pkgs/build-support/cc-wrapper/add-hardening.sh

   1 declare -a hardeningCFlagsAfter=()
   2 declare -a hardeningCFlagsBefore=()
   3
   4 declare -A hardeningEnableMap=()
   5
   6 # Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
   7 # array expansion also prevents undefined variables from causing trouble with
   8 # `set -u`.
   9 for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do
  10   hardeningEnableMap["$flag"]=1
  11 done
  12
  13 # fortify3 implies fortify enablement - make explicit before
  14 # we filter unsupported flags because unsupporting fortify3
  15 # doesn't mean we should unsupport fortify too
  16 if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
  17   hardeningEnableMap["fortify"]=1
  18 fi
  19
  20 # Remove unsupported flags.
  21 for flag in @hardening_unsupported_flags@; do
  22   unset -v "hardeningEnableMap[$flag]"
  23   # fortify being unsupported implies fortify3 is unsupported
  24   if [[ "$flag" = 'fortify' ]] ; then
  25     unset -v "hardeningEnableMap['fortify3']"
  26   fi
  27 done
  28
  29 # now make fortify and fortify3 mutually exclusive
  30 if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
  31   unset -v "hardeningEnableMap['fortify']"
  32 fi
  33
  34 if (( "${NIX_DEBUG:-0}" >= 1 )); then
  35   declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection pacret pie pic strictoverflow format trivialautovarinit zerocallusedregs)
  36   declare -A hardeningDisableMap=()
  37
  38   # Determine which flags were effectively disabled so we can report below.
  39   for flag in "${allHardeningFlags[@]}"; do
  40     if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
  41       hardeningDisableMap["$flag"]=1
  42     fi
  43   done
  44
  45   printf 'HARDENING: disabled flags:' >&2
  46   (( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
  47   echo >&2
  48
  49   if (( "${#hardeningEnableMap[@]}" )); then
  50     echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
  51   fi
  52 fi
  53
  54 for flag in "${!hardeningEnableMap[@]}"; do
  55   case $flag in
  56     fortify | fortify3)
  57       # Use -U_FORTIFY_SOURCE to avoid warnings on toolchains that explicitly
  58       # set -D_FORTIFY_SOURCE=0 (like 'clang -fsanitize=address').
  59       hardeningCFlagsBefore+=('-O2' '-U_FORTIFY_SOURCE')
  60       # Unset any _FORTIFY_SOURCE values the command-line may have set before
  61       # enforcing our own value, avoiding (potentially fatal) redefinition
  62       # warnings
  63       hardeningCFlagsAfter+=('-U_FORTIFY_SOURCE')
  64       case $flag in
  65         fortify)
  66           if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify >&2; fi
  67           hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=2')
  68         ;;
  69         fortify3)
  70           if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling fortify3 >&2; fi
  71           hardeningCFlagsAfter+=('-D_FORTIFY_SOURCE=3')
  72         ;;
  73         *)
  74           # Ignore unsupported.
  75           ;;
  76       esac
  77       ;;
  78     shadowstack)
  79       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling shadowstack >&2; fi
  80       hardeningCFlagsBefore+=('-fcf-protection=return')
  81       ;;
  82     pacret)
  83       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pacret >&2; fi
  84       hardeningCFlagsBefore+=('-mbranch-protection=pac-ret')
  85       ;;
  86     stackprotector)
  87       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
  88       hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
  89       ;;
  90     stackclashprotection)
  91       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
  92       hardeningCFlagsBefore+=('-fstack-clash-protection')
  93       ;;
  94     pie)
  95       # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
  96       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
  97       hardeningCFlagsBefore=('-fPIE' "${hardeningCFlagsBefore[@]}")
  98       if [[ ! (" ${params[*]} " =~ " -shared " || " ${params[*]} " =~ " -static ") ]]; then
  99         if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
 100         hardeningCFlagsBefore=('-pie' "${hardeningCFlagsBefore[@]}")
 101       fi
 102       ;;
 103     pic)
 104       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pic >&2; fi
 105       hardeningCFlagsBefore+=('-fPIC')
 106       ;;
 107     strictoverflow)
 108       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling strictoverflow >&2; fi
 109       if (( @isClang@ )); then
 110         # In Clang, -fno-strict-overflow only serves to set -fwrapv and is
 111         # reported as an unused CLI argument if -fwrapv or -fno-wrapv is set
 112         # explicitly, so we side step that by doing the conversion here.
 113         #
 114         # See: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.6/clang/lib/Driver/ToolChains/Clang.cpp#L6315
 115         #
 116         hardeningCFlagsBefore+=('-fwrapv')
 117       else
 118         hardeningCFlagsBefore+=('-fno-strict-overflow')
 119       fi
 120       ;;
 121     trivialautovarinit)
 122       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling trivialautovarinit >&2; fi
 123       hardeningCFlagsBefore+=('-ftrivial-auto-var-init=pattern')
 124       ;;
 125     format)
 126       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling format >&2; fi
 127       hardeningCFlagsBefore+=('-Wformat' '-Wformat-security' '-Werror=format-security')
 128       ;;
 129     zerocallusedregs)
 130       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling zerocallusedregs >&2; fi
 131       hardeningCFlagsBefore+=('-fzero-call-used-regs=used-gpr')
 132       ;;
 133     *)
 134       # Ignore unsupported. Checked in Nix that at least *some*
 135       # tool supports each flag.
 136       ;;
 137   esac
 138 done