Skip to content

Commit b3fdd7d

Browse files
millertmillert
committed
configure: compile with _FORTIFY_SOURCE=3 where possible
This enables enhanced buffer size detection. For details see: https://developers.redhat.com/articles/2022/09/17/gccs-new-fortification-level Some systems will warn about using a value > 2 so we try to detect that and fall back to _FORTIFY_SOURCE=2.
1 parent 21dcc3f commit b3fdd7d

File tree

2 files changed

+247
-23
lines changed

2 files changed

+247
-23
lines changed

‎configure‎

Lines changed: 218 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -34810,8 +34810,140 @@ fi
3481034810
#
3481134811
# Attempt to use _FORTIFY_SOURCE with sprintf. If the headers support
3481234812
# it but libc does not, __sprintf_chk should be an undefined symbol.
34813+
# Some systems warn about using a value of _FORTIFY_SOURCE > 2.
3481334814
#
3481434815
O_CPPFLAGS="$CPPFLAGS"
34816+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking supported _FORTIFY_SOURCE level" >&5
34817+
printf %s "checking supported _FORTIFY_SOURCE level... " >&6; }
34818+
if test ${sudo_cv_fortify_source_level+y}
34819+
then :
34820+
printf %s "(cached) " >&6
34821+
else case e in #(
34822+
e)
34823+
34824+
if test ${CPPFLAGS+y}
34825+
then :
34826+
34827+
case " $CPPFLAGS " in #(
34828+
*" -U_FORTIFY_SOURCE "*) :
34829+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS already contains -U_FORTIFY_SOURCE"; } >&5
34830+
(: CPPFLAGS already contains -U_FORTIFY_SOURCE) 2>&5
34831+
ac_status=$?
34832+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34833+
test $ac_status = 0; } ;; #(
34834+
*) :
34835+
34836+
as_fn_append CPPFLAGS " -U_FORTIFY_SOURCE"
34837+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34838+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34839+
ac_status=$?
34840+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34841+
test $ac_status = 0; }
34842+
;;
34843+
esac
34844+
34845+
else case e in #(
34846+
e)
34847+
CPPFLAGS=-U_FORTIFY_SOURCE
34848+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34849+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34850+
ac_status=$?
34851+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34852+
test $ac_status = 0; }
34853+
;;
34854+
esac
34855+
fi
34856+
34857+
34858+
if test ${CPPFLAGS+y}
34859+
then :
34860+
34861+
case " $CPPFLAGS " in #(
34862+
*" -D_FORTIFY_SOURCE=3 "*) :
34863+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS already contains -D_FORTIFY_SOURCE=3"; } >&5
34864+
(: CPPFLAGS already contains -D_FORTIFY_SOURCE=3) 2>&5
34865+
ac_status=$?
34866+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34867+
test $ac_status = 0; } ;; #(
34868+
*) :
34869+
34870+
as_fn_append CPPFLAGS " -D_FORTIFY_SOURCE=3"
34871+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34872+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34873+
ac_status=$?
34874+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34875+
test $ac_status = 0; }
34876+
;;
34877+
esac
34878+
34879+
else case e in #(
34880+
e)
34881+
CPPFLAGS=-D_FORTIFY_SOURCE=3
34882+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34883+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34884+
ac_status=$?
34885+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34886+
test $ac_status = 0; }
34887+
;;
34888+
esac
34889+
fi
34890+
34891+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
34892+
/* end confdefs.h. */
34893+
34894+
#include <stdio.h>
34895+
int
34896+
main (void)
34897+
{
34898+
char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];
34899+
34900+
;
34901+
return 0;
34902+
}
34903+
_ACEOF
34904+
if ac_fn_c_try_link "$LINENO"
34905+
then :
34906+
34907+
sudo_cv_fortify_source_level=3
34908+
34909+
else case e in #(
34910+
e)
34911+
# Try again with -D_FORTIFY_SOURCE=2
34912+
CPPFLAGS="$O_CPPFLAGS"
34913+
34914+
if test ${CPPFLAGS+y}
34915+
then :
34916+
34917+
case " $CPPFLAGS " in #(
34918+
*" -U_FORTIFY_SOURCE "*) :
34919+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS already contains -U_FORTIFY_SOURCE"; } >&5
34920+
(: CPPFLAGS already contains -U_FORTIFY_SOURCE) 2>&5
34921+
ac_status=$?
34922+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34923+
test $ac_status = 0; } ;; #(
34924+
*) :
34925+
34926+
as_fn_append CPPFLAGS " -U_FORTIFY_SOURCE"
34927+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34928+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34929+
ac_status=$?
34930+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34931+
test $ac_status = 0; }
34932+
;;
34933+
esac
34934+
34935+
else case e in #(
34936+
e)
34937+
CPPFLAGS=-U_FORTIFY_SOURCE
34938+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
34939+
(: CPPFLAGS="$CPPFLAGS") 2>&5
34940+
ac_status=$?
34941+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
34942+
test $ac_status = 0; }
34943+
;;
34944+
esac
34945+
fi
34946+
3481534947

