From 9ff1e6d80bbd5b44b9ec4c0a837d9a4c962698e4 Mon Sep 17 00:00:00 2001 From: Giuseppe D'Angelo Date: Wed, 6 Mar 2024 16:22:12 +0100 Subject: [PATCH] Add hardening build options This commit enables hardened-specific checks and codegen, inspired by GCC 14's -fhardened command line switch and LLVM/libc++'s hardened modes. We enable (depending on compiler capabilities): * -ftrivial-auto-var-init=pattern; * -fstack-protector-strong; * -fstack-clash-protection; * -fcf-protection=full or /CETCOMPAT; * -D_FORTIFY_SOURCE=3 or 2 on Glibc, depending on the Glibc version, provided that some optimization level is enabled (release build or optimized debug build); * on libstdc++, -D_GLIBCXX_ASSERTIONS; * on libc++, -D_LIBCPP_HARDENING_MODE set to _LIBCPP_HARDENING_MODE_EXTENSIVE in debug and to _LIBCPP_HARDENING_MODE_FAST in release (_DEBUG is too slow); * -Wl,-z,relro,-z,now. This aligns us 100% with -fhardened (we already pass -fPIE and -pie anyhow). Some Linux distributions already ship GCC/Clang with some of these options enabled by default. The check for Intel CET has been amended to always test if the compiler supports the corresponding flag; and, if so, enable the feature. Before, it was behind a configure option and the test only checked if the compiler had CET support automatically active (the test didn't pass -fcf-protection to the compiler). The check for -fstack-protector-strong has been made general (rather than QNX-specific). We don't support QNX < 7 anyhow. Finally, the qt_config_linker_supports_flag_test test has been amended to also support MSVC. All of the hardening options are enabled by default. [ChangeLog][Build System] Qt builds by default in "hardened mode", meaning that a series of security-related compiler options are automatically enabled. In the unlikely case in which these options constitute an unacceptable performance hit, it is possible to disable individual hardening options when configuring Qt. Change-Id: I2c026b0438010ad10d5e7b1136fedf4ae3af8822 Reviewed-by: Qt CI Bot Reviewed-by: Thiago Macieira --- cmake/QtFeature.cmake | 11 ++- cmake/QtInternalTargets.cmake | 46 ++++++++-- config_help.txt | 11 ++- configure.cmake | 163 ++++++++++++++++++++++++++++------ qt_cmdline.cmake | 7 ++ 5 files changed, 203 insertions(+), 35 deletions(-) diff --git a/cmake/QtFeature.cmake b/cmake/QtFeature.cmake index afe0417f613..96cb308b2c1 100644 --- a/cmake/QtFeature.cmake +++ b/cmake/QtFeature.cmake @@ -1359,7 +1359,16 @@ function(qt_config_linker_supports_flag_test name) endif() cmake_parse_arguments(arg "" "LABEL;FLAG" "" ${ARGN}) - set(flags "-Wl,${arg_FLAG}") + if(GCC OR CLANG) + set(flags "-Wl,--fatal-warnings,${arg_FLAG}") + elseif(MSVC) + set(flags "${arg_FLAG}") + else() + # We don't know how to pass linker options in a way that + # it reliably fails, so assume the detection failed. + set(TEST_${name} "0" CACHE INTERNAL "${label}") + return() + endif() # Pass the linker that the main project uses to the compile test. qt_internal_get_active_linker_flags(linker_flags) diff --git a/cmake/QtInternalTargets.cmake b/cmake/QtInternalTargets.cmake index bdba1b5be14..885665b7ed5 100644 --- a/cmake/QtInternalTargets.cmake +++ b/cmake/QtInternalTargets.cmake @@ -316,18 +316,52 @@ if (GCC AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL "9.2") target_compile_options(PlatformCommonInternal INTERFACE $<$:-Wsuggest-override>) endif() +# Hardening options if(QT_FEATURE_intelcet) if(MSVC) - qt_internal_platform_link_options(PlatformCommonInternal INTERFACE - -CETCOMPAT - ) + qt_internal_platform_link_options(PlatformCommonInternal INTERFACE -CETCOMPAT) else() - target_compile_options(PlatformCommonInternal INTERFACE - -fcf-protection=full - ) + target_compile_options(PlatformCommonInternal INTERFACE -fcf-protection=full) endif() endif() +if(QT_FEATURE_glibc_fortify_source) + set(is_optimized_build "$>,$>") + # Some compilers may define _FORTIFY_SOURCE by default when optimizing, remove it + # before defining our own + target_compile_options(PlatformCommonInternal BEFORE INTERFACE "$<${is_optimized_build}:-U_FORTIFY_SOURCE>") + if(TEST_glibc_234) + target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=3>") + else() + target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=2>") + endif() +endif() + +if(QT_FEATURE_trivial_auto_var_init_pattern) + target_compile_options(PlatformCommonInternal INTERFACE -ftrivial-auto-var-init=pattern) +endif() + +if(QT_FEATURE_stack_protector) + target_compile_options(PlatformCommonInternal INTERFACE -fstack-protector-strong) +endif() + +if(QT_FEATURE_stack_clash_protection) + target_compile_options(PlatformCommonInternal INTERFACE -fstack-clash-protection) +endif() + +if(QT_FEATURE_libstdcpp_assertions) + target_compile_definitions(PlatformCommonInternal INTERFACE _GLIBCXX_ASSERTIONS) +endif() + +if(QT_FEATURE_libcpp_hardening) + target_compile_definitions(PlatformCommonInternal INTERFACE -D_LIBCPP_HARDENING_MODE="$,_LIBCPP_HARDENING_MODE_EXTENSIVE,_LIBCPP_HARDENING_MODE_FAST>") +endif() + +if(QT_FEATURE_relro_now_linker) + qt_internal_platform_link_options(PlatformCommonInternal INTERFACE "-Wl,-z,relro,-z,now") +endif() + + if(QT_FEATURE_force_asserts) target_compile_definitions(PlatformCommonInternal INTERFACE QT_FORCE_ASSERTS) endif() diff --git a/config_help.txt b/config_help.txt index c6273a53f7f..a5f8cd62df1 100644 --- a/config_help.txt +++ b/config_help.txt @@ -138,7 +138,16 @@ Build options: -pch ................. Use precompiled headers [auto] -ltcg ................ Use Link Time Code Generation [no] - -intelcet ............ Use Intel Control-flow Enforcement Technology [no] + -intelcet ............ Use Intel Control-flow Enforcement Technology [auto] + -glibc-fortify-source Use Glibc function fortification [auto] + -trivial-auto-var-init-pattern + Use -ftrivial-auto-var-init=pattern [auto] + -stack-protector ..... Use -fstack-protector-strong [auto] + -stack-clash-protection + Use -fstack-clash-protection [auto] + -libstdcpp-assertions Use libstdc++ assertions [auto] + -libcpp-hardening .... Use libc++ hardening [auto] + -relro-now-linker .... Use -z relro -z now when linking [auto] -linker [bfd,gold,lld,mold] Force use of the GNU ld, GNU gold, LLVM/LLD or mold linker instead of default one (GCC and clang only) diff --git a/configure.cmake b/configure.cmake index 74ea2133f01..caa1366ea20 100644 --- a/configure.cmake +++ b/configure.cmake @@ -211,6 +211,28 @@ endif() # machineTuple qt_config_compile_test_machine_tuple("machine tuple") +# glibc +qt_config_compile_test(glibc + LABEL "Using Glibc" + CODE +"#include +#ifndef __GLIBC__ +#error +#endif +int main() {}" +) + +# glibc 2.34, for _FORTIFY_SOURCE == 3 +qt_config_compile_test(glibc_234 + LABEL "Using Glibc >= 2.34" + CODE +"#include +#if !defined(__GLIBC__) || !