Hardening options for C and C++ in Slackware

teoberi · 12-22-2023, 04:40 AM

A good script!

I tested it on a test server and it found issues for:
llvm-17.0.6-x86_64-1
ruby-3.2.2-x86_64-1

teoberi · 12-25-2023, 12:32 PM

Bind (build from official Slackware source)
https://www.linuxquestions.org/quest...0/#post6472478

teoberi · 12-25-2023, 12:32 PM

python-PyYAML (build from official Slackware source)

Code:

CFLAGS="-fPIC -fstack-protector-strong" CXXFLAGS="-fPIC -fstack-protector-strong" LDFLAGS="-Wl,-z,now,-s" python3 setup.py install --root=$PKG || exit 1

Quote:

-pie shouldn't be used when you are trying to create only shared library

teoberi · 12-25-2023, 01:37 PM

iucode_tool (build from SlackBuilds)

Code:

CPPFLAGS="-O2 -D_FORTIFY_SOURCE=2"
CFLAGS="-fPIE -fstack-protector-strong"
LDFLAGS="-Wl,-pie,-z,now"

Observation
CXXFLAGS does not appear anywhere in the documentation or in the command output:

Code:

./configure --help

Quote:

Some influential environment variables:
CC C compiler command
CFLAGS C compiler flags
LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a
nonstandard directory <lib dir>
LIBS libraries to pass to the linker, e.g. -l<library>
CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I<include dir> if
you have headers in a nonstandard directory <include dir>
CPP C preprocessor

Use these variables to override the choices made by `configure' or to help
it to find libraries and programs with nonstandard names/locations.

It can be built without it.

Code:

checksec --file=/usr/sbin/iucode_tool

Code:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols        Yes   2               7               /usr/sbin/iucode_tool

rkomar · 12-25-2023, 03:15 PM

What's the point of hardening every executable in the distribution? I can see that those that run as root or that get arbitrary input from the network could use hardening, but the vast majority of executables just run under the user's identity. I don't think that stack smashing the latter would get you any special privileges.

teoberi · 12-26-2023, 11:13 AM

Simple, as in real life, everything depends on the chosen security options.

At home, you can opt for the installation of a security system for the whole house, only for certain parts or not at all.
In the business environment, I don't think you can afford to neglect security.
Analogy:
home = home PC
business = business workstation/server
In the first post of this thread, there is a link to a document related to this aspect made by representatives from Ericsson, Intel, Linux Foundation, IBM, Micro$oft, Google, Canonical (Ubuntu), RHEL, etc in section 7. Contributors. Also, section 10. References is quite extensive.
The GNU Compiler Collection (GCC) has specific options for these hardening flags which, if enabled when compiling the compiler, become default when using the compiler executable thus generated (section 2.2. What should you do when compiling compilers?).
In section 3. Recommended Compiler Options there are links related to this topic from major Linux distributions such as Debian, Gentoo, Fedora, OpenSUSE and Ubuntu.
If we were discussing how difficult it would be to do this with the two possible solutions:
1. compiling the compiler with these options to become default (there will be cases of packages that do not compile and will have to be modified manually);
2. compiling each package with manual setting of these flags.
Both variants require a lot of effort and a lot of testing, but other distributions have already done it. Even for distributions that have package maintainers (e.g. Debian) this took quite a long time but it was done.

teoberi · 12-26-2023, 11:13 AM

Simple, as in real life, everything depends on the chosen security options.

At home, you can opt for the installation of a security system for the whole house, only for certain parts or not at all.
In the business environment, I don't think you can afford to neglect security.
Analogy:
home = home PC
business = business workstation/server
In the first post of this thread, there is a link to a document related to this aspect made by representatives from Ericsson, Intel, Linux Foundation, IBM, Micro$oft, Google, Canonical (Ubuntu), RHEL, etc in section 7. Contributors. Also, section 10. References is quite extensive.
The GNU Compiler Collection (GCC) has specific options for these hardening flags which, if enabled when compiling the compiler, become default when using the compiler executable thus generated (section 2.2. What should you do when compiling compilers?).
In section 3. Recommended Compiler Options there are links related to this topic from major Linux distributions such as Debian, Gentoo, Fedora, OpenSUSE and Ubuntu.
If we were discussing how difficult it would be to do this with the two possible solutions:
1. compiling the compiler with these options to become default (there will be cases of packages that do not compile and will have to be modified manually);
2. compiling each package with manual setting of these flags.
Both variants require a lot of effort and a lot of testing, but other distributions have already done it. Even for distributions that have package maintainers (e.g. Debian) this took quite a long time but it was done.

teoberi · 12-26-2023, 01:56 PM

Duplicate post, I have no idea why?
I had no intention of repeating anything.

If I delete it, both are deleted.

dhalliwe · 12-26-2023, 03:15 PM

Quote:

Duplicate post, I have no idea why?

