Skip to content

Commit 5ea92e4

Browse files
millertmillert
committed
hardening.m4: check for -fcf-protection=return on 32-bit x86
We don't use -fcf-protection=full on 32-bit x86 because some older x86 clones don't support the ENDBR32 instructions it generates. However, we can use -fcf-protection=return to enable shadow stack support, which does not generate any additonal instructions.
1 parent 7640b85 commit 5ea92e4

File tree

2 files changed

+224
-48
lines changed

2 files changed

+224
-48
lines changed

‎configure‎

Lines changed: 204 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -35352,14 +35352,17 @@ fi
3535235352

3535335353
fi
3535435354

35355-
# Check for control-flow transfer instrumentation (Intel CET)
35356-
# on x86-64. Do not enable for 32-bit, since no 32-bit OS supports
35357-
# it and the generated ENDBR32 instructions have compatibility
35358-
# issues with some old i586/i686 processors (eg Geode or Vortex).
35359-
if test "$host_cpu" = "x86_64"; then
35360-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -fcf-protection" >&5
35361-
printf %s "checking whether the C compiler accepts -fcf-protection... " >&6; }
35362-
if test ${ax_cv_check_cflags___fcf_protection+y}
35355+
# Check for control-flow transfer instrumentation (Intel CET).
35356+
# Do not enable branch protection for 32-bit, since no 32-bit
35357+
# OS supports it and the generated ENDBR32 instructions have
35358+
# compatibility issues with some older i586/i686 compatible
35359+
# processors (e.g. Geode or Vortex).
35360+
case $host_cpu in #(
35361+
x86_64) :
35362+
35363+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -fcf-protection=full" >&5
35364+
printf %s "checking whether the C compiler accepts -fcf-protection=full... " >&6; }
35365+
if test ${ax_cv_check_cflags___fcf_protection_full+y}
3536335366
then :
3536435367
printf %s "(cached) " >&6
3536535368
else case e in #(
@@ -35368,7 +35371,7 @@ else case e in #(
3536835371
if test x"$GCC" = xyes ; then
3536935372
add_gnu_werror="-Werror"
3537035373
fi
35371-
CFLAGS="$CFLAGS -fcf-protection $add_gnu_werror"
35374+
CFLAGS="$CFLAGS -fcf-protection=full $add_gnu_werror"
3537235375
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
3537335376
/* end confdefs.h. */
3537435377

@@ -35382,29 +35385,29 @@ main (void)
3538235385
_ACEOF
3538335386
if ac_fn_c_try_compile "$LINENO"
3538435387
then :
35385-
ax_cv_check_cflags___fcf_protection=yes
35388+
ax_cv_check_cflags___fcf_protection_full=yes
3538635389
else case e in #(
35387-
e) ax_cv_check_cflags___fcf_protection=no ;;
35390+
e) ax_cv_check_cflags___fcf_protection_full=no ;;
3538835391
esac
3538935392
fi
3539035393
rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
3539135394
CFLAGS=$ax_check_save_flags ;;
3539235395
esac
3539335396
fi
35394-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fcf_protection" >&5
35395-
printf "%s\n" "$ax_cv_check_cflags___fcf_protection" >&6; }
35396-
if test "x$ax_cv_check_cflags___fcf_protection" = xyes
35397+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fcf_protection_full" >&5
35398+
printf "%s\n" "$ax_cv_check_cflags___fcf_protection_full" >&6; }
35399+
if test "x$ax_cv_check_cflags___fcf_protection_full" = xyes
3539735400
then :
3539835401

35399-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fcf-protection" >&5
35400-
printf %s "checking whether the linker accepts -fcf-protection... " >&6; }
35401-
if test ${ax_cv_check_ldflags___fcf_protection+y}
35402+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fcf-protection=full" >&5
35403+
printf %s "checking whether the linker accepts -fcf-protection=full... " >&6; }
35404+
if test ${ax_cv_check_ldflags___fcf_protection_full+y}
3540235405
then :
3540335406
printf %s "(cached) " >&6
3540435407
else case e in #(
3540535408
e)
3540635409
ax_check_save_flags=$LDFLAGS
35407-
LDFLAGS="$LDFLAGS -fcf-protection"
35410+
LDFLAGS="$LDFLAGS -fcf-protection=full"
3540835411
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
3540935412
/* end confdefs.h. */
3541035413

