123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466 |
- From 133d73079c5771bbf3d8311281b6772846357ec1 Mon Sep 17 00:00:00 2001
- From: Chris Coulson <chris.coulson@canonical.com>
- Date: Tue, 1 Dec 2020 23:03:39 +0000
- Subject: [PATCH] kern/efi: Add initial stack protector implementation
- It works only on UEFI platforms but can be quite easily extended to
- others architectures and platforms if needed.
- Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
- Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
- Reviewed-by: Marco A Benatto <mbenatto@redhat.com>
- Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- acinclude.m4 | 38 ++++++++++++++++-
- configure | 97 +++++++++++++++++++++++++++++++++++++++---
- configure.ac | 44 ++++++++++++++++---
- grub-core/Makefile.am | 1 +
- grub-core/Makefile.in | 1 +
- grub-core/kern/efi/init.c | 54 +++++++++++++++++++++++
- include/grub/efi/api.h | 19 +++++++++
- include/grub/stack_protector.h | 30 +++++++++++++
- po/POTFILES.in | 1 +
- 9 files changed, 272 insertions(+), 13 deletions(-)
- create mode 100644 include/grub/stack_protector.h
- diff --git a/acinclude.m4 b/acinclude.m4
- index 78cdf6e..6e14bb5 100644
- --- a/acinclude.m4
- +++ b/acinclude.m4
- @@ -305,9 +305,9 @@ fi
- ])
-
-
- -dnl Check if the C compiler supports `-fstack-protector'.
- +dnl Check if the C compiler supports the stack protector
- AC_DEFUN([grub_CHECK_STACK_PROTECTOR],[
- -[# Smashing stack protector.
- +[# Stack smashing protector.
- ssp_possible=yes]
- AC_MSG_CHECKING([whether `$CC' accepts `-fstack-protector'])
- # Is this a reliable test case?
- @@ -324,6 +324,40 @@ else
- ssp_possible=no]
- AC_MSG_RESULT([no])
- [fi]
- +[# Strong stack smashing protector.
- +ssp_strong_possible=yes]
- +AC_MSG_CHECKING([whether `$CC' accepts `-fstack-protector-strong'])
- +# Is this a reliable test case?
- +AC_LANG_CONFTEST([AC_LANG_SOURCE([[
- +void foo (void) { volatile char a[8]; a[3]; }
- +]])])
- +[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
- +# `ac_compile' like this correct, after all?
- +if eval "$ac_compile -S -fstack-protector-strong -o conftest.s" 2> /dev/null; then]
- + AC_MSG_RESULT([yes])
- + [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
- + rm -f conftest.s
- +else
- + ssp_strong_possible=no]
- + AC_MSG_RESULT([no])
- +[fi]
- +[# Global stack smashing protector.
- +ssp_global_possible=yes]
- +AC_MSG_CHECKING([whether `$CC' accepts `-mstack-protector-guard=global'])
- +# Is this a reliable test case?
- +AC_LANG_CONFTEST([AC_LANG_SOURCE([[
- +void foo (void) { volatile char a[8]; a[3]; }
- +]])])
- +[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
- +# `ac_compile' like this correct, after all?
- +if eval "$ac_compile -S -fstack-protector -mstack-protector-guard=global -o conftest.s" 2> /dev/null; then]
- + AC_MSG_RESULT([yes])
- + [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
- + rm -f conftest.s
- +else
- + ssp_global_possible=no]
- + AC_MSG_RESULT([no])
- +[fi]
- ])
-
- dnl Check if the C compiler supports `-mstack-arg-probe' (Cygwin).
- diff --git a/configure b/configure
- index 9290ae8..973f702 100755
- --- a/configure
- +++ b/configure
- @@ -1778,6 +1778,7 @@ with_libintl_prefix
- with_libpth_prefix
- with_included_regex
- enable_efiemu
- +enable_stack_protector
- enable_mm_debug
- enable_cache_stats
- enable_boot_time
- @@ -2459,6 +2460,8 @@ Optional Features:
- --disable-rpath do not hardcode runtime library paths
- --enable-efiemu build and install the efiemu runtimes
- (default=guessed)
- + --enable-stack-protector
- + enable the stack protector
- --enable-mm-debug include memory manager debugging
- --enable-cache-stats enable disk cache statistics collection
- --enable-boot-time enable boot time statistics collection
- @@ -32348,9 +32351,9 @@ fi
-
- CFLAGS="$TARGET_CFLAGS"
-
- -# Smashing stack protector.
- +# Stack smashing protector.
-
- -# Smashing stack protector.
- +# Stack smashing protector.
