No edit summary |
No edit summary |
||
Line 116: | Line 116: | ||
---------------------------------------------------- | ---------------------------------------------------- | ||
== How To Test == | |||
<!-- This does not need to be a full-fledged document. Describe the dimensions of tests that this change implementation is expected to pass when it is done. If it needs to be tested with different hardware or software configurations, indicate them. The more specific you can be, the better the community testing can be. | |||
Remember that you are writing this how to for interested testers to use to check out your change implementation - documenting what you do for testing is OK, but it's much better to document what *I* can do to test your change. | |||
A good "how to test" should answer these four questions: | |||
0. What special hardware / data / etc. is needed (if any)? | |||
1. How do I prepare my system to test this change? What packages | |||
need to be installed, config files edited, etc.? | |||
2. What specific actions do I perform to check that the change is | |||
working like it's supposed to? | |||
3. What are the expected results of those actions? | |||
--> | |||
# Running checksec should always report only | |||
<code>Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH</code> | |||
otherwise a tracking bug should exist for the respective packages. All packages need to be tested as usual for normal behaviour. | |||
=== Troubleshooting steps for package maintainers === | === Troubleshooting steps for package maintainers === | ||
Line 176: | Line 195: | ||
== Upgrade/compatibility impact == | == Upgrade/compatibility impact == | ||
This should not cause problems with upgrades. | This should not cause problems with upgrades. | ||
== User Experience == | == User Experience == |
Revision as of 00:30, 1 April 2015
Harden All Packages
Summary
In Fedora 22 and before, it was up to the package maintainer to add %global _hardened_build 1
to their spec file to ensure their program was hardened. Beginning with Fedora 23 this will now become the defaults for all packages. You can compare the security by running the following as root:
yum install checksec
checksec --proc-all
To see the mitigations in the libraries that a process is using, find the process id from the previous command (for example 123):
checksec --proc-libs 123
Owner
- Name: Till Maas | Moez Roy | Florian Weimer
- Email: opensource@till.name | moez.roy@gmail.com | fweimer@redhat.com
Current status
- Targeted release:
Fedora 22Fedora 23 - Last updated: 2015-02-12
- Tracker bug: Build failures tracker bug
Detailed Description
Currently, the Packaging Guidelines allow maintainers to decide whether their packages use position-independent code (PIC). There are rules that say that a lot of packages should use PIC, but in reality a lot of packages do not use PIC even if they must. Also since a lot of packages if not all potentially process untrusted input, it makes sense for these packages to use PIC to enhance the security of Fedora. Therefore I propose to build all packages with PIC by changing RPM to use the appropriate flags by default.
Implementation (done): Change line 130 in redhat-rpm-config macros from #_hardened_build 0 to %_hardened_build 1
References:
- https://fedorahosted.org/fesco/ticket/1384
- https://fedorahosted.org/fesco/ticket/1113 (older attempt with many references)
- https://fedorahosted.org/rel-eng/ticket/6049
- There should be several mails about this on the devel list
- Build failures tracker bug
Detailed Harden Flags Description
The following only deals with flags added by this proposal. It does not mention existing hardening flags such as the -fstack-protector-strong compiler flag or the -z relro linker flag.
This table shows the required compiler and linker flags with and without full ASLR support. The flags are described from the perspective of the gcc or g++ compiler driver, so linker flags (for ld) are prefixed with -Wl.
Non-hardening | Hardening | |
Compile for static linking | (nothing) | -fPIE |
Link executable | (nothing) | -pie -Wl,-z,now |
Compile for dynamic linking | -fPIC | -fPIC |
Link shared object | -shared | -shared -Wl,-z,now |
The key change is that for PIE builds, compilation for static linking (such as object files which go into the main program, not a library) needs the flag -fPIE. But this flag must not be included when compiling for dynamic linking because the resulting object code is not compatible with that. To repeat, you should not specify both -fpic and -fpie on the same command line because this rarely has the intended effect.
For both hardened and non-hardened builds, it is possible to compile everything with -fPIC -pie. This can simplify injecting the flags into the build process.