@@ -35418,35 +35421,35 @@ main (void)
3541835421
_ACEOF
3541935422
if ac_fn_c_try_link "$LINENO"
3542035423
then :
35421-
ax_cv_check_ldflags___fcf_protection=yes
35424+
ax_cv_check_ldflags___fcf_protection_full=yes
3542235425
else case e in #(
35423-
e) ax_cv_check_ldflags___fcf_protection=no ;;
35426+
e) ax_cv_check_ldflags___fcf_protection_full=no ;;
3542435427
esac
3542535428
fi
3542635429
rm -f core conftest.err conftest.$ac_objext conftest.beam \
3542735430
conftest$ac_exeext conftest.$ac_ext
3542835431
LDFLAGS=$ax_check_save_flags ;;
3542935432
esac
3543035433
fi
35431-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fcf_protection" >&5
35432-
printf "%s\n" "$ax_cv_check_ldflags___fcf_protection" >&6; }
35433-
if test "x$ax_cv_check_ldflags___fcf_protection" = xyes
35434+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fcf_protection_full" >&5
35435+
printf "%s\n" "$ax_cv_check_ldflags___fcf_protection_full" >&6; }
35436+
if test "x$ax_cv_check_ldflags___fcf_protection_full" = xyes
3543435437
then :
3543535438

3543635439

3543735440
if test ${HARDENING_CFLAGS+y}
3543835441
then :
3543935442

3544035443
case " $HARDENING_CFLAGS " in #(
35441-
*" -fcf-protection "*) :
35442-
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS already contains -fcf-protection"; } >&5
35443-
(: HARDENING_CFLAGS already contains -fcf-protection) 2>&5
35444+
*" -fcf-protection=full "*) :
35445+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS already contains -fcf-protection=full"; } >&5
35446+
(: HARDENING_CFLAGS already contains -fcf-protection=full) 2>&5
3544435447
ac_status=$?
3544535448
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
3544635449
test $ac_status = 0; } ;; #(
3544735450
*) :
3544835451

35449-
as_fn_append HARDENING_CFLAGS " -fcf-protection"
35452+
as_fn_append HARDENING_CFLAGS " -fcf-protection=full"
3545035453
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS=\"\$HARDENING_CFLAGS\""; } >&5
3545135454
(: HARDENING_CFLAGS="$HARDENING_CFLAGS") 2>&5
3545235455
ac_status=$?
@@ -35457,7 +35460,7 @@ esac
3545735460

3545835461
else case e in #(
3545935462
e)
35460-
HARDENING_CFLAGS=-fcf-protection
35463+
HARDENING_CFLAGS=-fcf-protection=full
3546135464
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS=\"\$HARDENING_CFLAGS\""; } >&5
3546235465
(: HARDENING_CFLAGS="$HARDENING_CFLAGS") 2>&5
3546335466
ac_status=$?
@@ -35472,15 +35475,15 @@ if test ${HARDENING_LDFLAGS+y}
3547235475
then :
3547335476

3547435477
case " $HARDENING_LDFLAGS " in #(
35475-
*" -Wc,-fcf-protection "*) :
35476-
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS already contains -Wc,-fcf-protection"; } >&5
35477-
(: HARDENING_LDFLAGS already contains -Wc,-fcf-protection) 2>&5
35478+
*" -Wc,-fcf-protection=full "*) :
35479+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS already contains -Wc,-fcf-protection=full"; } >&5
35480+
(: HARDENING_LDFLAGS already contains -Wc,-fcf-protection=full) 2>&5
3547835481
ac_status=$?
3547935482
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
3548035483
test $ac_status = 0; } ;; #(
3548135484
*) :
3548235485

35483-
as_fn_append HARDENING_LDFLAGS " -Wc,-fcf-protection"
35486+
as_fn_append HARDENING_LDFLAGS " -Wc,-fcf-protection=full"
3548435487
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS=\"\$HARDENING_LDFLAGS\""; } >&5
3548535488
(: HARDENING_LDFLAGS="$HARDENING_LDFLAGS") 2>&5
3548635489
ac_status=$?
@@ -35491,7 +35494,7 @@ esac
3549135494

3549235495
else case e in #(
3549335496
e)
35494-
HARDENING_LDFLAGS=-Wc,-fcf-protection
35497+
HARDENING_LDFLAGS=-Wc,-fcf-protection=full
3549535498
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS=\"\$HARDENING_LDFLAGS\""; } >&5
3549635499
(: HARDENING_LDFLAGS="$HARDENING_LDFLAGS") 2>&5
3549735500
ac_status=$?
@@ -35513,13 +35516,177 @@ else case e in #(
3551335516
esac
3551435517
fi
3551535518

