alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

cc-wrapper: add stackcheck hardening (stack clash)

Browse source 
This fixes the Stack Clash issue rediscovered by Qualys. See
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
for more information on the topic, specifically section III.

We don't have the kernel mitigation available because it is a Grsecurity
feature which we don't support anymore. Other distributions like Gentoo
Hardened and Arch already have `-fstack-check` enabled by default.

See the Gentoo page on Stack Clash for more information on this solution:
https://wiki.gentoo.org/wiki/Hardened/Gentoo_Hardened_and_Stack_Clash

This unfortunately doesn't apply to clang because `-fstack-check` is a
noop there. Note that the GCC implementation also has problems that could
be exploited to circumvent these checks but it is still better than
keeping it disabled.
This commit is contained in:
Franz Pletz 2017-06-21 19:11:41 +02:00
parent 6338c50a84
commit 4150f5e8ba
No known key found for this signature in database
GPG key ID: 846FDED7792617B4
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkgs/build-support/cc-wrapper/add-hardening.sh
View file

@ -1,4 +1,4 @@
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow)
hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow stackcheck)
hardeningFlags+=("${hardeningEnable[@]}")
hardeningCFlags=()
hardeningLDFlags=()
@ -50,7 +50,11 @@ if [[ ! $hardeningDisable =~ "all" ]]; then
if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling bindnow >&2; fi
hardeningLDFlags+=('-z' 'now')
;;
*)
stackcheck)
if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling stackcheck >&2; fi
hardeningCFlags+=('-fstack-check=specific')
;;
*)
echo "Hardening flag unknown: $flag" >&2
;;
esac