- ssp_possible=yes
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-fstack-protector'" >&5
- $as_echo_n "checking whether \`$CC' accepts \`-fstack-protector'... " >&6; }
- @@ -32373,11 +32376,88 @@ else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
- $as_echo "no" >&6; }
- fi
- +# Strong stack smashing protector.
- +ssp_strong_possible=yes
- +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-fstack-protector-strong'" >&5
- +$as_echo_n "checking whether \`$CC' accepts \`-fstack-protector-strong'... " >&6; }
- +# Is this a reliable test case?
- +cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- +/* end confdefs.h. */
-
- -# Need that, because some distributions ship compilers that include
- -# `-fstack-protector' in the default specs.
- -if test "x$ssp_possible" = xyes; then
- - TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
- +void foo (void) { volatile char a[8]; a[3]; }
- +
- +_ACEOF
- +# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
- +# `ac_compile' like this correct, after all?
- +if eval "$ac_compile -S -fstack-protector-strong -o conftest.s" 2> /dev/null; then
- + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
- +$as_echo "yes" >&6; }
- + # Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
- + rm -f conftest.s
- +else
- + ssp_strong_possible=no
- + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
- +$as_echo "no" >&6; }
- +fi
- +# Global stack smashing protector.
- +ssp_global_possible=yes
- +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-mstack-protector-guard=global'" >&5
- +$as_echo_n "checking whether \`$CC' accepts \`-mstack-protector-guard=global'... " >&6; }
- +# Is this a reliable test case?
- +cat confdefs.h - <<_ACEOF >conftest.$ac_ext
- +/* end confdefs.h. */
- +
- +void foo (void) { volatile char a[8]; a[3]; }
- +
- +_ACEOF
- +# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
- +# `ac_compile' like this correct, after all?
- +if eval "$ac_compile -S -fstack-protector -mstack-protector-guard=global -o conftest.s" 2> /dev/null; then
- + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
- +$as_echo "yes" >&6; }
- + # Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
- + rm -f conftest.s
- +else
- + ssp_global_possible=no
- + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
- +$as_echo "no" >&6; }
- +fi
- +
- +# Check whether --enable-stack-protector was given.
- +if test "${enable_stack_protector+set}" = set; then :
- + enableval=$enable_stack_protector;
- +else
- + enable_stack_protector=no
- +fi
- +
- +if test "x$enable_stack_protector" = xno; then
- + if test "x$ssp_possible" = xyes; then
- + # Need that, because some distributions ship compilers that include
- + # `-fstack-protector' in the default specs.
- + TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
- + fi
- +elif test "x$platform" != xefi; then
- + as_fn_error $? "--enable-stack-protector is only supported on EFI platforms" "$LINENO" 5
- +elif test "x$ssp_global_possible" != xyes; then
- + as_fn_error $? "--enable-stack-protector is not supported (compiler doesn't support -mstack-protector-guard=global)" "$LINENO" 5
- +else
- + TARGET_CFLAGS="$TARGET_CFLAGS -mstack-protector-guard=global"
- + if test "x$enable_stack_protector" = xyes; then
- + if test "x$ssp_possible" != xyes; then
- + as_fn_error $? "--enable-stack-protector is not supported (compiler doesn't support -fstack-protector)" "$LINENO" 5
- + fi
- + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector"
- + elif test "x$enable_stack_protector" = xstrong; then
- + if test "x$ssp_strong_possible" != xyes; then
- + as_fn_error $? "--enable-stack-protector=strong is not supported (compiler doesn't support -fstack-protector-strong)" "$LINENO" 5
- + fi
- + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector-strong"
- + else
- + # Note, -fstack-protector-all requires that the protector is disabled for
- + # functions that appear in the call stack when the canary is initialized.
- + as_fn_error $? "invalid value $enable_stack_protector for --enable-stack-protector" "$LINENO" 5
- + fi
- + TARGET_CPPFLAGS="$TARGET_CPPFLAGS -DGRUB_STACK_PROTECTOR=1"
- fi
-
- CFLAGS="$TARGET_CFLAGS"
- @@ -37054,5 +37134,10 @@ echo "Without liblzma (no support for XZ-compressed mips images) ($liblzma_excus
- else
- echo "With liblzma from $LIBLZMA (support for XZ-compressed mips images)"
- fi
- +if test "x$enable_stack_protector" != xno; then
- +echo "With stack smashing protector: Yes"
- +else
- +echo "With stack smashing protector: No"
- +fi
- echo "*******************************************************"
-
- diff --git a/configure.ac b/configure.ac
- index 7656f24..bb6b02a 100644
- --- a/configure.ac
- +++ b/configure.ac
- @@ -1285,12 +1285,41 @@ fi]
-
- CFLAGS="$TARGET_CFLAGS"
-
- -# Smashing stack protector.
