0133-kern-efi-Add-initial-stack-protector-implementation.patch 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466
  1. From 133d73079c5771bbf3d8311281b6772846357ec1 Mon Sep 17 00:00:00 2001
  2. From: Chris Coulson <chris.coulson@canonical.com>
  3. Date: Tue, 1 Dec 2020 23:03:39 +0000
  4. Subject: [PATCH] kern/efi: Add initial stack protector implementation
  5. It works only on UEFI platforms but can be quite easily extended to
  6. others architectures and platforms if needed.
  7. Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
  8. Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
  9. Reviewed-by: Marco A Benatto <mbenatto@redhat.com>
  10. Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. acinclude.m4 | 38 ++++++++++++++++-
  14. configure | 97 +++++++++++++++++++++++++++++++++++++++---
  15. configure.ac | 44 ++++++++++++++++---
  16. grub-core/Makefile.am | 1 +
  17. grub-core/Makefile.in | 1 +
  18. grub-core/kern/efi/init.c | 54 +++++++++++++++++++++++
  19. include/grub/efi/api.h | 19 +++++++++
  20. include/grub/stack_protector.h | 30 +++++++++++++
  21. po/POTFILES.in | 1 +
  22. 9 files changed, 272 insertions(+), 13 deletions(-)
  23. create mode 100644 include/grub/stack_protector.h
  24. diff --git a/acinclude.m4 b/acinclude.m4
  25. index 78cdf6e..6e14bb5 100644
  26. --- a/acinclude.m4
  27. +++ b/acinclude.m4
  28. @@ -305,9 +305,9 @@ fi
  29. ])
  30. -dnl Check if the C compiler supports `-fstack-protector'.
  31. +dnl Check if the C compiler supports the stack protector
  32. AC_DEFUN([grub_CHECK_STACK_PROTECTOR],[
  33. -[# Smashing stack protector.
  34. +[# Stack smashing protector.
  35. ssp_possible=yes]
  36. AC_MSG_CHECKING([whether `$CC' accepts `-fstack-protector'])
  37. # Is this a reliable test case?
  38. @@ -324,6 +324,40 @@ else
  39. ssp_possible=no]
  40. AC_MSG_RESULT([no])
  41. [fi]
  42. +[# Strong stack smashing protector.
  43. +ssp_strong_possible=yes]
  44. +AC_MSG_CHECKING([whether `$CC' accepts `-fstack-protector-strong'])
  45. +# Is this a reliable test case?
  46. +AC_LANG_CONFTEST([AC_LANG_SOURCE([[
  47. +void foo (void) { volatile char a[8]; a[3]; }
  48. +]])])
  49. +[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
  50. +# `ac_compile' like this correct, after all?
  51. +if eval "$ac_compile -S -fstack-protector-strong -o conftest.s" 2> /dev/null; then]
  52. + AC_MSG_RESULT([yes])
  53. + [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
  54. + rm -f conftest.s
  55. +else
  56. + ssp_strong_possible=no]
  57. + AC_MSG_RESULT([no])
  58. +[fi]
  59. +[# Global stack smashing protector.
  60. +ssp_global_possible=yes]
  61. +AC_MSG_CHECKING([whether `$CC' accepts `-mstack-protector-guard=global'])
  62. +# Is this a reliable test case?
  63. +AC_LANG_CONFTEST([AC_LANG_SOURCE([[
  64. +void foo (void) { volatile char a[8]; a[3]; }
  65. +]])])
  66. +[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
  67. +# `ac_compile' like this correct, after all?
  68. +if eval "$ac_compile -S -fstack-protector -mstack-protector-guard=global -o conftest.s" 2> /dev/null; then]
  69. + AC_MSG_RESULT([yes])
  70. + [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
  71. + rm -f conftest.s
  72. +else
  73. + ssp_global_possible=no]
  74. + AC_MSG_RESULT([no])
  75. +[fi]
  76. ])
  77. dnl Check if the C compiler supports `-mstack-arg-probe' (Cygwin).