Similar thing happened to someone else a few weeks ago. If you look at the comment numbers on the right (#36 and #37) they have the exact same link.

teoberi · 12-27-2023, 12:07 AM

Maybe what I wrote seemed important to the forum and thought to repeat the post.

teoberi · 12-28-2023, 03:29 AM

Apache (build from official Slackware source)

Code:

CPPFLAGS="-O2 -D_FORTIFY_SOURCE=2"
CFLAGS="-fPIC -fstack-protector-strong"
LDFLAGS="-Wl,-z,now,--enable-new-dtags"

Additional:
Fix for build with libxml2-2.12.3
https://github.com/apache/httpd/pull/393/files

BrunoLafleur · 12-28-2023, 04:14 AM

Since glibc 2.34 and GCC 12, there has been a new fortification level (_FORTIFY_SOURCE=3).

Here for example :
https://developers.redhat.com/articl...size_detection

GazL · 12-28-2023, 05:01 AM

Quote:

Originally Posted by teoberi

Apache (build from official SlackBuilds)

Code:

CPPFLAGS="-O2 -D_FORTIFY_SOURCE=2"
CFLAGS="-fPIC -fstack-protector-strong"
LDFLAGS="-Wl,-z,now,--enable-new-dtags"

Additional:
Fix for build with libxml2-2.12.3
https://github.com/apache/httpd/pull/393/files

Bit pedantic, but...
-O2 is not a pre-processor option. It belongs in CFLAGS not CPPFLAGS.

teoberi · 12-28-2023, 05:11 AM

Quote:

Originally Posted by GazL

Bit pedantic, but...
-O2 is not a pre-processor option. It belongs in CFLAGS not CPPFLAGS.

Try to compile one of the packages presented by me in Slackware with CPPFLAGS without "O2".
I received a compilation error stating this.
I will still study the problem and I will come back.

So far I have found this
https://steveyang.blog/en/tag/how-to...ization-level/
and:
https://developers.redhat.com/articl...d_shadow_stack
https://bbs.archlinux.org/viewtopic.php?id=225086
https://lists.gnu.org/archive/html/a.../msg00003.html
https://lists.archlinux.org/pipermai...il/024776.html

teoberi · 12-28-2023, 05:19 AM

Quote:

Originally Posted by BrunoLafleur

Since glibc 2.34 and GCC 12, there has been a new fortification level (_FORTIFY_SOURCE=3).

Here for example :
https://developers.redhat.com/articl...size_detection

Yes, and it is highly recommended for test compilation.
An example for Clamav on my last Pull Request.
https://github.com/Cisco-Talos/clama...cks#step:9:240
In the document from the first post of this thread it appears:

Quote:

_FORTIFY_SOURCE is recommended for all applications that depend on glibc and should be widely deployed. Most packages in all major Linux distributions enable at least _FORTIFY_SOURCE=2 and some even enable _FORTIFY_SOURCE=3.

However, things are constantly moving and Ubuntu will also make the transition to "3" in 2024.
https://bugs.launchpad.net/ubuntu/+s...3/+bug/2012440

There has been some discussion in this thread about using these hardening options.

I found in the previous link the reference to:
https://github.com/jvoisin/compiler-flags-distro
The respective document presents the status of the implementation of these options for several distributions of Linux, Android and Google Chrome.
It is a bit difficult to read the document because of the scroll bars, but I am attaching it in Adobe Acrobat Reader format.

teoberi · 01-01-2024, 03:38 AM

GRUB 2.12 (build from official Slackware source)

Code:

CPPFLAGS="-O2 -D_FORTIFY_SOURCE=2"
HOST_CFLAGS="-fstack-protector-strong"
LDFLAGS="-Wl,-z,now"

Remarks
1. Stack canary "-fstack-protector" (-fstack-protector!=-fstack-protector-strong) can be enabled by default through the "--enable-stack-protector" configuration option, but only for *-efi architectures by modifying grub.SlackBuild, something already done by Didier Spaier here.
2. Build as position-independent code (-fPIE -pie) is disabled by the GRUB maintainers in the configure.ac file, but Fedora and Ubuntu (as examples) have changed this.

Code:

checksec --file=usr/sbin/grub2-install-fedora

Code:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols        No    0               19              usr/sbin/grub2-install-fedora

Code:

checksec --file=/tmp/2/grub-probe-fedora

Code:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols        Yes   8               24              /tmp/2/grub-probe-fedora

Code:

checksec --file=/tmp/2/grub-probe-ubuntu

Code:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   No Symbols        Yes   8               24              /tmp/2/grub-probe-ubuntu

I updated GRUB 2.06 to 2.12 in VirtualBox with the hardening options above and it works.
I will test the configuration for a few days and then when GRUB comes out of "testing" I will apply it to the production servers.