Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add branch protection flags #260

Merged
merged 8 commits into from
Nov 8, 2023
Merged

Add branch protection flags #260

Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
37b3257
Add branch protection flags
david-a-wheeler Oct 17, 2023
7d2bacb
Fix URL in reference
david-a-wheeler Oct 17, 2023
056551a
Various fixes from review
david-a-wheeler Oct 19, 2023
1dbdd57
Pull out architecture-specific flags
david-a-wheeler Oct 25, 2023
56e1b28
Tweak per review in #260
david-a-wheeler Nov 3, 2023
82b44f7
Not all x86
david-a-wheeler Nov 7, 2023
6c8c0e1
Merge branch 'main' into branch_protection
david-a-wheeler Nov 7, 2023
a3c8990
Improve fcf description
david-a-wheeler Nov 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ When compiling C or C++ code on compilers such as GCC and clang, turn on these f
-D_FORTIFY_SOURCE=3 \
-D_GLIBCXX_ASSERTIONS \
-fstack-clash-protection -fstack-protector-strong \
-fcf-protection=full -mbranch-protection=standard \
-Wl,-z,nodlopen -Wl,-z,noexecstack \
-Wl,-z,relro -Wl,-z,now \
-fPIE -pie -fPIC -shared
Expand Down Expand Up @@ -126,6 +127,8 @@ Table 2: Recommended compiler options that enable run-time protection mechanisms
| [`-D_GLIBCXX_ASSERTIONS`](#-D_GLIBCXX_ASSERTIONS)<br>[`-D_LIBCPP_ASSERT`](#-D_LIBCPP_ASSERT) | libstdc++ 6.0<br/>libc++ 3.3.0 | Precondition checks for C++ standard library calls. Can impact performance. |
| [`-fstack-clash-protection`](#-fstack-clash-protection) | GCC 8<br/>Clang 11.0.0 | Enable run-time checks for variable-size stack allocation validity. Can impact performance. |
| [`-fstack-protector-strong`](#-fstack-protector-strong) | GCC 4.9.0<br/>Clang 5.0.0 | Enable run-time checks for stack-based buffer overflows. Can impact performance. |
| [`-fcf-protection=full`](#-fcf-protection=full) | GCC <br/>Clang | Enable branch protection to counter Return Oriented Programming (ROP) and Jump Oriented Programming (JOP)attacks on Intel |
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
| [`-mbranch-protection=standard`](#-mbranch-protection-standard) | GCC <br/>Clang | Enable branch protection to counter Return Oriented Programming (ROP) and Jump Oriented Programming (JOP) attacks on AArch64 |
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
| [`-Wl,-z,nodlopen`](#-Wl,-z,nodlopen) | Binutils 2.10 | Restrict `dlopen(3)` calls to shared objects |
| [`-Wl,-z,noexecstack`](#-Wl,-z,noexecstack) | Binutils 2.14 | Enable data execution prevention by marking stack memory as non-executable |
| [`-Wl,-z,relro`](#-Wl,-z,relro)<br/>[`-Wl,-z,now`](#-Wl,-z,now) | Binutils 2.15 | Mark relocation table entries resolved at load-time as read-only. `-Wl,-z,now` can impact startup performance. |
Expand Down Expand Up @@ -378,6 +381,30 @@ The performance overhead is dependent on the number of function’s instrumented

---

### Implement control flow integrity checks

| Compiler Flag | Supported since | Description |
|:-------------------------------------------------------------------------------------------------------- |:-------------:|:------------------------------------------------------------ |
| <span id="-fcf-protection=full">`-fcf-protection=full`</span><br/> | GCC <br/>Clang | Enable branch protection to counter Return Oriented Programming (ROP) and Jump Oriented Programming (JOP)attacks on Intel |
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
| <span id="-mbranch-protection-standard">`-mbranch-protection=standard`</span> | GCC <br/>Clang | Enable branch protection to counter Return Oriented Programming (ROP) and Jump Oriented Programming (JOP) attacks on AArch64 |

#### Synopsis

Return-oriented programming (ROP) uses an initial subversion (such as a buffer overflow) to perform an indirect jump that executes an arbitrary sequence of instructions. A countermeasure is to ensure that jump addresses and return addresses are correct. This is not a complete solution, but it makes attacks harder to perform.
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved

#### Performance implications

There are performance implications but they are typically mild
due to hardware assistance.
david-a-wheeler marked this conversation as resolved.
Show resolved Hide resolved
The `-fcf-protection=full` flag enables Intel's Control-Flow Enforcement Technology (CET) [^IntelCET].
The `-mbranch-protection=standard` flag invokes similar protections in the AArch64. In clang it is equivalent to `-mbranch-protection=bti+pac-ret` and invokes the AArch64 Branch Target Identification (BTI) and Pointer Authentication using key A (pac-ret) [^Armclang]

[^Armclang]: ARM Developer, [Arm Compiler armclang Reference Guide Version 6.12 -mbranch-protection](https://developer.arm.com/documentation/100067/0612/armclang-Command-line-Options/-mbranch-protection).

[^IntelCET]: Intel, ["A Technical Look at Intel’s Control-flow Enforcement Technology"](https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html), 2020-06-13.

---

### Restrict dlopen calls to shared objects

| Compiler Flag | Supported since | Description |
Expand Down
Loading