  78. diff --git a/configure b/configure
  79. index 9290ae8..973f702 100755
  80. --- a/configure
  81. +++ b/configure
  82. @@ -1778,6 +1778,7 @@ with_libintl_prefix
  83. with_libpth_prefix
  84. with_included_regex
  85. enable_efiemu
  86. +enable_stack_protector
  87. enable_mm_debug
  88. enable_cache_stats
  89. enable_boot_time
  90. @@ -2459,6 +2460,8 @@ Optional Features:
  91. --disable-rpath do not hardcode runtime library paths
  92. --enable-efiemu build and install the efiemu runtimes
  93. (default=guessed)
  94. + --enable-stack-protector
  95. + enable the stack protector
  96. --enable-mm-debug include memory manager debugging
  97. --enable-cache-stats enable disk cache statistics collection
  98. --enable-boot-time enable boot time statistics collection
  99. @@ -32348,9 +32351,9 @@ fi
  100. CFLAGS="$TARGET_CFLAGS"
  101. -# Smashing stack protector.
  102. +# Stack smashing protector.
  103. -# Smashing stack protector.
  104. +# Stack smashing protector.
  105. ssp_possible=yes
  106. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-fstack-protector'" >&5
  107. $as_echo_n "checking whether \`$CC' accepts \`-fstack-protector'... " >&6; }
  108. @@ -32373,11 +32376,88 @@ else
  109. { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
  110. $as_echo "no" >&6; }
  111. fi
  112. +# Strong stack smashing protector.
  113. +ssp_strong_possible=yes
  114. +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-fstack-protector-strong'" >&5
  115. +$as_echo_n "checking whether \`$CC' accepts \`-fstack-protector-strong'... " >&6; }
  116. +# Is this a reliable test case?
  117. +cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  118. +/* end confdefs.h. */
  119. -# Need that, because some distributions ship compilers that include
  120. -# `-fstack-protector' in the default specs.
  121. -if test "x$ssp_possible" = xyes; then
  122. - TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
  123. +void foo (void) { volatile char a[8]; a[3]; }
  124. +
  125. +_ACEOF
  126. +# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
  127. +# `ac_compile' like this correct, after all?
  128. +if eval "$ac_compile -S -fstack-protector-strong -o conftest.s" 2> /dev/null; then
  129. + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
  130. +$as_echo "yes" >&6; }
  131. + # Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
  132. + rm -f conftest.s
  133. +else
  134. + ssp_strong_possible=no
  135. + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
  136. +$as_echo "no" >&6; }
  137. +fi
  138. +# Global stack smashing protector.
  139. +ssp_global_possible=yes
  140. +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether \`$CC' accepts \`-mstack-protector-guard=global'" >&5
  141. +$as_echo_n "checking whether \`$CC' accepts \`-mstack-protector-guard=global'... " >&6; }
  142. +# Is this a reliable test case?
  143. +cat confdefs.h - <<_ACEOF >conftest.$ac_ext
  144. +/* end confdefs.h. */
  145. +
  146. +void foo (void) { volatile char a[8]; a[3]; }
  147. +
  148. +_ACEOF
  149. +# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
  150. +# `ac_compile' like this correct, after all?
  151. +if eval "$ac_compile -S -fstack-protector -mstack-protector-guard=global -o conftest.s" 2> /dev/null; then
  152. + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
  153. +$as_echo "yes" >&6; }
  154. + # Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
  155. + rm -f conftest.s
  156. +else
  157. + ssp_global_possible=no
  158. + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
  159. +$as_echo "no" >&6; }
  160. +fi
  161. +
  162. +# Check whether --enable-stack-protector was given.
  163. +if test "${enable_stack_protector+set}" = set; then :
  164. + enableval=$enable_stack_protector;
  165. +else
  166. + enable_stack_protector=no
  167. +fi
  168. +
  169. +if test "x$enable_stack_protector" = xno; then
  170. + if test "x$ssp_possible" = xyes; then
  171. + # Need that, because some distributions ship compilers that include
  172. + # `-fstack-protector' in the default specs.