35516-
fi
35519+
;; #(
35520+
i*86) :
35521+
35522+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -fcf-protection=return" >&5
35523+
printf %s "checking whether the C compiler accepts -fcf-protection=return... " >&6; }
35524+
if test ${ax_cv_check_cflags___fcf_protection_return+y}
35525+
then :
35526+
printf %s "(cached) " >&6
35527+
else case e in #(
35528+
e)
35529+
ax_check_save_flags=$CFLAGS
35530+
if test x"$GCC" = xyes ; then
35531+
add_gnu_werror="-Werror"
35532+
fi
35533+
CFLAGS="$CFLAGS -fcf-protection=return $add_gnu_werror"
35534+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
35535+
/* end confdefs.h. */
35536+
35537+
int
35538+
main (void)
35539+
{
35540+
35541+
;
35542+
return 0;
35543+
}
35544+
_ACEOF
35545+
if ac_fn_c_try_compile "$LINENO"
35546+
then :
35547+
ax_cv_check_cflags___fcf_protection_return=yes
35548+
else case e in #(
35549+
e) ax_cv_check_cflags___fcf_protection_return=no ;;
35550+
esac
35551+
fi
35552+
rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
35553+
CFLAGS=$ax_check_save_flags ;;
35554+
esac
35555+
fi
35556+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fcf_protection_return" >&5
35557+
printf "%s\n" "$ax_cv_check_cflags___fcf_protection_return" >&6; }
35558+
if test "x$ax_cv_check_cflags___fcf_protection_return" = xyes
35559+
then :
35560+
35561+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fcf-protection=return" >&5
35562+
printf %s "checking whether the linker accepts -fcf-protection=return... " >&6; }
35563+
if test ${ax_cv_check_ldflags___fcf_protection_return+y}
35564+
then :
35565+
printf %s "(cached) " >&6
35566+
else case e in #(
35567+
e)
35568+
ax_check_save_flags=$LDFLAGS
35569+
LDFLAGS="$LDFLAGS -fcf-protection=return"
35570+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
35571+
/* end confdefs.h. */
35572+
35573+
int
35574+
main (void)
35575+
{
35576+
35577+
;
35578+
return 0;
35579+
}
35580+
_ACEOF
35581+
if ac_fn_c_try_link "$LINENO"
35582+
then :
35583+
ax_cv_check_ldflags___fcf_protection_return=yes
35584+
else case e in #(
35585+
e) ax_cv_check_ldflags___fcf_protection_return=no ;;
35586+
esac
35587+
fi
35588+
rm -f core conftest.err conftest.$ac_objext conftest.beam \
35589+
conftest$ac_exeext conftest.$ac_ext
35590+
LDFLAGS=$ax_check_save_flags ;;
35591+
esac
35592+
fi
35593+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fcf_protection_return" >&5
35594+
printf "%s\n" "$ax_cv_check_ldflags___fcf_protection_return" >&6; }
35595+
if test "x$ax_cv_check_ldflags___fcf_protection_return" = xyes
35596+
then :
35597+
35598+
35599+
if test ${HARDENING_CFLAGS+y}
35600+
then :
35601+
35602+
case " $HARDENING_CFLAGS " in #(
35603+
*" -fcf-protection=return "*) :
35604+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS already contains -fcf-protection=return"; } >&5
35605+
(: HARDENING_CFLAGS already contains -fcf-protection=return) 2>&5
35606+
ac_status=$?
35607+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35608+
test $ac_status = 0; } ;; #(
35609+
*) :
35610+
35611+
as_fn_append HARDENING_CFLAGS " -fcf-protection=return"
35612+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS=\"\$HARDENING_CFLAGS\""; } >&5
35613+
(: HARDENING_CFLAGS="$HARDENING_CFLAGS") 2>&5
35614+
ac_status=$?
35615+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35616+
test $ac_status = 0; }
35617+
;;
35618+
esac
35619+
35620+
else case e in #(
35621+
e)
35622+
HARDENING_CFLAGS=-fcf-protection=return
35623+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_CFLAGS=\"\$HARDENING_CFLAGS\""; } >&5
35624+
(: HARDENING_CFLAGS="$HARDENING_CFLAGS") 2>&5
35625+
ac_status=$?
35626+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35627+
test $ac_status = 0; }
35628+
;;
35629+
esac
35630+
fi
35631+
35632+
35633+
if test ${HARDENING_LDFLAGS+y}
35634+
then :
35635+
35636+
case " $HARDENING_LDFLAGS " in #(
35637+
*" -Wc,-fcf-protection=return "*) :
35638+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS already contains -Wc,-fcf-protection=return"; } >&5
35639+
(: HARDENING_LDFLAGS already contains -Wc,-fcf-protection=return) 2>&5
35640+
ac_status=$?
35641+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35642+
test $ac_status = 0; } ;; #(
35643+
*) :
35644+
35645+
as_fn_append HARDENING_LDFLAGS " -Wc,-fcf-protection=return"
35646+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS=\"\$HARDENING_LDFLAGS\""; } >&5
35647+
(: HARDENING_LDFLAGS="$HARDENING_LDFLAGS") 2>&5
35648+
ac_status=$?
35649+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35650+
test $ac_status = 0; }
35651+
;;
35652+
esac
35653+
35654+
else case e in #(
35655+
e)
35656+
HARDENING_LDFLAGS=-Wc,-fcf-protection=return
35657+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : HARDENING_LDFLAGS=\"\$HARDENING_LDFLAGS\""; } >&5
35658+
(: HARDENING_LDFLAGS="$HARDENING_LDFLAGS") 2>&5
35659+
ac_status=$?
35660+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35661+
test $ac_status = 0; }
35662+
;;
35663+
esac
35664+
fi
35665+
35666+
35667+
else case e in #(
35668+
e) : ;;
35669+
esac
35670+
fi
35671+
35672+
35673+
else case e in #(
35674+
e) : ;;
35675+
esac
35676+
fi
35677+
35678+
;; #(
35679+
*) :
35680+
;;
35681+
esac
3551735682

