Skip to content

Commit 8319c4e

Browse files
laanwjlaanwj
committed
Merge bitcoin/bitcoin#23838: scripts: make security checks architecture independent
b9898ae scripts: make security checks architecture independent (fanquake) Pull request description: This paves the way for using and checking for architecture dependent flags like `-fcf-protection` on x86_64 Linux and `-mbranch-protection` on 64 bit ARM. While we need a workaround for RISCV arch detection, I sent a change upstream (lief-project/LIEF#640), which has been merged. So we can drop this workaround along with our other RISCV workarounds (i.e lief-project/LIEF#562) with the next LIEF release. Required for #19075, #21851, #21888 etc. Guix build: ```bash bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum c57bcad9d763aae223a256283fef6243d79e0df46c5b5706dc9034a87df56694 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/SHA256SUMS.part f16fb8f0a2d4dfd576fea440c487722d076f3db9d10ec0480b2f94df0c92a6a3 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/bitcoin-b9898aeeaa6a-aarch64-linux-gnu-debug.tar.gz 0e6e660eca7484ddb160b3d62d8867cf171044e81e719de899cd9b8b898cc614 guix-build-b9898aeeaa6a/output/aarch64-linux-gnu/bitcoin-b9898aeeaa6a-aarch64-linux-gnu.tar.gz 29f14e305a280dc1d33a1f2d660db952caf6f3a9aeff9ab9560f122821269ab2 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/SHA256SUMS.part 26477f58601363dfe8eb2639472f71943bc341d415b6190316af232f363f5485 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/bitcoin-b9898aeeaa6a-arm-linux-gnueabihf-debug.tar.gz 372be53fd6d7fedad1bddc45cd9d1ce34cff376eaae4f613e2aa2465728fba82 guix-build-b9898aeeaa6a/output/arm-linux-gnueabihf/bitcoin-b9898aeeaa6a-arm-linux-gnueabihf.tar.gz 39778c9d2949deaba404c90b930e5a0b72663bb05e9d82e93439be131fd622e3 guix-build-b9898aeeaa6a/output/dist-archive/bitcoin-b9898aeeaa6a.tar.gz 599eee817b364b0348034a3e8c97b4bb1a35a78e3ba3472f7589f7a241947b51 guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/SHA256SUMS.part ade0c5ac07d467aa73f85d2a08c3fc3b311816869a2b6903bba4b4e6c88ad9d2 guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64-linux-gnu-debug.tar.gz c63db0e2570756df0b459e6114f01f0b47972ba8d81fcd9568edee95dfade23b guix-build-b9898aeeaa6a/output/powerpc64-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64-linux-gnu.tar.gz dc4e6ba6958e534161a54669ff5d75bc312cfeb92567cc2092235eed0e2f6aa7 guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/SHA256SUMS.part 3ce4c7e50915f72f24fcd24e1e1bc8460cdf2c065e390cf5f626c4cffd50961c guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64le-linux-gnu-debug.tar.gz c8f4a8f10f16fab07547553f1f2580c4aa98ac63246fb30da0560a6367990dd1 guix-build-b9898aeeaa6a/output/powerpc64le-linux-gnu/bitcoin-b9898aeeaa6a-powerpc64le-linux-gnu.tar.gz 8206937fefc76cc277cc7aa8762d7554575942a9e1704106d5ab9b6fe01d5408 guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/SHA256SUMS.part 9530ee044927df02d96c3a9e5974d68b70a7105cb943b94e846c496c2d0579b9 guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/bitcoin-b9898aeeaa6a-riscv64-linux-gnu-debug.tar.gz fc4885db902c3205d3c1bc45c7e03375e621633efb419df37f145d11329bd6ed guix-build-b9898aeeaa6a/output/riscv64-linux-gnu/bitcoin-b9898aeeaa6a-riscv64-linux-gnu.tar.gz caedbc37d5aa5fbb0e370019ce5f1d5f6745b32153f562b0aee80aceec57deab guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/SHA256SUMS.part 1b363dfde1d83530ec4deb0f24547c07446f5db99f327fe382a6e91b4b6cc454 guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx-unsigned.dmg bee82fe6e50a249eab21b6c97ad7436447489d0eabe3e5f7c992ba3b22dfc5ea guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx-unsigned.tar.gz a935280e1229c69bdd29f32d4c894f1384e765872c68ea0dcdacdf897d4bc013 guix-build-b9898aeeaa6a/output/x86_64-apple-darwin/bitcoin-b9898aeeaa6a-osx64.tar.gz 370a87e34e694fe44ba0cd809a1ba044bcc0e7e100b01d74a883069b3d754d1c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/SHA256SUMS.part 46f8c3aa2c3a65f3fc73ddda344724e800bb463d80b062dc749ab76f4c21bc8c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/bitcoin-b9898aeeaa6a-x86_64-linux-gnu-debug.tar.gz 9704b95152ebe582f8aa70bbab8f34ea5e32d80dfda948c019cb9f7d0982f36c guix-build-b9898aeeaa6a/output/x86_64-linux-gnu/bitcoin-b9898aeeaa6a-x86_64-linux-gnu.tar.gz 8385a966601ab4b9dc11d4467435c26af93dce97b66f3d33d7a8f7a885ac326d guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/SHA256SUMS.part f46812804e79166e5440b678166ce2cc38b5628d1a9e312b3af138720cacc478 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win-unsigned.tar.gz 1d7077fdc59ce6af2ea5bffaa5a2ab579f8e8382467a7140623a6a2c4a588a0c guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64-debug.zip 033fa4263ec91ca1e53ff652f12104c3c2aa7da9240a9b48bfa8f2341c79a225 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64-setup-unsigned.exe b7fdc84dee75951c131747c00e1e3c2da87e6f98e9435ffe7fa350ecda6771e8 guix-build-b9898aeeaa6a/output/x86_64-w64-mingw32/bitcoin-b9898aeeaa6a-win64.zip ``` ACKs for top commit: laanwj: Code review ACK b9898ae hebasto: ACK b9898ae Tree-SHA512: d7e7c3eb33f54d44a2252f36871fdb77c182da18ee02078e8b5b4f91d02ec91f9e5c829160839b010b40670202ff05d2c702b7a3873b450878f21ade4dc0ab58
2 parents 66be456 + b9898ae commit 8319c4e

