d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a WITH_BIND_NOW build knob

Browse Source 
The linker's -z now flag sets the DF_BIND_NOW flag, which signals to the
runtime loader that all relocation processing should be performed at
process startup rather than on demand.  In combination with lld's
default of enabling relro this causes the GOT to be made read-only when
the process starts, preventing straightforward GOT overwrite attacks.

Shawn Webb discovered a failure on HardenedBSD with BIND_NOW and ifunc
use, which resulted in my rtld fix in r340137.  Add a BIND_NOW knob as
it is trivial to do so and is a useful ELF hardening feature.  This
change is equivalent to HardenedBSD's but not identical as there are
other diffs/conflicts nearby.

Note that our ELF Tool Chain readelf does not currently decode the
DF_BIND_NOW flag - see PR232983.

Reviewed by:	brooks
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D17846
This commit is contained in:
Ed Maste 2018-11-06 15:52:49 +00:00
parent 02bf7e5e40
commit bf81eb3ca9
5 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
share/mk/bsd.lib.mk
View File

@ -69,6 +69,10 @@ TAGS+= package=${PACKAGE:Uruntime}
TAG_ARGS= -T ${TAGS:[*]:S/ /,/g}
.endif
# ELF hardening knobs
.if ${MK_BIND_NOW} != "no"
LDFLAGS+= -Wl,-znow
.endif
.if ${MK_RETPOLINE} != "no"
CFLAGS+= -mretpoline
CXXFLAGS+= -mretpoline

1
share/mk/bsd.opts.mk
View File

@ -69,6 +69,7 @@ __DEFAULT_YES_OPTIONS = \
WARNS
__DEFAULT_NO_OPTIONS = \
BIND_NOW \
CCACHE_BUILD \
CTF \
INSTALL_AS_USER \

4
share/mk/bsd.prog.mk
View File

@ -34,6 +34,10 @@ PROG= ${PROG_CXX}
MK_DEBUG_FILES= no
.endif
# ELF hardening knobs
.if ${MK_BIND_NOW} != "no"
LDFLAGS+= -Wl,-znow
.endif
.if ${MK_RETPOLINE} != "no"
CFLAGS+= -mretpoline
CXXFLAGS+= -mretpoline

5
tools/build/options/WITHOUT_BIND_NOW Normal file
View File

@ -0,0 +1,5 @@
.\" $FreeBSD$
Do not build all binaries with the
.Dv DF_BIND_NOW
flag set.
Run-time relocation processing will be performed on demand.

5
tools/build/options/WITH_BIND_NOW Normal file
View File

@ -0,0 +1,5 @@
.\" $FreeBSD$
Build all binaries with the
.Dv DF_BIND_NOW
flag set to indicate that the run-time loader should perform all relocation
processing at process startup rather than on demand.