Browse Source

Merge #7424: Add security/export checks to gitian and fix current failures

a81c87f release: add security/symbol checks to gitian (Cory Fields)
a8ce872 release: always link librt for glibc back-compat builds (Cory Fields)
f3d3eaf release: add check-symbols and check-security make targets (Cory Fields)
475813b release: add _IO_stdin_used to ignored exports (Cory Fields)
cd27bf5 release: fix parsing of BIND_NOW with older readelf (Cory Fields)
0.13
Wladimir J. van der Laan 9 years ago
parent
commit
42ecea48fd
No known key found for this signature in database
GPG Key ID: 74810B012346C9A6
  1. 5
      Makefile.am
  2. 12
      configure.ac
  3. 2
      contrib/devtools/security-check.py
  4. 5
      contrib/devtools/symbol-check.py
  5. 2
      contrib/gitian-descriptors/gitian-linux.yml
  6. 1
      contrib/gitian-descriptors/gitian-win.yml
  7. 14
      src/Makefile.am

5
Makefile.am

@ -26,6 +26,9 @@ OSX_QT_TRANSLATIONS = da,de,es,hu,ru,uk,zh_CN,zh_TW
DIST_DOCS = $(wildcard doc/*.md) $(wildcard doc/release-notes/*.md) DIST_DOCS = $(wildcard doc/*.md) $(wildcard doc/release-notes/*.md)
BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
$(top_srcdir)/contrib/devtools/security-check.py
WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \ WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \
$(top_srcdir)/share/pixmaps/nsis-header.bmp \ $(top_srcdir)/share/pixmaps/nsis-header.bmp \
$(top_srcdir)/share/pixmaps/nsis-wizard.bmp \ $(top_srcdir)/share/pixmaps/nsis-wizard.bmp \
@ -213,7 +216,7 @@ endif
dist_noinst_SCRIPTS = autogen.sh dist_noinst_SCRIPTS = autogen.sh
EXTRA_DIST = $(top_srcdir)/share/genbuild.sh qa/pull-tester/rpc-tests.py qa/rpc-tests $(DIST_DOCS) $(WINDOWS_PACKAGING) $(OSX_PACKAGING) EXTRA_DIST = $(top_srcdir)/share/genbuild.sh qa/pull-tester/rpc-tests.py qa/rpc-tests $(DIST_DOCS) $(WINDOWS_PACKAGING) $(OSX_PACKAGING) $(BIN_CHECKS)
CLEANFILES = $(OSX_DMG) $(BITCOIN_WIN_INSTALLER) CLEANFILES = $(OSX_DMG) $(BITCOIN_WIN_INSTALLER)

12
configure.ac

@ -64,6 +64,8 @@ AC_PATH_PROG([GIT], [git])
AC_PATH_PROG(CCACHE,ccache) AC_PATH_PROG(CCACHE,ccache)
AC_PATH_PROG(XGETTEXT,xgettext) AC_PATH_PROG(XGETTEXT,xgettext)
AC_PATH_PROG(HEXDUMP,hexdump) AC_PATH_PROG(HEXDUMP,hexdump)
AC_PATH_TOOL(READELF, readelf)
AC_PATH_TOOL(CPPFILT, c++filt)
dnl pkg-config check. dnl pkg-config check.
PKG_PROG_PKG_CONFIG PKG_PROG_PKG_CONFIG
@ -409,6 +411,10 @@ AX_GCC_FUNC_ATTRIBUTE([dllimport])
if test x$use_glibc_compat != xno; then if test x$use_glibc_compat != xno; then
#glibc absorbed clock_gettime in 2.17. librt (its previous location) is safe to link
#in anyway for back-compat.
AC_CHECK_LIB([rt],[clock_gettime],, AC_MSG_ERROR(lib missing))
#__fdelt_chk's params and return type have changed from long unsigned int to long int. #__fdelt_chk's params and return type have changed from long unsigned int to long int.
# See which one is present here. # See which one is present here.
AC_MSG_CHECKING(__fdelt_chk type) AC_MSG_CHECKING(__fdelt_chk type)
@ -422,7 +428,8 @@ if test x$use_glibc_compat != xno; then
[ fdelt_type="long int"]) [ fdelt_type="long int"])
AC_MSG_RESULT($fdelt_type) AC_MSG_RESULT($fdelt_type)
AC_DEFINE_UNQUOTED(FDELT_TYPE, $fdelt_type,[parameter and return value type for __fdelt_chk]) AC_DEFINE_UNQUOTED(FDELT_TYPE, $fdelt_type,[parameter and return value type for __fdelt_chk])
else
AC_SEARCH_LIBS([clock_gettime],[rt])
fi fi
if test x$TARGET_OS != xwindows; then if test x$TARGET_OS != xwindows; then
@ -489,8 +496,6 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <sys/socket.h>]],
[ AC_MSG_RESULT(no)] [ AC_MSG_RESULT(no)]
) )
AC_SEARCH_LIBS([clock_gettime],[rt])
AC_MSG_CHECKING([for visibility attribute]) AC_MSG_CHECKING([for visibility attribute])
AC_LINK_IFELSE([AC_LANG_SOURCE([ AC_LINK_IFELSE([AC_LANG_SOURCE([
int foo_def( void ) __attribute__((visibility("default"))); int foo_def( void ) __attribute__((visibility("default")));
@ -936,6 +941,7 @@ AM_CONDITIONAL([USE_LCOV],[test x$use_lcov = xyes])
AM_CONDITIONAL([USE_COMPARISON_TOOL],[test x$use_comparison_tool != xno]) AM_CONDITIONAL([USE_COMPARISON_TOOL],[test x$use_comparison_tool != xno])
AM_CONDITIONAL([USE_COMPARISON_TOOL_REORG_TESTS],[test x$use_comparison_tool_reorg_test != xno]) AM_CONDITIONAL([USE_COMPARISON_TOOL_REORG_TESTS],[test x$use_comparison_tool_reorg_test != xno])
AM_CONDITIONAL([GLIBC_BACK_COMPAT],[test x$use_glibc_compat = xyes]) AM_CONDITIONAL([GLIBC_BACK_COMPAT],[test x$use_glibc_compat = xyes])
AM_CONDITIONAL([HARDEN],[test x$use_hardening = xyes])
AC_DEFINE(CLIENT_VERSION_MAJOR, _CLIENT_VERSION_MAJOR, [Major version]) AC_DEFINE(CLIENT_VERSION_MAJOR, _CLIENT_VERSION_MAJOR, [Major version])
AC_DEFINE(CLIENT_VERSION_MINOR, _CLIENT_VERSION_MINOR, [Minor version]) AC_DEFINE(CLIENT_VERSION_MINOR, _CLIENT_VERSION_MINOR, [Minor version])