File tree

1 file changed

+38
-8
lines changed

1 file changed

+38
-8
lines changed

‎contrib/devtools/security-check.py

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@
1212

1313
import lief #type:ignore
1414

15+
# temporary constant, to be replaced with lief.ELF.ARCH.RISCV
16+
# https://github.com/lief-project/LIEF/pull/562
17+
LIEF_ELF_ARCH_RISCV = lief.ELF.ARCH(243)
18+
1519
def check_ELF_RELRO(binary) -> bool:
1620
'''
1721
Check for read-only relocations.
@@ -178,31 +182,46 @@ def check_control_flow(binary) -> bool:
178182
return True
179183
return False
180184

181-
182-
CHECKS = {
183-
lief.EXE_FORMATS.ELF: [
185+
BASE_ELF = [
184186
('PIE', check_PIE),
185187
('NX', check_NX),
186188
('RELRO', check_ELF_RELRO),
187189
('Canary', check_ELF_Canary),
188190
('separate_code', check_ELF_separate_code),
189-
],
190-
lief.EXE_FORMATS.PE: [
191+
]
192+
193+
BASE_PE = [
191194
('PIE', check_PIE),
192195
('DYNAMIC_BASE', check_PE_DYNAMIC_BASE),
193196
('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA),
194197
('NX', check_NX),
195198
('RELOC_SECTION', check_PE_RELOC_SECTION),
196199
('CONTROL_FLOW', check_PE_control_flow),
197-
],
198-
lief.EXE_FORMATS.MACHO: [
200+
]
201+
202+
BASE_MACHO = [
199203
('PIE', check_PIE),
200204
('NOUNDEFS', check_MACHO_NOUNDEFS),
201205
('NX', check_NX),
202206
('LAZY_BINDINGS', check_MACHO_LAZY_BINDINGS),
203207
('Canary', check_MACHO_Canary),
204208
('CONTROL_FLOW', check_control_flow),
205209
]
210+
211+
CHECKS = {
212+
lief.EXE_FORMATS.ELF: {
213+
lief.ARCHITECTURES.X86: BASE_ELF,
214+
lief.ARCHITECTURES.ARM: BASE_ELF,
215+
lief.ARCHITECTURES.ARM64: BASE_ELF,
216+
lief.ARCHITECTURES.PPC: BASE_ELF,
217+
LIEF_ELF_ARCH_RISCV: BASE_ELF,
218+
},
219+
lief.EXE_FORMATS.PE: {
220+
lief.ARCHITECTURES.X86: BASE_PE,
221+
},
222+
lief.EXE_FORMATS.MACHO: {
223+
lief.ARCHITECTURES.X86: BASE_MACHO,
224+
}
206225
}
207226

208227
if __name__ == '__main__':
@@ -211,13 +230,24 @@ def check_control_flow(binary) -> bool:
211230
try:
212231
binary = lief.parse(filename)
213232
etype = binary.format
233+
arch = binary.abstract.header.architecture
234+
binary.concrete
235+
214236
if etype == lief.EXE_FORMATS.UNKNOWN:
215237
print(f'{filename}: unknown executable format')
216238
retval = 1
217239
continue
218240

241+
if arch == lief.ARCHITECTURES.NONE:
242+
if binary.header.machine_type == LIEF_ELF_ARCH_RISCV:
243+
arch = LIEF_ELF_ARCH_RISCV
244+
else:
245+
print(f'{filename}: unknown architecture')
246+
retval = 1
247+
continue
248+
219249
failed: List[str] = []
220-
for (name, func) in CHECKS[etype]:
250+
for (name, func) in CHECKS[etype][arch]:
221251
if not func(binary):
222252
failed.append(name)
223253
if failed:

0 commit comments

Comments
 (0)