{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12895","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12895/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12895/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12895/events","html_url":"https://github.com/NixOS/nixpkgs/pull/12895","id":132452932,"number":12895,"title":"[WIP/RFC] Hardened compiler flags by default","user":{"login":"globin","id":1447245,"avatar_url":"https://avatars.githubusercontent.com/u/1447245?v=3","gravatar_id":"","url":"https://api.github.com/users/globin","html_url":"https://github.com/globin","followers_url":"https://api.github.com/users/globin/followers","following_url":"https://api.github.com/users/globin/following{/other_user}","gists_url":"https://api.github.com/users/globin/gists{/gist_id}","starred_url":"https://api.github.com/users/globin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/globin/subscriptions","organizations_url":"https://api.github.com/users/globin/orgs","repos_url":"https://api.github.com/users/globin/repos","events_url":"https://api.github.com/users/globin/events{/privacy}","received_events_url":"https://api.github.com/users/globin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20mass-rebuild","name":"1.severity: mass-rebuild","color":"e11d21"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20security","name":"1.severity: security","color":"e11d21"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/8.has:%20documentation","name":"8.has: documentation","color":"009800"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/9","html_url":"https://github.com/NixOS/nixpkgs/milestones/16.09","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/milestones/9/labels","id":1599653,"number":9,"title":"16.09","description":"The next release after 16.03. Perhaps it will be 16.09","creator":{"login":"vcunat","id":1785925,"avatar_url":"https://avatars.githubusercontent.com/u/1785925?v=3","gravatar_id":"","url":"https://api.github.com/users/vcunat","html_url":"https://github.com/vcunat","followers_url":"https://api.github.com/users/vcunat/followers","following_url":"https://api.github.com/users/vcunat/following{/other_user}","gists_url":"https://api.github.com/users/vcunat/gists{/gist_id}","starred_url":"https://api.github.com/users/vcunat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcunat/subscriptions","organizations_url":"https://api.github.com/users/vcunat/orgs","repos_url":"https://api.github.com/users/vcunat/repos","events_url":"https://api.github.com/users/vcunat/events{/privacy}","received_events_url":"https://api.github.com/users/vcunat/received_events","type":"User","site_admin":false},"open_issues":50,"closed_issues":43,"state":"open","created_at":"2016-02-23T13:45:20Z","updated_at":"2016-08-22T00:15:14Z","due_on":null,"closed_at":null},"comments":81,"created_at":"2016-02-09T15:46:37Z","updated_at":"2016-08-22T12:35:03Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/12895","html_url":"https://github.com/NixOS/nixpkgs/pull/12895","diff_url":"https://github.com/NixOS/nixpkgs/pull/12895.diff","patch_url":"https://github.com/NixOS/nixpkgs/pull/12895.patch"},"body":"~~This adds some compiler/linker flags to harden our packages via a stdenv adapter:~~\r\n\r\nThe following parameters are now available:\r\n\r\n  * `hardeningDisable`\r\n    To disable specific hardening flags\r\n  * `hardeningEnable`\r\n    To enable specific hardening flags\r\n\r\nOnly the cc-wrapper supports this right now, but these may be reused by other wrappers, builders or setup hooks.\r\n\r\ncc-wrapper supports the following flags:\r\n\r\n  * `fortify`\r\n  * `stackprotector`\r\n  * `pie` (disabled by default)\r\n  * `pic`\r\n  * `strictoverflow`\r\n  * `format`\r\n  * `relro`\r\n  * `bindnow`\r\n\r\nInformation from the debian wiki:\r\n\r\n**Stack protector** is a mainline GCC feature, which adds safety checks against stack overwrites. This renders many potential code injection attacks into aborting situations. In the best case this turns code injection vulnerabilities into denial of service or into non-issues (depending on the application). http://en.wikipedia.org/wiki/Stack-smashing_protection\r\n~~*Currently this uses `-fstack-protector-all` instead of `-fstack-protector-strong` because the bootstrapping compiler is too old.