  173. + TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
  174. + fi
  175. +elif test "x$platform" != xefi; then
  176. + as_fn_error $? "--enable-stack-protector is only supported on EFI platforms" "$LINENO" 5
  177. +elif test "x$ssp_global_possible" != xyes; then
  178. + as_fn_error $? "--enable-stack-protector is not supported (compiler doesn't support -mstack-protector-guard=global)" "$LINENO" 5
  179. +else
  180. + TARGET_CFLAGS="$TARGET_CFLAGS -mstack-protector-guard=global"
  181. + if test "x$enable_stack_protector" = xyes; then
  182. + if test "x$ssp_possible" != xyes; then
  183. + as_fn_error $? "--enable-stack-protector is not supported (compiler doesn't support -fstack-protector)" "$LINENO" 5
  184. + fi
  185. + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector"
  186. + elif test "x$enable_stack_protector" = xstrong; then
  187. + if test "x$ssp_strong_possible" != xyes; then
  188. + as_fn_error $? "--enable-stack-protector=strong is not supported (compiler doesn't support -fstack-protector-strong)" "$LINENO" 5
  189. + fi
  190. + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector-strong"
  191. + else
  192. + # Note, -fstack-protector-all requires that the protector is disabled for
  193. + # functions that appear in the call stack when the canary is initialized.
  194. + as_fn_error $? "invalid value $enable_stack_protector for --enable-stack-protector" "$LINENO" 5
  195. + fi
  196. + TARGET_CPPFLAGS="$TARGET_CPPFLAGS -DGRUB_STACK_PROTECTOR=1"
  197. fi
  198. CFLAGS="$TARGET_CFLAGS"
  199. @@ -37054,5 +37134,10 @@ echo "Without liblzma (no support for XZ-compressed mips images) ($liblzma_excus
  200. else
  201. echo "With liblzma from $LIBLZMA (support for XZ-compressed mips images)"
  202. fi
  203. +if test "x$enable_stack_protector" != xno; then
  204. +echo "With stack smashing protector: Yes"
  205. +else
  206. +echo "With stack smashing protector: No"
  207. +fi
  208. echo "*******************************************************"
  209. diff --git a/configure.ac b/configure.ac
  210. index 7656f24..bb6b02a 100644
  211. --- a/configure.ac
  212. +++ b/configure.ac
  213. @@ -1285,12 +1285,41 @@ fi]
  214. CFLAGS="$TARGET_CFLAGS"
  215. -# Smashing stack protector.
  216. +# Stack smashing protector.
  217. grub_CHECK_STACK_PROTECTOR
  218. -# Need that, because some distributions ship compilers that include
  219. -# `-fstack-protector' in the default specs.
  220. -if test "x$ssp_possible" = xyes; then
  221. - TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
  222. +AC_ARG_ENABLE([stack-protector],
  223. + AS_HELP_STRING([--enable-stack-protector],
  224. + [enable the stack protector]),
  225. + [],
  226. + [enable_stack_protector=no])
  227. +if test "x$enable_stack_protector" = xno; then
  228. + if test "x$ssp_possible" = xyes; then
  229. + # Need that, because some distributions ship compilers that include
  230. + # `-fstack-protector' in the default specs.
  231. + TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
  232. + fi
  233. +elif test "x$platform" != xefi; then
  234. + AC_MSG_ERROR([--enable-stack-protector is only supported on EFI platforms])
  235. +elif test "x$ssp_global_possible" != xyes; then
  236. + AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -mstack-protector-guard=global)])
  237. +else
  238. + TARGET_CFLAGS="$TARGET_CFLAGS -mstack-protector-guard=global"
  239. + if test "x$enable_stack_protector" = xyes; then
  240. + if test "x$ssp_possible" != xyes; then
  241. + AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -fstack-protector)])
  242. + fi
  243. + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector"
  244. + elif test "x$enable_stack_protector" = xstrong; then
  245. + if test "x$ssp_strong_possible" != xyes; then
  246. + AC_MSG_ERROR([--enable-stack-protector=strong is not supported (compiler doesn't support -fstack-protector-strong)])
  247. + fi
  248. + TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector-strong"
  249. + else
  250. + # Note, -fstack-protector-all requires that the protector is disabled for
  251. + # functions that appear in the call stack when the canary is initialized.