2
contrib/devtools/security-check.py

@ -94,7 +94,7 @@ def check_ELF_RELRO(executable):
raise IOError('Error opening file') raise IOError('Error opening file')
for line in stdout.split('\n'): for line in stdout.split('\n'):
tokens = line.split() tokens = line.split()
if len(tokens)>1 and tokens[1] == '(BIND_NOW)': if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2]):
have_bindnow = True have_bindnow = True
return have_gnu_relro and have_bindnow return have_gnu_relro and have_bindnow

5
contrib/devtools/symbol-check.py

@ -42,9 +42,12 @@ MAX_VERSIONS = {
'GLIBCXX': (3,4,13), 'GLIBCXX': (3,4,13),
'GLIBC': (2,11) 'GLIBC': (2,11)
} }
# See here for a description of _IO_stdin_used:
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=634261#109
# Ignore symbols that are exported as part of every executable # Ignore symbols that are exported as part of every executable
IGNORE_EXPORTS = { IGNORE_EXPORTS = {
'_edata', '_end', '_init', '__bss_start', '_fini' '_edata', '_end', '_init', '__bss_start', '_fini', '_IO_stdin_used'
} }
READELF_CMD = os.getenv('READELF', '/usr/bin/readelf') READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
CPPFILT_CMD = os.getenv('CPPFILT', '/usr/bin/c++filt') CPPFILT_CMD = os.getenv('CPPFILT', '/usr/bin/c++filt')

2
contrib/gitian-descriptors/gitian-linux.yml

@ -96,6 +96,8 @@ script: |
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS} ./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
make ${MAKEOPTS} make ${MAKEOPTS}
make ${MAKEOPTS} -C src check-security
make ${MAKEOPTS} -C src check-symbols
make install-strip make install-strip
cd installed cd installed
find . -name "lib*.la" -delete find . -name "lib*.la" -delete

1
contrib/gitian-descriptors/gitian-win.yml

@ -126,6 +126,7 @@ script: |
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS} ./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
make ${MAKEOPTS} make ${MAKEOPTS}
make ${MAKEOPTS} -C src check-security
make deploy make deploy
make install-strip make install-strip
cp -f bitcoin-*setup*.exe $OUTDIR/ cp -f bitcoin-*setup*.exe $OUTDIR/

14
src/Makefile.am

@ -76,7 +76,7 @@ if BUILD_BITCOIN_UTILS
bin_PROGRAMS += bitcoin-cli bitcoin-tx bin_PROGRAMS += bitcoin-cli bitcoin-tx
endif endif
.PHONY: FORCE .PHONY: FORCE check-symbols check-security
# bitcoin core # # bitcoin core #
BITCOIN_CORE_H = \ BITCOIN_CORE_H = \
addrman.h \ addrman.h \
@ -459,6 +459,18 @@ clean-local:
$(AM_V_CXX) $(OBJCXX) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(AM_V_CXX) $(OBJCXX) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
$(CPPFLAGS) $(AM_CXXFLAGS) $(QT_INCLUDES) $(AM_CXXFLAGS) $(PIE_FLAGS) $(CXXFLAGS) -c -o $@ $< $(CPPFLAGS) $(AM_CXXFLAGS) $(QT_INCLUDES) $(AM_CXXFLAGS) $(PIE_FLAGS) $(CXXFLAGS) -c -o $@ $<
check-symbols: $(bin_PROGRAMS)
if GLIBC_BACK_COMPAT
@echo "Checking glibc back compat..."
$(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(top_srcdir)/contrib/devtools/symbol-check.py < $(bin_PROGRAMS)
endif
check-security: $(bin_PROGRAMS)
if HARDEN
@echo "Checking binary security..."
$(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py < $(bin_PROGRAMS)
endif
%.pb.cc %.pb.h: %.proto %.pb.cc %.pb.h: %.proto
@test -f $(PROTOC) @test -f $(PROTOC)
$(AM_V_GEN) $(PROTOC) --cpp_out=$(@D) --proto_path=$(abspath $(<D) $<) $(AM_V_GEN) $(PROTOC) --cpp_out=$(@D) --proto_path=$(abspath $(<D) $<)

Loading…
Cancel
Save