Alternatively, you can rely on the RPM-provided compiler and linker flag settings. In Fedora 23, this will enable additional GCC specs files (which are not related to RPM spec files), altering the compiler driver behavior in the following way:
- If there is no -fPIC-style flag on the command line, the source file is compiled as if -fPIE were specified.
- If there is no -shared flag on the command line, the program is linked with -pie.
- -z now is always passed to the linker.
This happens by injection CFLAGS, CXXFLAGS, and LDFLAGS environment variables in the invocation of the %configure RPM macro. Details are in the /usr/lib/rpm/redhat/macros file. (In previous Fedora releases, this only happened when the _hardended_build RPM macro was set to 1 in the spec file.)
In effect, this maps the non-hardening column to the hardening column in the table above.
Copy relocations support in GCC 5 and binutils 2.26 makes the performance on x86_64 of PIE literally zero for many programs.
redhat-hardened-cc1 *cc1_options: + %{!fpie:%{!fPIE:%{!fpic:%{!fPIC:%{!fno-pic:-fPIE}}}}}
redhat-hardened-ld *self_spec: + %{!shared:-pie} *link: + -z now
How To Test
- Running checksec should always report only
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH
otherwise a tracking bug should exist for the respective packages. All packages need to be tested as usual for normal behaviour.
Troubleshooting steps for package maintainers
1. Add %global _hardened_build 1
and build your package against F21. As F21 uses GCC 4.9.2, older binutils, older glibc etc. you will be able to identify whether the build failure is caused by GCC5, the newer binutils, the new glibc etc..
2. If you get linker errors, you can try disabling -z now
by putting the following under the %build
section of your spec file:
CFLAGS="$RPM_OPT_FLAGS -Wl,-z,lazy" CXXFLAGS="$RPM_OPT_FLAGS -Wl,-z,lazy" export CFLAGS export CXXFLAGS
3a. Check whether it builds successfully if you disable the hardening change:
%undefine _hardened_build
3b. Enable only PIE manually for your package:
CFLAGS="$RPM_OPT_FLAGS -fPIC -pie" CXXFLAGS="$RPM_OPT_FLAGS -fPIC -pie" export CFLAGS export CXXFLAGS
3c. Enable only -z now manually for your package:
CFLAGS="$RPM_OPT_FLAGS -Wl,-z,relro -Wl,-z,now" CXXFLAGS="$RPM_OPT_FLAGS -Wl,-z,relro -Wl,-z,now" export CFLAGS export CXXFLAGS
3d. Enable 3b and 3c above manually for your package:
CFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now" CXXFLAGS="$RPM_OPT_FLAGS -fPIC -pie -Wl,-z,relro -Wl,-z,now" export CFLAGS export CXXFLAGS
Benefit to Fedora
Packages in Fedora will be more secure than in other distributions or packages provided by upstream. Therefore our users less likely become victims of attacks. Fedora will use more state-of-the-art security mechanisms to fulfill its first and features foundations.
Scope
- Proposal owners:
Help writing the new packaging guidelines.
- Other developers:
Change the rpm macros to build packages by default with PIC/PIE flags (i.e. set _hardened_package to 1 by default). Bug report: https://bugzilla.redhat.com/show_bug.cgi?id=1192183
- Release engineering:
Do a mass rebuild for all arch packages
- Policies and guidelines:
Adjust the Packaging Guidelines to allow non-PIC packages only if the package is not working otherwise and require a tracker bug similar to packages not working on certain archs. Update the Guidelines to reflect the new defaults.
Upgrade/compatibility impact
This should not cause problems with upgrades.
User Experience
Fedora users might notice less sucessful attacks on their systems.
Dependencies
The rpm macros for Fedora need to be adjusted. Prelink might be retired.
Contingency Plan
- Contingency mechanism: Rebuild packages only that do not work because of this without PIC.
- More Details: Rel-Eng will add '%undefine _hardened_build' to the top of the spec file for packages that fail to build.
- Contingency deadline: beta freeze
- Blocks release? No
Documentation
The current packaging guidelines can be consulted.
Release Notes
Fedora now hardens as much packages as possible with position-independent code to reduce the impact of certain potential security vulnerabilities.