FreeChainXenon/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

configure: Implement --enable-host-bind-now

Browse source 
As promised in the --enable-host-pie patch, this patch adds another
configure option, --enable-host-bind-now, which adds -z now when linking
the compiler executables in order to extend hardening.  BIND_NOW with RELRO
allows the GOT to be marked RO; this prevents GOT modification attacks.

This option does not affect linking of target libraries; you can use
LDFLAGS_FOR_TARGET=-Wl,-z,relro,-z,now to enable RELRO/BIND_NOW.

With this patch:
$ readelf -Wd cc1{,plus,obj,gm2} f951 lto1 cpp  rust1 gnat1 | grep FLAGS
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE

c++tools/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.
	* configure: Regenerate.

gcc/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Add
	-Wl,-z,now to LD_PICFLAG if --enable-host-bind-now.
	* configure: Regenerate.
	* doc/install.texi: Document --enable-host-bind-now.

lto-plugin/ChangeLog:

	* configure.ac (--enable-host-bind-now): New check.  Link with
	-z,now.
	* configure: Regenerate.
This commit is contained in:
Marek Polacek 2023-06-22 11:30:01 -04:00
parent 4ced836362
commit 33ebb0dff9
7 changed files with 83 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
c++tools/configure vendored
View file

@ -628,6 +628,7 @@ EGREP
GREP
CXXCPP
LD_PICFLAG
enable_host_bind_now
PICFLAG
MAINTAINER
CXX_AUX_TOOLS
@ -702,6 +703,7 @@ enable_maintainer_mode
enable_checking
enable_default_pie
enable_host_pie
enable_host_bind_now
with_gcc_major_version_only
'
ac_precious_vars='build_alias
@ -1336,6 +1338,7 @@ Optional Features:
yes,no,all,none,release.
--enable-default-pie enable Position Independent Executable as default
--enable-host-pie build host code as PIE
--enable-host-bind-now link host code as BIND_NOW
Optional Packages:
--with-PACKAGE[=ARG] use PACKAGE [ARG=yes]
@ -3007,6 +3010,14 @@ fi
# Enable --enable-host-bind-now
# Check whether --enable-host-bind-now was given.
if test "${enable_host_bind_now+set}" = set; then :
enableval=$enable_host_bind_now; LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
fi
# Check if O_CLOEXEC is defined by fcntl

7
c++tools/configure.ac
View file

@ -110,6 +110,13 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])],
[PICFLAG=-fPIE; LD_PICFLAG=-pie], [])
AC_SUBST(PICFLAG)
# Enable --enable-host-bind-now
AC_ARG_ENABLE(host-bind-now,
[AS_HELP_STRING([--enable-host-bind-now],
[link host code as BIND_NOW])],
[LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"], [])
AC_SUBST(enable_host_bind_now)
AC_SUBST(LD_PICFLAG)
# Check if O_CLOEXEC is defined by fcntl

20
gcc/configure vendored
View file

@ -635,6 +635,7 @@ CET_HOST_FLAGS
LD_PICFLAG
PICFLAG
enable_default_pie
enable_host_bind_now
enable_host_pie
enable_host_shared
enable_plugin
@ -1031,6 +1032,7 @@ enable_version_specific_runtime_libs
enable_plugin
enable_host_shared
enable_host_pie
enable_host_bind_now
enable_libquadmath_support
with_linker_hash_style
with_diagnostics_color
@ -1794,6 +1796,7 @@ Optional Features:
--enable-plugin enable plugin support
--enable-host-shared build host code as shared libraries
--enable-host-pie build host code as PIE
--enable-host-bind-now link host code as BIND_NOW
--disable-libquadmath-support
disable libquadmath support for Fortran
--enable-default-pie enable Position Independent Executable as default
@ -19847,7 +19850,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
#line 19850 "configure"
#line 19853 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@ -19953,7 +19956,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
#line 19956 "configure"
#line 19959 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@ -32100,6 +32103,14 @@ fi
# Enable --enable-host-bind-now
# Check whether --enable-host-bind-now was given.
if test "${enable_host_bind_now+set}" = set; then :
enableval=$enable_host_bind_now;
fi
# Check whether --enable-libquadmath-support was given.
if test "${enable_libquadmath_support+set}" = set; then :
enableval=$enable_libquadmath_support; ENABLE_LIBQUADMATH_SUPPORT=$enableval
@ -32286,6 +32297,8 @@ else
PICFLAG=
fi
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@ -32294,6 +32307,9 @@ else
LD_PICFLAG=
fi
if test x$enable_host_bind_now = xyes; then
LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
fi