- +# Stack smashing protector.
- grub_CHECK_STACK_PROTECTOR
- -# Need that, because some distributions ship compilers that include
- -# `-fstack-protector' in the default specs.
- -if test "x$ssp_possible" = xyes; then
- - TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
- +AC_ARG_ENABLE([stack-protector],
- + AS_HELP_STRING([--enable-stack-protector],
- + [enable the stack protector]),
- + [],
- + [enable_stack_protector=no])
- +if test "x$enable_stack_protector" = xno; then
- + if test "x$ssp_possible" = xyes; then
- + # Need that, because some distributions ship compilers that include
- + # `-fstack-protector' in the default specs.
- + TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
- + fi
- +elif test "x$platform" != xefi; then
- + AC_MSG_ERROR([--enable-stack-protector is only supported on EFI platforms])
- +elif test "x$ssp_global_possible" != xyes; then
- + AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -mstack-protector-guard=global)])
- +else
- + TARGET_CFLAGS="$TARGET_CFLAGS -mstack-protector-guard=global"
- + if test "x$enable_stack_protector" = xyes; then
- + if test "x$ssp_possible" != xyes; then
- + AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -fstack-protector)])
- + fi
- + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector"
- + elif test "x$enable_stack_protector" = xstrong; then
- + if test "x$ssp_strong_possible" != xyes; then
- + AC_MSG_ERROR([--enable-stack-protector=strong is not supported (compiler doesn't support -fstack-protector-strong)])
- + fi
- + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector-strong"
- + else
- + # Note, -fstack-protector-all requires that the protector is disabled for
- + # functions that appear in the call stack when the canary is initialized.
- + AC_MSG_ERROR([invalid value $enable_stack_protector for --enable-stack-protector])
- + fi
- + TARGET_CPPFLAGS="$TARGET_CPPFLAGS -DGRUB_STACK_PROTECTOR=1"
- fi
-
- CFLAGS="$TARGET_CFLAGS"
- @@ -2103,5 +2132,10 @@ echo "Without liblzma (no support for XZ-compressed mips images) ($liblzma_excus
- else
- echo "With liblzma from $LIBLZMA (support for XZ-compressed mips images)"
- fi
- +if test "x$enable_stack_protector" != xno; then
- +echo "With stack smashing protector: Yes"
- +else
- +echo "With stack smashing protector: No"
- +fi
- echo "*******************************************************"
- ]
- diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
- index 30e23ad..ee88e44 100644
- --- a/grub-core/Makefile.am
- +++ b/grub-core/Makefile.am
- @@ -90,6 +90,7 @@ endif
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h
- +KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/stack_protector.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h
- KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/verify.h
- diff --git a/grub-core/Makefile.in b/grub-core/Makefile.in
- index 1f8133b..50c70b5 100644
- --- a/grub-core/Makefile.in
- +++ b/grub-core/Makefile.in
- @@ -16425,6 +16425,7 @@ KERNEL_HEADER_FILES = $(top_srcdir)/include/grub/cache.h \
- $(am__append_5795) $(top_srcdir)/include/grub/mm.h \
- $(top_srcdir)/include/grub/parser.h \
- $(top_srcdir)/include/grub/partition.h \
- + $(top_srcdir)/include/grub/stack_protector.h \
- $(top_srcdir)/include/grub/term.h \
- $(top_srcdir)/include/grub/time.h \
- $(top_srcdir)/include/grub/verify.h \
- diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
- index 1333465..7facacf 100644
- --- a/grub-core/kern/efi/init.c
- +++ b/grub-core/kern/efi/init.c
- @@ -27,6 +27,58 @@
- #include <grub/env.h>
- #include <grub/mm.h>
- #include <grub/kernel.h>
- +#include <grub/stack_protector.h>
- +
- +#ifdef GRUB_STACK_PROTECTOR
- +
- +static grub_efi_guid_t rng_protocol_guid = GRUB_EFI_RNG_PROTOCOL_GUID;
- +
- +/*
- + * Don't put this on grub_efi_init()'s local stack to avoid it
- + * getting a stack check.
- + */
- +static grub_efi_uint8_t stack_chk_guard_buf[32];
- +
- +grub_addr_t __stack_chk_guard;
- +
- +void __attribute__ ((noreturn))
- +__stack_chk_fail (void)
- +{
- + /*
- + * Assume it's not safe to call into EFI Boot Services. Sorry, that
- + * means no console message here.
