cc-wrapper: add support for ibt hardening flag on aarch64 & x86_64
#333895
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
6.topic: stdenv
ofborg
bot
added
10.rebuild-darwin-stdenv
despite the feature being known as "bti" (Branch Target Identification) on aarch64, using "ibt" (Indirect Branch Tracking, intel's preferred term) as the hardening flag name because bti has an unfortunate acronym collision with Branch Target Injection, a spectre variant.
includes tests covering use of ibt/shadowstack/pacret together as they have overlapping compiler flags on both x86_64 and aarch64 creating some potential for conflict
github-actions
bot
added
6.topic: nixos
|
In digging up details for the manual entry, I'm reminded that linux currently lacks userspace support for x86_64's IBT. So for now at least that's completely untestable. |
wegank
added
the
2.status: merge conflict
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
This sits on top of #331596 so perhaps review that first?
Background: https://en.wikipedia.org/wiki/Indirect_branch_tracking
Individual commit comments contain more detail on specific choices.
For IBT to be enabled at runtime, a binary's ELF files need to be marked as supporting IBT, and the linker won't mark them as such unless all their constituent
.ofiles are marked as such. This includes the c runtime filescrti.o,crtn.o,crtbegin.oet al. So for IBT to be usable at all on a toolchain, these files (belonging to glibc and gcc) must be built with IBT enabled. For x86_64, this is handled automagically by glibc and gcc's build systems. But for aarch64, it is not.So, perhaps controversially, this patches glibc and gcc for all systems (not just
pkgsExtraHardening) to build these crt files with IBT on aarch64. My reasoning is that this is safe because it's basically what is being done on x86_64 anyway and if we don't do this, theibthardening flag will have no real effect on individual packages in normal package sets, leaving people unable to try it out gradually. Also, because these changes rely on patches, I fear they would become bitrotted if they were made optional."Tested" this (via the added feature tests) extensively on x86_64 (clang & gcc, cross-building for aarch64 with clang & gcc) and aarch64 (clang & gcc, cross-building for x86_64 with clang & gcc).
However, as before I have not been able to test this on IBT-supporting hardware because I don't have access to any. This requires
a recent Intel/AMD processor or, on aarch64, an ARM v8.5+-based machine (a Graviton 4 or Apple M1 might do). So again I'm going to need some community help in trying to build as many packages as possible frompkgsExtraHardeningon some of these systems.TODO: release notes, manual additions...
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.