Skip to content

Commit 62b0213

Browse files
kwvgkwvg
committed
merge bitcoin#27999: add macOS test for fixup_chains usage
1 parent be17509 commit 62b0213

File tree

4 files changed

+49
-12
lines changed

4 files changed

+49
-12
lines changed

‎contrib/devtools/security-check.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,12 @@ def check_MACHO_NOUNDEFS(binary) -> bool:
158158
'''
159159
return binary.header.has(lief.MachO.HEADER_FLAGS.NOUNDEFS)
160160

161+
def check_MACHO_FIXUP_CHAINS(binary) -> bool:
162+
'''
163+
Check for use of chained fixups.
164+
'''
165+
return binary.has_dyld_chained_fixups
166+
161167
def check_MACHO_Canary(binary) -> bool:
162168
'''
163169
Check for use of stack canary
@@ -208,6 +214,7 @@ def check_MACHO_control_flow(binary) -> bool:
208214
BASE_MACHO = [
209215
('NOUNDEFS', check_MACHO_NOUNDEFS),
210216
('Canary', check_MACHO_Canary),
217+
('FIXUP_CHAINS', check_MACHO_FIXUP_CHAINS),
211218
]
212219

213220
CHECKS = {

‎contrib/devtools/test-security-check.py‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -119,27 +119,31 @@ def test_MACHO(self):
119119
arch = get_arch(cc, source, executable)
120120

121121
if arch == lief.ARCHITECTURES.X86:
122-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector']),
122+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-no_fixup_chains']),
123+
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS PIE NX CONTROL_FLOW'))
124+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector', '-Wl,-fixup_chains']),
123125
(1, executable+': failed NOUNDEFS Canary PIE NX CONTROL_FLOW'))
124-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fstack-protector-all']),
126+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fstack-protector-all', '-Wl,-fixup_chains']),
125127
(1, executable+': failed NOUNDEFS PIE NX CONTROL_FLOW'))
126-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-fstack-protector-all']),
128+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains']),
127129
(1, executable+': failed NOUNDEFS PIE CONTROL_FLOW'))
128-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all']),
130+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-fstack-protector-all', '-Wl,-fixup_chains']),
129131
(1, executable+': failed PIE CONTROL_FLOW'))
130-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all']),
132+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-Wl,-fixup_chains']),
131133
(1, executable+': failed PIE CONTROL_FLOW'))
132-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full']),
134+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
133135
(1, executable+': failed PIE'))
134-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full']),
136+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-pie','-Wl,-bind_at_load','-fstack-protector-all', '-fcf-protection=full', '-Wl,-fixup_chains']),
135137
(0, ''))
136138
else:
137139
# arm64 darwin doesn't support non-PIE binaries, control flow or executable stacks
138-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector']),
140+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-no_fixup_chains']),
141+
(1, executable+': failed NOUNDEFS Canary FIXUP_CHAINS'))
142+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fno-stack-protector', '-Wl,-fixup_chains']),
139143
(1, executable+': failed NOUNDEFS Canary'))
140-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fstack-protector-all']),
144+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-flat_namespace','-fstack-protector-all', '-Wl,-fixup_chains']),
141145
(1, executable+': failed NOUNDEFS'))
142-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-bind_at_load','-fstack-protector-all']),
146+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-bind_at_load','-fstack-protector-all', '-Wl,-fixup_chains']),
143147
(0, ''))
144148

145149

‎depends/packages/native_cctools.mk‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ $(package)_file_name=$($(package)_version).tar.gz
55
$(package)_sha256_hash=6b73269efdf5c58a070e7357b66ee760501388549d6a12b423723f45888b074b
66
$(package)_build_subdir=cctools
77
$(package)_dependencies=native_libtapi
8+
$(package)_patches=no_fixup_chains.patch
89

910
define $(package)_set_vars
1011
$(package)_config_opts=--target=$(host) --enable-lto-support
@@ -18,11 +19,13 @@ ifneq ($(strip $(FORCE_USE_SYSTEM_CLANG)),)
1819
define $(package)_preprocess_cmds
1920
mkdir -p $($(package)_staging_prefix_dir)/lib && \
2021
cp $(llvm_lib_dir)/libLTO.so $($(package)_staging_prefix_dir)/lib/ && \
21-
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools
22+
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools && \
23+
patch -p1 < $($(package)_patch_dir)/no_fixup_chains.patch
2224
endef
2325
else
2426
define $(package)_preprocess_cmds
25-
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools
27+
cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub cctools && \
28+
patch -p1 < $($(package)_patch_dir)/no_fixup_chains.patch
2629
endef
2730
endif
2831

‎depends/patches/native_cctools/no_fixup_chains.patch‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
commit 5860b35ff6c7241d1c35a1b3197b45e5c9ff86cf
2+
Author: fanquake <[email protected]>
3+
Date: Thu Jun 29 11:52:43 2023 +0100
4+
5+
ld64: add support for -no_fixup_chains
6+
7+
This is added in later versions, and is required if we want to be able
8+
to disable fixup_chains, for use in security tests.
9+
10+
diff --git a/cctools/ld64/src/ld/Options.cpp b/cctools/ld64/src/ld/Options.cpp
11+
index 15e8e88..b6580af 100644
12+
--- a/cctools/ld64/src/ld/Options.cpp
13+
+++ b/cctools/ld64/src/ld/Options.cpp
14+
@@ -4128,6 +4128,9 @@ void Options::parse(int argc, const char* argv[])
15+
else if ( strcmp(arg, "-fixup_chains") == 0 ) {
16+
fMakeChainedFixups = true;
17+
}
18+
+ else if ( strcmp(arg, "-no_fixup_chains") == 0 ) {
19+
+ fMakeChainedFixups = false;
20+
+ }
21+
else if (strcmp(arg, "-debug_variant") == 0) {
22+
fDebugVariant = true;
23+
}

0 commit comments

Comments
 (0)