__GLIBC_PREREQ(2, 34) +#error +#endif +int main() {}" +) + # cxx20 qt_config_compile_test(cxx20 LABEL "C++20 support" @@ -398,29 +420,40 @@ alloca(1); ") # stack_protector -qt_config_compile_test(stack_protector - LABEL "stack protection" - COMPILE_OPTIONS -fstack-protector-strong - CODE -"#ifdef __QNXNTO__ -# include -# if _NTO_VERSION < 700 -# error stack-protector not used (by default) before QNX 7.0.0. -# endif -#endif +if(NOT WASM) + # emcc doesn't support this, but the detection accidentally succeeds + # https://github.com/emscripten-core/emscripten/issues/17030 + qt_config_compiler_supports_flag_test(stack_protector + LABEL "stack protection" + FLAG "-fstack-protector-strong" + ) +endif() -int main(void) -{ - /* BEGIN TEST: */ - /* END TEST: */ - return 0; -} -") +# stack_clash_protection +if(NOT CLANG) # https://gitlab.kitware.com/cmake/cmake/-/issues/21998 + qt_config_compiler_supports_flag_test(stack_clash_protection + LABEL "-fstack-clash-protection support" + FLAG "-fstack-clash-protection" + ) +endif() + +# trivial_auto_var_init_pattern +qt_config_compiler_supports_flag_test(trivial_auto_var_init_pattern + LABEL "-ftrivial-auto-var-init=pattern support" + FLAG "-ftrivial-auto-var-init=pattern" +) # intelcet -qt_config_compile_test(intelcet - LABEL "Support for Intel Control-flow Enforcement Technology (CET)" - CODE +if(MSVC) + qt_config_linker_supports_flag_test(intelcet + LABEL "Support for Intel Control-flow Enforcement Technology (CET)" + FLAG "-CETCOMPAT" + ) +else() + qt_config_compile_test(intelcet + LABEL "Support for Intel Control-flow Enforcement Technology (CET)" + COMPILE_OPTIONS -fcf-protection=full + CODE "int main(void) { /* BEGIN TEST: */ @@ -430,8 +463,35 @@ qt_config_compile_test(intelcet /* END TEST: */ return 0; } -") +" + ) +endif() +# -z relro -z now +if(NOT WIN32) + qt_config_linker_supports_flag_test(relro_now_linker + LABEL "Support for -z relro and -z now" + FLAG "-z,relro,-z,now" + ) +endif() + +# Is libc++ the default Standard Library? +qt_config_compile_test(using_stdlib_libcpp + LABEL "Compiler defaults to libc++" + CODE +" +#include + +int main(void) +{ +/* BEGIN TEST: */ +#ifndef _LIBCPP_VERSION +# error +#endif +/* END TEST: */ +} +" +) #### Features @@ -889,10 +949,6 @@ qt_feature("alloca" PRIVATE LABEL "alloca()" CONDITION QT_FEATURE_alloca_h OR QT_FEATURE_alloca_malloc_h OR TEST_alloca_stdlib_h ) -qt_feature("stack-protector-strong" PRIVATE - LABEL "stack protection" - CONDITION QNX AND TEST_stack_protector -) qt_feature("system-zlib" PRIVATE LABEL "Using system zlib" CONDITION WrapSystemZLIB_FOUND @@ -1056,10 +1112,56 @@ qt_feature("relocatable" PRIVATE AUTODETECT QT_FEATURE_shared CONDITION QT_FEATURE_dlopen OR WIN32 OR NOT QT_FEATURE_shared ) +# hardening features qt_feature("intelcet" PRIVATE - LABEL "Using Intel CET" - CONDITION ( INPUT_intelcet STREQUAL yes ) OR TEST_intelcet + LABEL "Using Intel Control-flow Enforcement Technology (CET)" + AUTODETECT ON + CONDITION TEST_intelcet ) +qt_feature_config("intelcet" QMAKE_PUBLIC_CONFIG) +qt_feature("glibc_fortify_source" PRIVATE + LABEL "Using Glibc function fortification" + AUTODETECT ON + CONDITION TEST_glibc +) +qt_feature_config("glibc_fortify_source" QMAKE_PUBLIC_CONFIG) +qt_feature("trivial_auto_var_init_pattern" PRIVATE + LABEL "Using -ftrivial-auto-var-init=pattern" + AUTODETECT ON + CONDITION TEST_trivial_auto_var_init_pattern +) +qt_feature_config("trivial_auto_var_init_pattern" QMAKE_PUBLIC_CONFIG) +qt_feature("stack_protector" PRIVATE + LABEL "Using -fstack-protector-strong" + AUTODETECT ON + CONDITION TEST_stack_protector +) +qt_feature_config("stack_protector" QMAKE_PUBLIC_CONFIG) +qt_feature("stack_clash_protection" PRIVATE + LABEL "Using -fstack-clash-protection" + AUTODETECT ON + CONDITION TEST_stack_clash_protection +) +qt_feature_config("stack_clash_protection" QMAKE_PUBLIC_CONFIG) +qt_feature("libstdcpp_assertions" PRIVATE + LABEL "Using libstdc++ assertions" + AUTODETECT ON + CONDITION (GCC OR (CLANG AND NOT MSVC AND NOT QT_FEATURE_stdlib_libcpp AND NOT TEST_using_stdlib_libcpp)) +) +qt_feature_config("libstdcpp_assertions" QMAKE_PUBLIC_CONFIG) +qt_feature("libcpp_hardening" PRIVATE + LABEL "Using libc++ hardening" + AUTODETECT ON + CONDITION (QT_FEATURE_stdlib_libcpp OR TEST_using_stdlib_libcpp) +) +qt_feature_config("libcpp_hardening" QMAKE_PUBLIC_CONFIG) +qt_feature("relro_now_linker" PRIVATE + LABEL "Using -z relro -z now when linking" + AUTODETECT ON + CONDITION TEST_relro_now_linker +) +qt_feature_config("relro_now_linker" QMAKE_PUBLIC_CONFIG) + if("${INPUT_coverage}" STREQUAL "gcov") qt_config_compile_test(gcov @@ -1137,6 +1239,13 @@ qt_configure_add_summary_entry(ARGS "relocatable") qt_configure_add_summary_entry(ARGS "precompile_header") qt_configure_add_summary_entry(ARGS "ltcg") qt_configure_add_summary_entry(ARGS "intelcet") +qt_configure_add_summary_entry(ARGS "glibc_fortify_source") +qt_configure_add_summary_entry(ARGS "trivial_auto_var_init_pattern") +qt_configure_add_summary_entry(ARGS "stack_protector") +qt_configure_add_summary_entry(ARGS "stack_clash_protection") +qt_configure_add_summary_entry(ARGS "libstdcpp_assertions") +qt_configure_add_summary_entry(ARGS "libcpp_hardening") +qt_configure_add_summary_entry(ARGS "relro_now_linker") qt_configure_add_summary_entry( ARGS "wasm-simd128" CONDITION ( TEST_architecture_arch STREQUAL wasm ) diff --git a/qt_cmdline.cmake b/qt_cmdline.cmake index fdf22561e7b..a01ad054c42 100644 --- a/qt_cmdline.cmake +++ b/qt_cmdline.cmake @@ -76,6 +76,13 @@ qt_commandline_option(openssl-runtime TYPE void NAME openssl VALUE runtime) qt_commandline_option(linker TYPE optionalString VALUES bfd gold lld mold) qt_commandline_option(ltcg TYPE boolean) qt_commandline_option(intelcet TYPE boolean) +qt_commandline_option(glibc_fortify_source TYPE boolean) +qt_commandline_option(trivial_auto_var_init_pattern TYPE boolean) +qt_commandline_option(stack_protector TYPE boolean) +qt_commandline_option(stack_clash_protection TYPE boolean) +qt_commandline_option(libstdcpp_assertions TYPE boolean) +qt_commandline_option(libcpp_hardening TYPE boolean) +qt_commandline_option(relro_now_linker TYPE boolean) qt_commandline_option(make TYPE addString VALUES examples libs tests tools benchmarks manual-tests minimal-static-tests) qt_commandline_option(install-examples-sources TYPE boolean)