3551835683
#
3551935684
# Check for branch protection against ROP and JOP attacks on
3552035685
# AArch64 by using PAC and BTI.
3552135686
#
35522-
if test "$host_cpu" = "aarch64"; then
35687+
if test "$host_cpu" = "aarch64"
35688+
then :
35689+
3552335690
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -mbranch-protection=standard" >&5
3552435691
printf %s "checking whether the C compiler accepts -mbranch-protection=standard... " >&6; }
3552535692
if test ${ax_cv_check_cflags___mbranch_protection_standard+y}
@@ -35676,7 +35843,8 @@ else case e in #(
3567635843
esac
3567735844
fi
3567835845

35679-
fi
35846+
35847+
fi
3568035848

3568135849
# Force retention of null pointer checks.
3568235850
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -fno-delete-null-pointer-checks" >&5

‎m4/hardening.m4‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -123,31 +123,39 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
123123
])
124124
fi
125125
126-
# Check for control-flow transfer instrumentation (Intel CET)
127-
# on x86-64. Do not enable for 32-bit, since no 32-bit OS supports
128-
# it and the generated ENDBR32 instructions have compatibility
129-
# issues with some old i586/i686 processors (eg Geode or Vortex).
130-
if test "$host_cpu" = "x86_64"; then
131-
AX_CHECK_COMPILE_FLAG([-fcf-protection], [
132-
AX_CHECK_LINK_FLAG([-fcf-protection], [
133-
AX_APPEND_FLAG([-fcf-protection], [HARDENING_CFLAGS])
134-
AX_APPEND_FLAG([-Wc,-fcf-protection], [HARDENING_LDFLAGS])
126+
# Check for control-flow transfer instrumentation (Intel CET).
127+
# Do not enable branch protection for 32-bit, since no 32-bit
128+
# OS supports it and the generated ENDBR32 instructions have
129+
# compatibility issues with some older i586/i686 compatible
130+
# processors (e.g. Geode or Vortex).
131+
AS_CASE([$host_cpu], [x86_64], [
132+
AX_CHECK_COMPILE_FLAG([-fcf-protection=full], [
133+
AX_CHECK_LINK_FLAG([-fcf-protection=full], [
134+
AX_APPEND_FLAG([-fcf-protection=full], [HARDENING_CFLAGS])
135+
AX_APPEND_FLAG([-Wc,-fcf-protection=full], [HARDENING_LDFLAGS])
135136
])
136137
])
137-
fi
138+
], [i*86], [
139+
AX_CHECK_COMPILE_FLAG([-fcf-protection=return], [
140+
AX_CHECK_LINK_FLAG([-fcf-protection=return], [
141+
AX_APPEND_FLAG([-fcf-protection=return], [HARDENING_CFLAGS])
142+
AX_APPEND_FLAG([-Wc,-fcf-protection=return], [HARDENING_LDFLAGS])
143+
])
144+
])
145+
])
138146
139147
#
140148
# Check for branch protection against ROP and JOP attacks on
141149
# AArch64 by using PAC and BTI.
142150
#
143-
if test "$host_cpu" = "aarch64"; then
151+
AS_IF([test "$host_cpu" = "aarch64"], [
144152
AX_CHECK_COMPILE_FLAG([-mbranch-protection=standard], [
145153
AX_CHECK_LINK_FLAG([-mbranch-protection=standard], [
146154
AX_APPEND_FLAG([-mbranch-protection=standard], [HARDENING_CFLAGS])
147155
AX_APPEND_FLAG([-Wc,-mbranch-protection=standard], [HARDENING_LDFLAGS])
148156
])
149157
])
150-
fi
158+
])
151159
152160
# Force retention of null pointer checks.
153161
AX_CHECK_COMPILE_FLAG([-fno-delete-null-pointer-checks], [AX_APPEND_FLAG([-fno-delete-null-pointer-checks], [HARDENING_CFLAGS])])

0 commit comments

Comments
 (0)