From d70f2ccec4b0f39864e8576a37b7536457e03cee Mon Sep 17 00:00:00 2001 From: Georg Kunz Date: Wed, 1 Nov 2023 20:36:05 +0100 Subject: [PATCH 1/2] Compiler guide: Add note about redefining default of FORTIFY_SOURCE In case a compiler uses a predefined default for FORTIFY_SOURCE and a different mode is set on the command line, a warning about redefining the macro is triggered. To avoid this, the default value of FORTIFY_SOURCE can be unset first before setting the desired value. Signed-off-by: Georg Kunz --- .../Compiler-Options-Hardening-Guide-for-C-and-C++.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md index c5d0d32c..b7556032 100644 --- a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md +++ b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md @@ -17,7 +17,7 @@ When compiling C or C++ code on compilers such as GCC and clang, turn on these f ~~~~sh -O2 -Wall -Wformat=2 -Wconversion -Wtrampolines -Wimplicit-fallthrough \ --D_FORTIFY_SOURCE=3 \ +-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 \ -D_GLIBCXX_ASSERTIONS \ -fstack-clash-protection -fstack-protector-strong \ -Wl,-z,nodlopen -Wl,-z,noexecstack \ @@ -137,7 +137,7 @@ Table 2: Recommended compiler options that enable run-time protection mechanisms | Compiler Flag | Supported since | Description | |:----------------------------------------------------------------------------------------- |:----------------------------------:|:-------------------------------------------------------------------------------------------- | -| [`-D_FORTIFY_SOURCE=3`](#-D_FORTIFY_SOURCE=3)
(requires `-O1` or higher) | GCC 12.0
Clang 9.0.0[^Guelton20] | Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows. Some fortification levels can impact performance. | +| [`-D_FORTIFY_SOURCE=3`](#-D_FORTIFY_SOURCE=3)
(requires `-O1` or higher,
may require -U_FORTIFY_SOURCE) | GCC 12.0
Clang 9.0.0[^Guelton20] | Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows. Some fortification levels can impact performance. | | [`-D_GLIBCXX_ASSERTIONS`](#-D_GLIBCXX_ASSERTIONS)
[`-D_LIBCPP_ASSERT`](#-D_LIBCPP_ASSERT) | libstdc++ 6.0
libc++ 3.3.0 | Precondition checks for C++ standard library calls. Can impact performance. | | [`-fstack-clash-protection`](#-fstack-clash-protection) | GCC 8
Clang 11.0.0 | Enable run-time checks for variable-size stack allocation validity. Can impact performance. | | [`-fstack-protector-strong`](#-fstack-protector-strong) | GCC 4.9.0
Clang 5.0.0 | Enable run-time checks for stack-based buffer overflows. Can impact performance. | @@ -322,6 +322,8 @@ To benefit from `_FORTIFY_SOURCE` checks the following requirements must be met: If checks added by `_FORTIFY_SOURCE` detect unsafe behavior at run-time they will print an error message and terminate the application. +A default mode for FORTIFY_SOURCE may be predefined for a given compiler, for instance gcc shipped with Ubuntu 22.04 uses FORTIFY_SOURCE=2 by default. If a mode of FORTIFY_SOURCE is set on the command line which differs from the default, the compiler warns about redefining the FORTIFY_SOURCE macro. To avoid this, the predefined mode can be unset with -U_FORTIFY_SOURCE before setting the desired value. + #### Performance implications Both `_FORTIFY_SOURCE=1` and `_FORTIFY_SOURCE=2` are expected to have a negligible run-time performance impact (~0.1% ). From d6d8d23eafadfe56efa7b847a549a8c9eb73908b Mon Sep 17 00:00:00 2001 From: Georg Kunz Date: Wed, 1 Nov 2023 23:34:33 +0100 Subject: [PATCH 2/2] Compiler guide: Update notes on redefining FORTIFY_SOURCE Signed-off-by: Georg Kunz --- .../Compiler-Options-Hardening-Guide-for-C-and-C++.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md index b7556032..7da8e906 100644 --- a/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md +++ b/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.md @@ -137,7 +137,7 @@ Table 2: Recommended compiler options that enable run-time protection mechanisms | Compiler Flag | Supported since | Description | |:----------------------------------------------------------------------------------------- |:----------------------------------:|:-------------------------------------------------------------------------------------------- | -| [`-D_FORTIFY_SOURCE=3`](#-D_FORTIFY_SOURCE=3)
(requires `-O1` or higher,
may require -U_FORTIFY_SOURCE) | GCC 12.0
Clang 9.0.0[^Guelton20] | Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows. Some fortification levels can impact performance. | +| [`-D_FORTIFY_SOURCE=3`](#-D_FORTIFY_SOURCE=3)
(requires `-O1` or higher,
may require prepending -U_FORTIFY_SOURCE) | GCC 12.0
Clang 9.0.0[^Guelton20] | Fortify sources with compile- and run-time checks for unsafe libc usage and buffer overflows. Some fortification levels can impact performance. | | [`-D_GLIBCXX_ASSERTIONS`](#-D_GLIBCXX_ASSERTIONS)
[`-D_LIBCPP_ASSERT`](#-D_LIBCPP_ASSERT) | libstdc++ 6.0
libc++ 3.3.0 | Precondition checks for C++ standard library calls. Can impact performance. | | [`-fstack-clash-protection`](#-fstack-clash-protection) | GCC 8
Clang 11.0.0 | Enable run-time checks for variable-size stack allocation validity. Can impact performance. | | [`-fstack-protector-strong`](#-fstack-protector-strong) | GCC 4.9.0
Clang 5.0.0 | Enable run-time checks for stack-based buffer overflows. Can impact performance. | @@ -322,7 +322,7 @@ To benefit from `_FORTIFY_SOURCE` checks the following requirements must be met: If checks added by `_FORTIFY_SOURCE` detect unsafe behavior at run-time they will print an error message and terminate the application. -A default mode for FORTIFY_SOURCE may be predefined for a given compiler, for instance gcc shipped with Ubuntu 22.04 uses FORTIFY_SOURCE=2 by default. If a mode of FORTIFY_SOURCE is set on the command line which differs from the default, the compiler warns about redefining the FORTIFY_SOURCE macro. To avoid this, the predefined mode can be unset with -U_FORTIFY_SOURCE before setting the desired value. +A default mode for FORTIFY_SOURCE may be predefined for a given compiler, for instance GCC shipped with Ubuntu 22.04 uses FORTIFY_SOURCE=2 by default. If a mode of FORTIFY_SOURCE is set on the command line which differs from the default, the compiler warns about redefining the FORTIFY_SOURCE macro. To avoid this, the predefined mode can be unset with -U_FORTIFY_SOURCE before setting the desired value. #### Performance implications