GCC Preparing to Introduce “-Fhardened” Security Hardening Option

https://www.phoronix.com/news/GCC-fhardened-Hardening-Option

by pjmlp • 3 years ago

106 69 3 years ago

rwmj2• 3 years ago

I think the background to this is simplifying the mess of RPM macros which are needed to set all these flags:

https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/ra... https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/ra... https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/ra...

(and several other places). I'm sure Debian has something similar as do other distros, so having one flag which does it all is an advantage.

nerpderp822• 3 years ago

Do you know if any distros are going to enable it by default? I think -Fhardened should be opt-out not in.

landr0id• 3 years ago

-ftrivial-auto-var-init=pattern

Would be nice if this was zero instead of pattern.

formerly_proven• 3 years ago

From the compiler's PoV this is buggy code so it's better to make it predictably wrong rather than unboundedly incorrect (=security issues) or predictably correct (=people rely on UB).

woodruffw4• 3 years ago

On top of your reasons (which are good ones!), there’s another good reason to avoid default zero initialization in languages like C: zero is a special value for all kinds of sensitive operations (like UID 0 for root).

In other words: a mitigation that initializes all values to 0 may make some uses of uninitialized variables worse than they were before.

vbezhenar3• 3 years ago

UB is a property of standard. GCC implements plenty of deviations from standard. Nothing wrong with that, as long as it's explicitly documented.

I'd even argue that defined behaviour is a subset of undefined behaviour. So I'd value compiler options to force well defined and "expected" behaviour instead of the current insanity.

Clang "optimized" away empty loop. My MCU gets locked because of it. I have to write `b .` with assembly, because C can't cut it. It is insanity.

twic• 3 years ago

There is a proposal for C++ to zero-initialise automatic (ie local variables):

https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p27...

If that goes through, zeroing automatics would just be doing the same thing.

(FYI the feedback section of that paper is quite funny)

javier_e06• 3 years ago

In my field zeroes are a problem when there is byte shift (not aligned). Specially data transfers. Alignment corruption cannot be detected when the memory area is all zeroes. We use things like 0xaaaa will have you.

blackpill0w• 3 years ago

I guess the reasoning behind this is that using a pattern (0xFE on GCC 12.2.0) is easier to recognise in a crash dump.

tutfbhuf• 3 years ago

Does it make sense to compile the linux kernel with -Fhardened?

nicce6• 3 years ago

Performance impact would be too much likely. Control-flow integrity protections alone usually apply 5% overhead.

_a_a_a_• 3 years ago

can you explain what these integrity protections are and why they're needed, or give a link? TIA

nerpderp822• 3 years ago

This line of reasoning will lead to always using insecure systems over secure ones. We lost much larger percentages due sidechannel mitigations. Layout has more effect than -O1 to -03 (Berger et al). Machines have never been faster than they are now, when will they be fast enough to also safe by default?

chc4• 3 years ago

Android already supports enabling kCFI[0], and says they saw negligable performance and code size impact. Even if it was 5%, security mitigations with a large security impact probably make sense to enable for a lot of usecases.

0: https://source.android.com/docs/security/test/kcfi

rwmj2• 3 years ago

I don't think it would work. Linux uses internal string functions while _FORTIFY_SOURCE works with help from glibc, plus PIE is just not an appropriate memory model for kernel code.

josefx2• 3 years ago

Hardening flags can be problematic depending on which assumptions they make. Some years ago Golang ran into problems with kernels proactively checking for the stack guard page, since Go doesn't use any that safety feature just ended up corrupting random memory on every system call.

dmix• 3 years ago

Did Go address these issues or is it more fundamental?

LoganDark2• 3 years ago

Is it "-Fhardened", "-fhardened", or "-fhardening"?

rurban2• 3 years ago

-fhardened. see the article.

Just the HN headline is wrong

pxeger1• 3 years ago

The auto-capitalisation HN does to headlines seems completely unnecessary to me.

LoganDark2• 3 years ago

The article includes "-fhardening" as well. I agree that it's most likely to be -fhardened though.

woodruffw4• 3 years ago

Does anybody know how this interacts (or is intended to interact) with nested functions? My understanding is that GCC enables executable stacks when nested functions are used[1]; it'd be interesting to know whether they produce an error for this combination or continue to silently disable that mitigation.

[1] https://gcc.gnu.org/onlinedocs/gccint/Trampolines.html#Suppo...

jcalvinowens2• 3 years ago

Why would you ever want to do that? It's a weird GNU extension, I've personally never seen it used in real code. I'm really curious.

woodruffw4• 3 years ago

I don't ever want to do it. I'm worried that code I rely on will do it, and I'll end up building (or running) binaries that are missing basic security mitigations.

dooglius• 3 years ago

As indicated in that page, this is only an issue when one takes the address of a nested function, it doesn't happen merely by using nested functions.

mrlonglong2• 3 years ago

Why is it "-Fhardened" and not "-fhardened"?

redfern314• 3 years ago

Every instance in the source article uses lower case; not sure if they changed it or the title just got mangled when posting

kevincox• 3 years ago

That is Hacker News butchering the title. The flag is in fact -fhardened as stated in TFA.

mrlonglong2• 3 years ago

Glad to hear that. I was a bit worried the GCC boffins had lost it or something.

watersb• 3 years ago

I suppose that this meta-flag won't work with musl libc.

GCC Preparing to Introduce “-Fhardened” Security Hardening Option

Related Stories