Skip to content

Commit 17acb27

Browse files
committed
Merge bitcoin/bitcoin#27688: doc: remove Security section from build-unix.md
4bfcbbf doc: remove Security section from build-unix.md (fanquake) Pull request description: Our compile documentation isn't the right place for generic binary hardening notes, which are neither particularly Bitcoin-Core specific, or as relevant as they might have once been, i.e non-executable stacks are now just the norm. Just remove the notes for now, if someone has something more interesting/Bitcoin Core specific, it could be added in separate documentation in the future (maybe into the devwiki or similar). Split from bitcoin/bitcoin#27685 (comment). ACKs for top commit: jarolrod: ACK 4bfcbbf Tree-SHA512: 01b523ba40353d6cafb5dbd6540b514d83a2dc4e462a068fb390ca7de45b78e4a329367f70527f1824006ebe43f8caeea4ad05ec60556d5a5bd0143e27bf6581
2 parents 0f8c95d + 4bfcbbf commit 17acb27

File tree

1 file changed

+0
-46
lines changed

1 file changed

+0
-46
lines changed

doc/build-unix.md

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -184,52 +184,6 @@ export BDB_PREFIX="/path/to/bitcoin/depends/x86_64-pc-linux-gnu"
184184

185185
**Note**: You only need Berkeley DB if the legacy wallet is enabled (see [*Disable-wallet mode*](#disable-wallet-mode)).
186186

187-
Security
188-
--------
189-
To help make your Bitcoin Core installation more secure by making certain attacks impossible to
190-
exploit even if a vulnerability is found, binaries are hardened by default.
191-
This can be disabled with:
192-
193-
Hardening Flags:
194-
195-
./configure --enable-hardening
196-
./configure --disable-hardening
197-
198-
199-
Hardening enables the following features:
200-
* _Position Independent Executable_: Build position independent code to take advantage of Address Space Layout Randomization
201-
offered by some kernels. Attackers who can cause execution of code at an arbitrary memory
202-
location are thwarted if they don't know where anything useful is located.
203-
The stack and heap are randomly located by default, but this allows the code section to be
204-
randomly located as well.
205-
206-
On an AMD64 processor where a library was not compiled with -fPIC, this will cause an error
207-
such as: "relocation R_X86_64_32 against `......' can not be used when making a shared object;"
208-
209-
To test that you have built PIE executable, install scanelf, part of paxutils, and use:
210-
211-
scanelf -e ./bitcoin
212-
213-
The output should contain:
214-
215-
TYPE
216-
ET_DYN
217-
218-
* _Non-executable Stack_: If the stack is executable then trivial stack-based buffer overflow exploits are possible if
219-
vulnerable buffers are found. By default, Bitcoin Core should be built with a non-executable stack,
220-
but if one of the libraries it uses asks for an executable stack or someone makes a mistake
221-
and uses a compiler extension which requires an executable stack, it will silently build an
222-
executable without the non-executable stack protection.
223-
224-
To verify that the stack is non-executable after compiling use:
225-
`scanelf -e ./bitcoin`
226-
227-
The output should contain:
228-
STK/REL/PTL
229-
RW- R-- RW-
230-
231-
The STK RW- means that the stack is readable and writeable but not executable.
232-
233187
Disable-wallet mode
234188
--------------------
235189
When the intention is to only run a P2P node, without a wallet, Bitcoin Core can

0 commit comments

Comments
 (0)