3481634948
if test ${CPPFLAGS+y}
3481734949
then :
@@ -34846,16 +34978,10 @@ else case e in #(
3484634978
esac
3484734979
fi
3484834980

34849-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether _FORTIFY_SOURCE may be specified" >&5
34850-
printf %s "checking whether _FORTIFY_SOURCE may be specified... " >&6; }
34851-
if test ${sudo_cv_use_fortify_source+y}
34852-
then :
34853-
printf %s "(cached) " >&6
34854-
else case e in #(
34855-
e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
34981+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
3485634982
/* end confdefs.h. */
3485734983

34858-
#include <stdio.h>
34984+
#include <stdio.h>
3485934985
int
3486034986
main (void)
3486134987
{
@@ -34867,9 +34993,19 @@ char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];
3486734993
_ACEOF
3486834994
if ac_fn_c_try_link "$LINENO"
3486934995
then :
34870-
sudo_cv_use_fortify_source=yes
34996+
34997+
sudo_cv_fortify_source_level=2
34998+
3487134999
else case e in #(
34872-
e) sudo_cv_use_fortify_source=no
35000+
e)
35001+
sudo_cv_fortify_source_level=none
35002+
35003+
;;
35004+
esac
35005+
fi
35006+
rm -f core conftest.err conftest.$ac_objext conftest.beam \
35007+
conftest$ac_exeext conftest.$ac_ext
35008+
3487335009
;;
3487435010
esac
3487535011
fi
@@ -34879,10 +35015,78 @@ rm -f core conftest.err conftest.$ac_objext conftest.beam \
3487935015
;;
3488035016
esac
3488135017
fi
34882-
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $sudo_cv_use_fortify_source" >&5
34883-
printf "%s\n" "$sudo_cv_use_fortify_source" >&6; }
34884-
if test "$sudo_cv_use_fortify_source" != yes; then
34885-
CPPFLAGS="$O_CPPFLAGS"
35018+
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $sudo_cv_fortify_source_level" >&5
35019+
printf "%s\n" "$sudo_cv_fortify_source_level" >&6; }
35020+
CPPFLAGS="$O_CPPFLAGS"
35021+
if test "$sudo_cv_fortify_source_level" != none; then
35022+
35023+
if test ${CPPFLAGS+y}
35024+
then :
35025+
35026+
case " $CPPFLAGS " in #(
35027+
*" -U_FORTIFY_SOURCE "*) :
35028+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS already contains -U_FORTIFY_SOURCE"; } >&5
35029+
(: CPPFLAGS already contains -U_FORTIFY_SOURCE) 2>&5
35030+
ac_status=$?
35031+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35032+
test $ac_status = 0; } ;; #(
35033+
*) :
35034+
35035+
as_fn_append CPPFLAGS " -U_FORTIFY_SOURCE"
35036+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
35037+
(: CPPFLAGS="$CPPFLAGS") 2>&5
35038+
ac_status=$?
35039+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35040+
test $ac_status = 0; }
35041+
;;
35042+
esac
35043+
35044+
else case e in #(
35045+
e)
35046+
CPPFLAGS=-U_FORTIFY_SOURCE
35047+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
35048+
(: CPPFLAGS="$CPPFLAGS") 2>&5
35049+
ac_status=$?
35050+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35051+
test $ac_status = 0; }
35052+
;;
35053+
esac
35054+
fi
35055+
35056+
35057+
if test ${CPPFLAGS+y}
35058+
then :
35059+
35060+
case " $CPPFLAGS " in #(
35061+
*" -D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level "*) :
35062+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS already contains -D_FORTIFY_SOURCE=\$sudo_cv_fortify_source_level"; } >&5
35063+
(: CPPFLAGS already contains -D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level) 2>&5
35064+
ac_status=$?
35065+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35066+
test $ac_status = 0; } ;; #(
35067+
*) :
35068+
35069+
as_fn_append CPPFLAGS " -D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level"
35070+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
35071+
(: CPPFLAGS="$CPPFLAGS") 2>&5
35072+
ac_status=$?
35073+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35074+
test $ac_status = 0; }
35075+
;;
35076+
esac
35077+
35078+
else case e in #(
35079+
e)
35080+
CPPFLAGS=-D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level
35081+
{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CPPFLAGS=\"\$CPPFLAGS\""; } >&5
35082+
(: CPPFLAGS="$CPPFLAGS") 2>&5
35083+
ac_status=$?
35084+
printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
35085+
test $ac_status = 0; }
35086+
;;
35087+
esac
35088+
fi
35089+
3488635090
fi
3488735091

