From owner-freebsd-current@freebsd.org Thu Jul 28 00:02:17 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 41A1CBA768F for ; Thu, 28 Jul 2016 00:02:17 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: from mail-io0-f174.google.com (mail-io0-f174.google.com [209.85.223.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 15E1F150F; Thu, 28 Jul 2016 00:02:16 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: by mail-io0-f174.google.com with SMTP id q83so85623204iod.1; Wed, 27 Jul 2016 17:02:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc:content-transfer-encoding; bh=zRJZZ24mkxwqKb9zY+S50I4rnCSUiq831kPx2ZBceJA=; b=CGKsmDNbHCD0h/8y++d3nxfYzKCeAlgn58FS2njF+elXtEv0fd5ydkFMp0jitgYYQx QNAWuEj1itG+WyXtOrph4YANhpkGAMYDS3xK6xjU4vuu6WeqtlC2qhG432ifGCgn2QLe /5G4X47QUTwNBYUQeMsy5VRsfEOmmgeTo4d4KQxGFfn7LaGLAA9JLbSGfL/31cQf4eFo 0+1rJlWSl3ZtqSgX1cVewAoyeqxFqL5K1NnG5TZPKODThTLbFTuC6Z4LgFGbPFgyVIRg +1IIX4QcHF1wU4G5IlIggZsN/P43PT987+zXUpPpMpUSjJi10q596NZvIA09R61CdQQU HP8g== X-Gm-Message-State: AEkoouuVmU4E+3Tqbhcl0VyY9ebWLhbVYxhQEgpVJi8lOAz3LhwiU57NOVgD4skV+8qqTQ== X-Received: by 10.107.37.198 with SMTP id l189mr30914747iol.117.1469664135289; Wed, 27 Jul 2016 17:02:15 -0700 (PDT) Received: from mail-it0-f47.google.com (mail-it0-f47.google.com. [209.85.214.47]) by smtp.gmail.com with ESMTPSA id 4sm3862675itw.4.2016.07.27.17.02.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Jul 2016 17:02:15 -0700 (PDT) Received: by mail-it0-f47.google.com with SMTP id j124so65353742ith.1; Wed, 27 Jul 2016 17:02:12 -0700 (PDT) X-Received: by 10.36.29.15 with SMTP id 15mr9930216itj.97.1469664132646; Wed, 27 Jul 2016 17:02:12 -0700 (PDT) MIME-Version: 1.0 Reply-To: cem@freebsd.org Received: by 10.36.233.67 with HTTP; Wed, 27 Jul 2016 17:02:07 -0700 (PDT) In-Reply-To: <20160727225527.GG13428@mutt-hardenedbsd> References: <20160727225527.GG13428@mutt-hardenedbsd> From: Conrad Meyer Date: Wed, 27 Jul 2016 17:02:07 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: SafeStack in base To: Shawn Webb Cc: freebsd-current , Ed Maste Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 00:02:17 -0000 On Wed, Jul 27, 2016 at 3:55 PM, Shawn Webb wr= ote: > Hey All, > > I'm interested in getting SafeStack working in FreeBSD base. Below is a > link to a simplistic (maybe too simplistic?) patch to enable SafeStack. > The patch applies against HardenedBSD's hardened/current/master branch. > Given how simple the patch is, it'd be extremely easy to port over to > FreeBSD (just line numbers would change). > > I am running into a bit of a problem, though. When linking > lib/libcom_err, I get the following error: > > com_err.So: In function `com_err': > /usr/src/lib/libcom_err/../../contrib/com_err/com_err.c:100: undefined re= ference to `__safestack_unsafe_stack_ptr' > cc: error: linker command failed with exit code 1 (use -v to see invocati= on) > *** [libcom_err.so.5.full] Error code 1 > > llvm's documentation says that SafeStack has been tested on FreeBSD. > When and how was it tested? Apparently someone has done some work to > enable it on FreeBSD, but I can't find any relevant FreeBSD-specific > documentation. > > If someone could point me in the right direction, I'd love to help get > SafeStack working (and commited?) in FreeBSD. > > Link to simplistic patch: http://ix.io/186A > Link to build log: https://gist.github.com/lattera/5d94f44a5f3e10a28425cd= 59104dd169 Hey Shawn, The relevant link line is: > -- libcom_err.so.5.full --- > building shared library libcom_err.so.5 > cc -target x86_64-unknown-freebsd12.0 --sysroot=3D/usr/obj/usr/src/tmp -B= /usr/obj/usr/src/tmp/usr/bin -Wl,--no-undefined -Wl,-z,relro -Wl,-z,now -fs= anitize=3Dsafe-stack -Wl,--version-script=3D/usr/src/lib/libcom_err/../../c= ontrib/com_err/version-script.map -fstack-protector-strong -shared -Wl,-x -= Wl,--fatal-warnings -Wl,--warn-shared-textrel -o libcom_err.so.5.full -Wl,= -soname,libcom_err.so.5 `NM=3D'nm' NMFLAGS=3D'' lorder com_err.So error.So= | tsort -q` The problem appears to be an upstream limitation of -fsanitize=3Dsafe-stack: "Most programs, static libraries, or individual files can be compiled with SafeStack as is. =E2=80=A6 Linking a DSO with SafeStack is not currently supported." [0] That probably needs to be addressed upstream before it can be enabled globa= lly. Best, Conrad [0]: http://clang.llvm.org/docs/SafeStack.html