  252. + AC_MSG_ERROR([invalid value $enable_stack_protector for --enable-stack-protector])
  253. + fi
  254. + TARGET_CPPFLAGS="$TARGET_CPPFLAGS -DGRUB_STACK_PROTECTOR=1"
  255. fi
  256. CFLAGS="$TARGET_CFLAGS"
  257. @@ -2103,5 +2132,10 @@ echo "Without liblzma (no support for XZ-compressed mips images) ($liblzma_excus
  258. else
  259. echo "With liblzma from $LIBLZMA (support for XZ-compressed mips images)"
  260. fi
  261. +if test "x$enable_stack_protector" != xno; then
  262. +echo "With stack smashing protector: Yes"
  263. +else
  264. +echo "With stack smashing protector: No"
  265. +fi
  266. echo "*******************************************************"
  267. ]
  268. diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am
  269. index 30e23ad..ee88e44 100644
  270. --- a/grub-core/Makefile.am
  271. +++ b/grub-core/Makefile.am
  272. @@ -90,6 +90,7 @@ endif
  273. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm.h
  274. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h
  275. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h
  276. +KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/stack_protector.h
  277. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h
  278. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h
  279. KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/verify.h
  280. diff --git a/grub-core/Makefile.in b/grub-core/Makefile.in
  281. index 1f8133b..50c70b5 100644
  282. --- a/grub-core/Makefile.in
  283. +++ b/grub-core/Makefile.in
  284. @@ -16425,6 +16425,7 @@ KERNEL_HEADER_FILES = $(top_srcdir)/include/grub/cache.h \
  285. $(am__append_5795) $(top_srcdir)/include/grub/mm.h \
  286. $(top_srcdir)/include/grub/parser.h \
  287. $(top_srcdir)/include/grub/partition.h \
  288. + $(top_srcdir)/include/grub/stack_protector.h \
  289. $(top_srcdir)/include/grub/term.h \
  290. $(top_srcdir)/include/grub/time.h \
  291. $(top_srcdir)/include/grub/verify.h \
  292. diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
  293. index 1333465..7facacf 100644
  294. --- a/grub-core/kern/efi/init.c
  295. +++ b/grub-core/kern/efi/init.c
  296. @@ -27,6 +27,58 @@
  297. #include <grub/env.h>
  298. #include <grub/mm.h>
  299. #include <grub/kernel.h>
  300. +#include <grub/stack_protector.h>
  301. +
  302. +#ifdef GRUB_STACK_PROTECTOR
  303. +
  304. +static grub_efi_guid_t rng_protocol_guid = GRUB_EFI_RNG_PROTOCOL_GUID;
  305. +
  306. +/*
  307. + * Don't put this on grub_efi_init()'s local stack to avoid it
  308. + * getting a stack check.
  309. + */
  310. +static grub_efi_uint8_t stack_chk_guard_buf[32];
  311. +
  312. +grub_addr_t __stack_chk_guard;
  313. +
  314. +void __attribute__ ((noreturn))
  315. +__stack_chk_fail (void)
  316. +{
  317. + /*
  318. + * Assume it's not safe to call into EFI Boot Services. Sorry, that
  319. + * means no console message here.
  320. + */
  321. + do
  322. + {
  323. + /* Do not optimize out the loop. */
  324. + asm volatile ("");
  325. + }
  326. + while (1);
  327. +}
  328. +
  329. +static void
  330. +stack_protector_init (void)
  331. +{
  332. + grub_efi_rng_protocol_t *rng;
  333. +
  334. + /* Set up the stack canary. Make errors here non-fatal for now. */
  335. + rng = grub_efi_locate_protocol (&rng_protocol_guid, NULL);
  336. + if (rng != NULL)
  337. + {
  338. + grub_efi_status_t status;
  339. +
  340. + status = efi_call_4 (rng->get_rng, rng, NULL, sizeof (stack_chk_guard_buf),
  341. + stack_chk_guard_buf);
  342. + if (status == GRUB_EFI_SUCCESS)
  343. + grub_memcpy (&__stack_chk_guard, stack_chk_guard_buf, sizeof (__stack_chk_guard));
  344. + }
  345. +}
  346. +#else
  347. +static void