3488835092
if test -n "$GCC" -a "$enable_ssp" != "no"; then

‎m4/hardening.m4‎

Lines changed: 29 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,43 @@ AC_DEFUN([SUDO_CHECK_HARDENING], [
66
#
77
# Attempt to use _FORTIFY_SOURCE with sprintf. If the headers support
88
# it but libc does not, __sprintf_chk should be an undefined symbol.
9+
# Some systems warn about using a value of _FORTIFY_SOURCE > 2.
910
#
1011
O_CPPFLAGS="$CPPFLAGS"
11-
AX_APPEND_FLAG([-D_FORTIFY_SOURCE=2], [CPPFLAGS])
12-
AC_CACHE_CHECK([whether _FORTIFY_SOURCE may be specified],
13-
[sudo_cv_use_fortify_source],
14-
[AC_LINK_IFELSE([
12+
AC_CACHE_CHECK([supported _FORTIFY_SOURCE level],
13+
[sudo_cv_fortify_source_level],
14+
[
15+
AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
16+
AX_APPEND_FLAG([-D_FORTIFY_SOURCE=3], [CPPFLAGS])
17+
AC_LINK_IFELSE([
1518
AC_LANG_PROGRAM(
1619
[[#include <stdio.h>]],
1720
[[char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];]]
18-
)],
19-
[sudo_cv_use_fortify_source=yes],
20-
[sudo_cv_use_fortify_source=no]
21+
)], [
22+
sudo_cv_fortify_source_level=3
23+
], [
24+
# Try again with -D_FORTIFY_SOURCE=2
25+
CPPFLAGS="$O_CPPFLAGS"
26+
AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
27+
AX_APPEND_FLAG([-D_FORTIFY_SOURCE=2], [CPPFLAGS])
28+
AC_LINK_IFELSE([
29+
AC_LANG_PROGRAM(
30+
[[#include <stdio.h>]],
31+
[[char buf[4]; sprintf(buf, "%s", "foo"); return buf[0];]]
32+
)], [
33+
sudo_cv_fortify_source_level=2
34+
], [
35+
sudo_cv_fortify_source_level=none
36+
]
37+
)
38+
]
2139
)
2240
]
2341
)
24-
if test "$sudo_cv_use_fortify_source" != yes; then
25-
CPPFLAGS="$O_CPPFLAGS"
42+
CPPFLAGS="$O_CPPFLAGS"
43+
if test "$sudo_cv_fortify_source_level" != none; then
44+
AX_APPEND_FLAG([-U_FORTIFY_SOURCE], [CPPFLAGS])
45+
AX_APPEND_FLAG([-D_FORTIFY_SOURCE=$sudo_cv_fortify_source_level], [CPPFLAGS])
2646
fi
2747
2848
dnl

0 commit comments

Comments
 (0)