-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-bind_at_load','-fstack-protector-all']),
146+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-bind_at_load','-fstack-protector-all', '-Wl,-fixup_chains']),
143147
(0, ''))
144148

145149

‎depends/packages/native_cctools.mk

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ $(package)_file_name=$($(package)_version).tar.gz
55
$(package)_sha256_hash=6b73269efdf5c58a070e7357b66ee760501388549d6a12b423723f45888b074b
66
$(package)_build_subdir=cctools
77
$(package)_dependencies=native_libtapi
8+
$(package)_patches=no_fixup_chains.patch
89

910
define $(package)_set_vars
1011
$(package)_config_opts=--target=$(host) --enable-lto-support
@@ -18,11 +19,13 @@ ifneq ($(strip $(FORCE_USE_SYSTEM_CLANG)),)
1819
define $(package)_preprocess_cmds
1920
mkdir -p $($(package)_staging_prefix_dir)/lib && \
2021
cp $(llvm_lib_dir)/libLTO.so $($(package)_staging_prefix_dir)/lib/ && \
21-
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools
22+
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools && \
23+
patch -p1 < $($(package)_patch_dir)/no_fixup_chains.patch
2224
endef
2325
else
2426
define $(package)_preprocess_cmds
25-
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools
27+
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools && \
28+
patch -p1 < $($(package)_patch_dir)/no_fixup_chains.patch
2629
endef
2730
endif
2831

‎depends/patches/native_cctools/no_fixup_chains.patch

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
commit 5860b35ff6c7241d1c35a1b3197b45e5c9ff86cf
2+
Author: fanquake <[email protected]>
3+
Date: Thu Jun 29 11:52:43 2023 +0100
4+
5+
ld64: add support for -no_fixup_chains
6+
7+
This is added in later versions, and is required if we want to be able
8+
to disable fixup_chains, for use in security tests.
9+
10+
diff --git a/cctools/ld64/src/ld/Options.cpp b/cctools/ld64/src/ld/Options.cpp
11+
index 15e8e88..b6580af 100644
12+
--- a/cctools/ld64/src/ld/Options.cpp
13+
+++ b/cctools/ld64/src/ld/Options.cpp
14+
@@ -4128,6 +4128,9 @@ void Options::parse(int argc, const char* argv[])
15+
else if ( strcmp(arg, "-fixup_chains") == 0 ) {
16+
fMakeChainedFixups = true;
17+
}
18+
+ else if ( strcmp(arg, "-no_fixup_chains") == 0 ) {
19+
+ fMakeChainedFixups = false;
20+
+ }
21+
else if (strcmp(arg, "-debug_variant") == 0) {
22+
fDebugVariant = true;
23+
}

0 commit comments

Comments
 (0)