  348. +stack_protector_init (void)
  349. +{
  350. +}
  351. +#endif
  352. grub_addr_t grub_modbase;
  353. @@ -38,6 +90,8 @@ grub_efi_init (void)
  354. messages. */
  355. grub_console_init ();
  356. + stack_protector_init ();
  357. +
  358. /* Initialize the memory management system. */
  359. grub_efi_mm_init ();
  360. diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h
  361. index 13e5715..5517f7e 100644
  362. --- a/include/grub/efi/api.h
  363. +++ b/include/grub/efi/api.h
  364. @@ -339,6 +339,11 @@
  365. { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } \
  366. }
  367. +#define GRUB_EFI_RNG_PROTOCOL_GUID \
  368. + { 0x3152bca5, 0xeade, 0x433d, \
  369. + { 0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 } \
  370. + }
  371. +
  372. struct grub_efi_sal_system_table
  373. {
  374. grub_uint32_t signature;
  375. @@ -1700,6 +1705,20 @@ struct grub_efi_shim_lock_protocol
  376. };
  377. typedef struct grub_efi_shim_lock_protocol grub_efi_shim_lock_protocol_t;
  378. +typedef grub_efi_guid_t grub_efi_rng_algorithm_t;
  379. +
  380. +struct grub_efi_rng_protocol
  381. +{
  382. + grub_efi_status_t (*get_info) (struct grub_efi_rng_protocol *this,
  383. + grub_efi_uintn_t *rng_algorithm_list_size,
  384. + grub_efi_rng_algorithm_t *rng_algorithm_list);
  385. + grub_efi_status_t (*get_rng) (struct grub_efi_rng_protocol *this,
  386. + grub_efi_rng_algorithm_t *rng_algorithm,
  387. + grub_efi_uintn_t rng_value_length,
  388. + grub_efi_uint8_t *rng_value);
  389. +};
  390. +typedef struct grub_efi_rng_protocol grub_efi_rng_protocol_t;
  391. +
  392. #if (GRUB_TARGET_SIZEOF_VOID_P == 4) || defined (__ia64__) \
  393. || defined (__aarch64__) || defined (__MINGW64__) || defined (__CYGWIN__) \
  394. || defined(__riscv)
  395. diff --git a/include/grub/stack_protector.h b/include/grub/stack_protector.h
  396. new file mode 100644
  397. index 0000000..c88dc00
  398. --- /dev/null
  399. +++ b/include/grub/stack_protector.h
  400. @@ -0,0 +1,30 @@
  401. +/*
  402. + * GRUB -- GRand Unified Bootloader
  403. + * Copyright (C) 2021 Free Software Foundation, Inc.
  404. + *
  405. + * GRUB is free software: you can redistribute it and/or modify
  406. + * it under the terms of the GNU General Public License as published by
  407. + * the Free Software Foundation, either version 3 of the License, or
  408. + * (at your option) any later version.
  409. + *
  410. + * GRUB is distributed in the hope that it will be useful,
  411. + * but WITHOUT ANY WARRANTY; without even the implied warranty of
  412. + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  413. + * GNU General Public License for more details.
  414. + *
  415. + * You should have received a copy of the GNU General Public License
  416. + * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
  417. + */
  418. +
  419. +#ifndef GRUB_STACK_PROTECTOR_H
  420. +#define GRUB_STACK_PROTECTOR_H 1
  421. +
  422. +#include <grub/symbol.h>
  423. +#include <grub/types.h>
  424. +
  425. +#ifdef GRUB_STACK_PROTECTOR
  426. +extern grub_addr_t EXPORT_VAR (__stack_chk_guard);
  427. +extern void __attribute__ ((noreturn)) EXPORT_FUNC (__stack_chk_fail) (void);
  428. +#endif
  429. +
  430. +#endif /* GRUB_STACK_PROTECTOR_H */
  431. diff --git a/po/POTFILES.in b/po/POTFILES.in
  432. index 7753ab4..ef42c7d 100644
  433. --- a/po/POTFILES.in
  434. +++ b/po/POTFILES.in
  435. @@ -1319,6 +1319,7 @@
  436. ./include/grub/sparc64/time.h
  437. ./include/grub/sparc64/types.h
  438. ./include/grub/speaker.h
  439. +./include/grub/stack_protector.h
  440. ./include/grub/symbol.h
  441. ./include/grub/syslinux_parse.h
  442. ./include/grub/term.h
  443. --
  444. 2.14.2