Project

General

Profile

Actions

Feature #13274

closed

enable -fstack-protector-strong by default in user land

Added by Robert Mustacchi 7 months ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Category:
lib - userland libraries
Start date:
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:

Description

It is long past time for -fstack-protector-strong to be enabled by default in user land in the build. This goes through and enables this across the entire user land stack with a few exceptions to deal with bootstrapping and other minor challenges. In particular, if this had been enabled, it would have at least caught #13242 (I explicitly tested that).

The current exceptions are as follows:
  • rtld (and as a side effect libc and libconv) due to bootstrapping issues around enabling the guard
  • kmdb as it needs its own implementation of the stack protector and can't really use the kernel's
  • The kmdb standalone versions of libdis, libctf, and libumem which are only used for kmdb.
  • DTrace's drti.o which would require other objects to need ssp_ns that wouldn't in and of itself know to

The above can all be dealt with other work over time, the highest value would be enabling libc; however, that's no reason to stop getting basically all of the rest of userland enabled.

As part of doing this work, I discovered a lot of bugs in the build system which will be linked as blockers on this ticket.


Related issues

Related to illumos gate - Bug #13324: struct dk_minfo_ext size differences trigger SSP in libfdiskClosed

Actions
Related to illumos gate - Bug #13562: zlogin for Solaris10 branded zones does not work after implementation of Feature #13274ClosedKlaus Ziegler

Actions
Blocked by illumos gate - Feature #5788: Want support for GCC's stack protector in libcClosedRobert Mustacchi2015-04-03

Actions
Blocked by illumos gate - Bug #13260: librtld_db demo should be built separatelyClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13261: libdbus-1 deps missing libbsmClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13262: rcm_daemon missing library search pathsClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13263: startd needs to search $(ROOT)/usr/lib/fm for depsClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13264: perl Makefiles place object files after librariesClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13265: libmp.so.1 missing library search pathClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13266: mdb build tools should use native toolsClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13267: tools libld build picks up normal sgs libsClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13268: lp native build forgot CFLAGSClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13269: esc needs a native buildClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13270: cmd/spell native build incompleteClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13271: 64-bit crypto tests have wrong library search pathClosedRobert Mustacchi

Actions
Blocked by illumos gate - Bug #13272: 64-bit secflags test has wrong ldlibsClosedRobert Mustacchi

Actions
Actions

Also available in: Atom PDF