13
gcc/configure.ac
View file

@ -7425,6 +7425,12 @@ AC_ARG_ENABLE(host-pie,
[build host code as PIE])])
AC_SUBST(enable_host_pie)
# Enable --enable-host-bind-now
AC_ARG_ENABLE(host-bind-now,
[AS_HELP_STRING([--enable-host-bind-now],
[link host code as BIND_NOW])])
AC_SUBST(enable_host_bind_now)
AC_ARG_ENABLE(libquadmath-support,
[AS_HELP_STRING([--disable-libquadmath-support],
[disable libquadmath support for Fortran])],
@ -7566,6 +7572,8 @@ else
PICFLAG=
fi
AC_SUBST([PICFLAG])
if test x$enable_host_pie = xyes; then
LD_PICFLAG=-pie
elif test x$gcc_cv_no_pie = xyes; then
@ -7574,7 +7582,10 @@ else
LD_PICFLAG=
fi
AC_SUBST([PICFLAG])
if test x$enable_host_bind_now = xyes; then
LD_PICFLAG="$LD_PICFLAG -Wl,-z,now"
fi
AC_SUBST([LD_PICFLAG])
# Enable Intel CET on Intel CET enabled host if jit is enabled.

6
gcc/doc/install.texi
View file

@ -1095,6 +1095,12 @@ protection against Return Oriented Programming (ROP) attacks.
in which case @option{-fPIC} is used when compiling, and @option{-pie} when
linking.
@item --enable-host-bind-now
Specify that the @emph{host} executables should be linked with the option
@option{-Wl,-z,now}, which means that the dynamic linker will resolve all
symbols when the executables are started, and that in turn allows RELRO to
mark the GOT read-only, resulting in better security.
@item @anchor{with-gnu-as}--with-gnu-as
Specify that the compiler should assume that the
assembler it finds is the GNU assembler. However, this does not modify

20
lto-plugin/configure vendored
View file

@ -663,6 +663,7 @@ accel_dir_suffix
gcc_build_dir
CET_HOST_FLAGS
ac_lto_plugin_ldflags
enable_host_bind_now
ac_lto_plugin_warn_cflags
EGREP
GREP
@ -778,6 +779,7 @@ enable_maintainer_mode
with_libiberty
enable_dependency_tracking
enable_largefile
enable_host_bind_now
enable_cet
with_gcc_major_version_only
enable_shared
@ -1425,6 +1427,7 @@ Optional Features:
--disable-dependency-tracking
speeds up one-time build
--disable-largefile omit support for large files
--enable-host-bind-now link host code as BIND_NOW
--enable-cet enable Intel CET in host libraries [default=auto]
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-static[=PKGS] build static libraries [default=yes]
@ -5669,6 +5672,19 @@ if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
# Enable --enable-host-bind-now
# Check whether --enable-host-bind-now was given.
if test "${enable_host_bind_now+set}" = set; then :
enableval=$enable_host_bind_now;
fi
if test x$enable_host_bind_now = xyes; then
ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
fi
# Check whether --enable-cet was given.
if test "${enable_cet+set}" = set; then :
@ -12134,7 +12150,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
#line 12137 "configure"
#line 12153 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@ -12240,7 +12256,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
#line 12243 "configure"
#line 12259 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H

11
lto-plugin/configure.ac
View file

@ -25,6 +25,17 @@ LDFLAGS="$saved_LDFLAGS"
if test "x$have_static_libgcc" = xyes; then
ac_lto_plugin_ldflags="-Wc,-static-libgcc"
fi
# Enable --enable-host-bind-now
AC_ARG_ENABLE(host-bind-now,
[AS_HELP_STRING([--enable-host-bind-now],
[link host code as BIND_NOW])])
AC_SUBST(enable_host_bind_now)
if test x$enable_host_bind_now = xyes; then
ac_lto_plugin_ldflags="$ac_lto_plugin_ldflags -Wl,-z,now"
fi
AC_SUBST(ac_lto_plugin_ldflags)
GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)