- + */
- + do
- + {
- + /* Do not optimize out the loop. */
- + asm volatile ("");
- + }
- + while (1);
- +}
- +
- +static void
- +stack_protector_init (void)
- +{
- + grub_efi_rng_protocol_t *rng;
- +
- + /* Set up the stack canary. Make errors here non-fatal for now. */
- + rng = grub_efi_locate_protocol (&rng_protocol_guid, NULL);
- + if (rng != NULL)
- + {
- + grub_efi_status_t status;
- +
- + status = efi_call_4 (rng->get_rng, rng, NULL, sizeof (stack_chk_guard_buf),
- + stack_chk_guard_buf);
- + if (status == GRUB_EFI_SUCCESS)
- + grub_memcpy (&__stack_chk_guard, stack_chk_guard_buf, sizeof (__stack_chk_guard));
- + }
- +}
- +#else
- +static void
- +stack_protector_init (void)
- +{
- +}
- +#endif
-
- grub_addr_t grub_modbase;
-
- @@ -38,6 +90,8 @@ grub_efi_init (void)
- messages. */
- grub_console_init ();
-
- + stack_protector_init ();
- +
- /* Initialize the memory management system. */
- grub_efi_mm_init ();
-
- diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h
- index 13e5715..5517f7e 100644
- --- a/include/grub/efi/api.h
- +++ b/include/grub/efi/api.h
- @@ -339,6 +339,11 @@
- { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } \
- }
-
- +#define GRUB_EFI_RNG_PROTOCOL_GUID \
- + { 0x3152bca5, 0xeade, 0x433d, \
- + { 0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 } \
- + }
- +
- struct grub_efi_sal_system_table
- {
- grub_uint32_t signature;
- @@ -1700,6 +1705,20 @@ struct grub_efi_shim_lock_protocol
- };
- typedef struct grub_efi_shim_lock_protocol grub_efi_shim_lock_protocol_t;
-
- +typedef grub_efi_guid_t grub_efi_rng_algorithm_t;
- +
- +struct grub_efi_rng_protocol
- +{
- + grub_efi_status_t (*get_info) (struct grub_efi_rng_protocol *this,
- + grub_efi_uintn_t *rng_algorithm_list_size,
- + grub_efi_rng_algorithm_t *rng_algorithm_list);
- + grub_efi_status_t (*get_rng) (struct grub_efi_rng_protocol *this,
- + grub_efi_rng_algorithm_t *rng_algorithm,
- + grub_efi_uintn_t rng_value_length,
- + grub_efi_uint8_t *rng_value);
- +};
- +typedef struct grub_efi_rng_protocol grub_efi_rng_protocol_t;
- +
- #if (GRUB_TARGET_SIZEOF_VOID_P == 4) || defined (__ia64__) \
- || defined (__aarch64__) || defined (__MINGW64__) || defined (__CYGWIN__) \
- || defined(__riscv)
- diff --git a/include/grub/stack_protector.h b/include/grub/stack_protector.h
- new file mode 100644
- index 0000000..c88dc00
- --- /dev/null
- +++ b/include/grub/stack_protector.h
- @@ -0,0 +1,30 @@
- +/*
- + * GRUB -- GRand Unified Bootloader
- + * Copyright (C) 2021 Free Software Foundation, Inc.
- + *
- + * GRUB is free software: you can redistribute it and/or modify
- + * it under the terms of the GNU General Public License as published by
- + * the Free Software Foundation, either version 3 of the License, or
- + * (at your option) any later version.
- + *
- + * GRUB is distributed in the hope that it will be useful,
- + * but WITHOUT ANY WARRANTY; without even the implied warranty of
- + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- + * GNU General Public License for more details.
- + *
- + * You should have received a copy of the GNU General Public License
- + * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
- + */
- +
- +#ifndef GRUB_STACK_PROTECTOR_H
- +#define GRUB_STACK_PROTECTOR_H 1
- +
- +#include <grub/symbol.h>
- +#include <grub/types.h>
- +
- +#ifdef GRUB_STACK_PROTECTOR
- +extern grub_addr_t EXPORT_VAR (__stack_chk_guard);
- +extern void __attribute__ ((noreturn)) EXPORT_FUNC (__stack_chk_fail) (void);
- +#endif
- +
- +#endif /* GRUB_STACK_PROTECTOR_H */
- diff --git a/po/POTFILES.in b/po/POTFILES.in
- index 7753ab4..ef42c7d 100644
- --- a/po/POTFILES.in
- +++ b/po/POTFILES.in
- @@ -1319,6 +1319,7 @@
- ./include/grub/sparc64/time.h
- ./include/grub/sparc64/types.h
- ./include/grub/speaker.h
- +./include/grub/stack_protector.h
- ./include/grub/symbol.h
- ./include/grub/syslinux_parse.h
- ./include/grub/term.h
- --
- 2.14.2
|