`* /cc @edolstra~~\r\n\r\n**Fortify** During code generation the compiler knows a great deal of information about buffer sizes (where possible), and attempts to replace insecure unlimited length buffer function calls with length-limited ones. This is especially useful for old, crufty code. Additionally, format strings in writable memory that contain '%n' are blocked. If an application depends on such a format string, it will need to be worked around. \r\n\r\n**Format**\r\nIf -Wformat is specified, also warn about uses of format functions that represent possible security problems. At present, this warns about calls to printf and scanf functions where the format string is not a string literal and there are no format arguments, as in printf (foo);. This may be a security hole if the format string came from untrusted input and contains %n. \r\n\r\n**Position Independent Executable (pie)** are needed to take advantage of Address Space Layout Randomization, supported by some kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this (-fPIC), so they gain ASLR automatically, but binary .text regions need to be build PIE to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.\r\n\r\n**relro**\r\nDuring program load, several ELF memory sections need to be written to by the linker, but can be turned read-only before turning over control to the program. This prevents some GOT (and .dtors) overwrite attacks, but at least the part of the GOT used by the dynamic linker (.got.plt) is still vulnerable. \r\n\r\n**bindnow**\r\nDuring program load, all dynamic symbols are resolved, allowing for the complete GOT to be marked read-only (due to -z relro above). This prevents GOT overwrite attacks. For very large application, this can incur some performance loss during initial load while symbols are resolved, but this shouldn't be an issue for daemons. \r\n\r\n**State in other Distributions**\r\nNearly all major distributions are setting these flags by default (except for pie), debian started working on this ~10 years ago, see links at the end.\r\n\r\nMost packages build (https://hydra.nixos.org/jobset/nixpkgs/pr-12895#tabs-evaluations), mostly needs further testing at runtime.\r\n\r\nI'd be happy to hear more comments, ideas, concerns!\r\n\r\n**Links**\r\nhttps://wiki.debian.org/Hardening\r\nhttps://wiki.ubuntu.com/Security/Features\r\nhttps://wiki.gentoo.org/wiki/Project:Hardened (and https://wiki.gentoo.org/wiki/Hardened/FAQ)\r\nhttps://wiki.archlinux.org/index.php/DeveloperWiki:Security\r\n\r\n(/cc @copumpkin @fpletz)"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/241399128","html_url":"https://github.com/NixOS/nixpkgs/pull/12895#issuecomment-241399128","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12895","id":241399128,"user":{"login":"obadz","id":3359345,"avatar_url":"https://avatars.githubusercontent.com/u/3359345?v=3","gravatar_id":"","url":"https://api.github.com/users/obadz","html_url":"https://github.com/obadz","followers_url":"https://api.github.com/users/obadz/followers","following_url":"https://api.github.com/users/obadz/following{/other_user}","gists_url":"https://api.github.com/users/obadz/gists{/gist_id}","starred_url":"https://api.github.com/users/obadz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/obadz/subscriptions","organizations_url":"https://api.github.com/users/obadz/orgs","repos_url":"https://api.github.com/users/obadz/repos","events_url":"https://api.github.com/users/obadz/events{/privacy}","received_events_url":"https://api.github.com/users/obadz/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T12:35:03Z","updated_at":"2016-08-22T12:35:03Z","body":"@edolstra,\r\n\r\nThis branch has built fine with all tests passing here: http://hydra.nixos.org/build/38503032#tabs-constituents\r\n\r\nFWIW I've also been running on it for 10 days without any hiccups.\r\n\r\nIt's being rebuilt in staging with glibc 2.24 and a bunch of other changes in `staging`: http://hydra.nixos.org/build/38892192#tabs-constituents\r\n\r\nI am planning to merge it into `master` if there aren't any substantial issues with that build unless you let us know that you want more time to think/review/or if you or anyone else has concerns."}}
{"actor":{"display_login":"obadz"}}