Enable (and check for) 64-bit ASLR on Windows #8249
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
Author
|
Ugh, looks like the mingw64 ld on Trusty doesn't support this: user@trusty:~$ i686-w64-mingw32-ld --version
GNU ld (GNU Binutils) 2.23.52.20130620
Copyright 2013 Free Software Foundation, Inc.
This program is free software; you may redistribute it under the terms of
the GNU General Public License version 3 or (at your option) a later version.
This program has absolutely no warranty.Minimum version would be binutils 2.25: https://sourceware.org/ml/binutils/2014-08/msg00167.html. We should look at upgrading the build image to 16.04 LTS after the 0.13 release, this will also resolve the heap initialize-to-zero issue we currently have to work around. |
Member
|
Maybe have configure check if this is supported, so it can be built both ways? |
Member
Author
That's what the check_link_flag already does. It's just the security check that fails after the build. If you don't run that, this pull works fine w/ older gccs. |
Member
Author
Member
|
@laanwj ACK on making it non-fatal for now. Optimally with some kind of switch to elevate warnings to errors like -Werror. That way we could set it as a real error in gitian when it should be supported, even though we allow older toolchains to configure with warnings. I'm still head-down in toolchain stuff, maybe we can have this turned on for 0.14. |
check_PE_PIE only checked for DYNAMIC_BASE, this is not enough for (secure) ASLR on 64-bit.
This should enable high-entropy ASLR on 64-bit targets, for better mitigation of exploits.
laanwj
force-pushed
the
2016_06_windows64_security
branch
from
2eb2873 to
62c2915
Compare
Member
Author
|
I split off the high entropy check and added this to the security-checks for now: I didn't find it worth the trouble to add a command-line option. The script can just be updated once we switch build platforms. The security check script exists for our releases, nothing else. |
laanwj
added a commit
that referenced
this pull request
Sep 26, 2016
zkbot
added a commit
to zcash/zcash
that referenced
this pull request
Dec 1, 2017
Build system improvements Includes commits cherry-picked from the following upstream PRs: - bitcoin/bitcoin#6978 - Only the first commit (second is for QT) - bitcoin/bitcoin#7059 - bitcoin/bitcoin#7603 - Only the first commit (the rest are for QT) - bitcoin/bitcoin#7954 - bitcoin/bitcoin#8314 - Only the second commit (first is for QT) - bitcoin/bitcoin#8504 - Only the first commit (second was undoing something we didn't have) - bitcoin/bitcoin#8520 - bitcoin/bitcoin#8563 - bitcoin/bitcoin#8249 - bitcoin/bitcoin#9156 - bitcoin/bitcoin#9831 - bitcoin/bitcoin#9789 - bitcoin/bitcoin#10766 Part of #2074.
zkbot
added a commit
to zcash/zcash
that referenced
this pull request
Dec 15, 2017
Build system improvements Includes commits cherry-picked from the following upstream PRs: - bitcoin/bitcoin#6978 - Only the first commit (second is for QT) - bitcoin/bitcoin#7059 - bitcoin/bitcoin#7603 - Only the first commit (without the `BITCOIN_QT_BIN` variable; the rest are for QT) - bitcoin/bitcoin#7954 - bitcoin/bitcoin#8314 - Only the second commit (first is for QT) - bitcoin/bitcoin#8504 - Only the first commit (second was undoing something we didn't have) - bitcoin/bitcoin#8520 - bitcoin/bitcoin#8563 - bitcoin/bitcoin#8249 - bitcoin/bitcoin#9156 - bitcoin/bitcoin#9831 - bitcoin/bitcoin#9789 - bitcoin/bitcoin#10766 Part of #2074.
kotodev
pushed a commit
to koto-dev/koto.old
that referenced
this pull request
Jan 25, 2018
Build system improvements Includes commits cherry-picked from the following upstream PRs: - bitcoin/bitcoin#6978 - Only the first commit (second is for QT) - bitcoin/bitcoin#7059 - bitcoin/bitcoin#7603 - Only the first commit (without the `BITCOIN_QT_BIN` variable; the rest are for QT) - bitcoin/bitcoin#7954 - bitcoin/bitcoin#8314 - Only the second commit (first is for QT) - bitcoin/bitcoin#8504 - Only the first commit (second was undoing something we didn't have) - bitcoin/bitcoin#8520 - bitcoin/bitcoin#8563 - bitcoin/bitcoin#8249 - bitcoin/bitcoin#9156 - bitcoin/bitcoin#9831 - bitcoin/bitcoin#9789 - bitcoin/bitcoin#10766 Part of #2074.
renium9
added a commit
to koto-dev/koto.old
that referenced
this pull request
Feb 6, 2018
Build system improvements Includes commits cherry-picked from the following upstream PRs: - bitcoin/bitcoin#6978 - Only the first commit (second is for QT) - bitcoin/bitcoin#7059 - bitcoin/bitcoin#7603 - Only the first commit (without the `BITCOIN_QT_BIN` variable; the rest are for QT) - bitcoin/bitcoin#7954 - bitcoin/bitcoin#8314 - Only the second commit (first is for QT) - bitcoin/bitcoin#8504 - Only the first commit (second was undoing something we didn't have) - bitcoin/bitcoin#8520 - bitcoin/bitcoin#8563 - bitcoin/bitcoin#8249 - bitcoin/bitcoin#9156 - bitcoin/bitcoin#9831 - bitcoin/bitcoin#9789 - bitcoin/bitcoin#10766 Part of #2074. # Conflicts: # configure.ac # src/Makefile.am # src/Makefile.gtest.include # src/Makefile.test.include # zcutil/build.sh
andvgal
pushed a commit
to energicryptocurrency/gen2-energi
that referenced
this pull request
Jan 6, 2019
laanwj
added a commit
that referenced
this pull request
May 14, 2020
eacedfb scripts: add additional type annotations to security-check.py (fanquake) 83d063e scripts: add run_command to security-check.py (fanquake) 13f606b scripts: remove NONFATAL from security-check.py (fanquake) 061acf6 scripts: no-longer check for 32 bit windows in security-check.py (fanquake) Pull request description: * Remove 32-bit Windows checks. * Remove NONFATAL checking. Added in #8249, however unused since #13764. * Add `run_command` to de-duplicate all of the subprocess calls. Mentioned in #18713. * Add additional type annotations. * Print stderr when there is an issue running a command. ACKs for top commit: laanwj: ACK eacedfb Tree-SHA512: 69a7ccfdf346ee202b3e8f940634c5daed1d2b5a5d15ac9800252866ba3284ec66e391a66a0b341f5a4e5e8482fe1b614d4671e8e766112ff059405081184a85
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #8248 for more information.