Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-25 08:39:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

kern/efi: Add initial stack protector implementation

Browse Source 
It works only on UEFI platforms but can be quite easily extended to
others architectures and platforms if needed.

Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Marco A Benatto <mbenatto@redhat.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
This commit is contained in:
Chris Coulson authored and Daniel Kiper committed 2021-03-02 15:54:19 +01:00
1 parent 4ea7bae51f
commit 133d73079c
6 files changed
+179 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

configure.ac
+39 -5
View File
@@ -1312,12 +1312,41 @@ fi]
CFLAGS="$TARGET_CFLAGS"
# Smashing stack protector.
# Stack smashing protector.
grub_CHECK_STACK_PROTECTOR
# Need that, because some distributions ship compilers that include
# `-fstack-protector' in the default specs.
if test "x$ssp_possible" = xyes; then
TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
AC_ARG_ENABLE([stack-protector],
AS_HELP_STRING([--enable-stack-protector],
[enable the stack protector]),
[],
[enable_stack_protector=no])
if test "x$enable_stack_protector" = xno; then
if test "x$ssp_possible" = xyes; then
# Need that, because some distributions ship compilers that include
# `-fstack-protector' in the default specs.
TARGET_CFLAGS="$TARGET_CFLAGS -fno-stack-protector"
fi
elif test "x$platform" != xefi; then
AC_MSG_ERROR([--enable-stack-protector is only supported on EFI platforms])
elif test "x$ssp_global_possible" != xyes; then
AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -mstack-protector-guard=global)])
else
TARGET_CFLAGS="$TARGET_CFLAGS -mstack-protector-guard=global"
if test "x$enable_stack_protector" = xyes; then
if test "x$ssp_possible" != xyes; then
AC_MSG_ERROR([--enable-stack-protector is not supported (compiler doesn't support -fstack-protector)])
fi
TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector"
elif test "x$enable_stack_protector" = xstrong; then
if test "x$ssp_strong_possible" != xyes; then
AC_MSG_ERROR([--enable-stack-protector=strong is not supported (compiler doesn't support -fstack-protector-strong)])
fi
TARGET_CFLAGS="$TARGET_CFLAGS -fstack-protector-strong"
else
# Note, -fstack-protector-all requires that the protector is disabled for
# functions that appear in the call stack when the canary is initialized.
AC_MSG_ERROR([invalid value $enable_stack_protector for --enable-stack-protector])
fi
TARGET_CPPFLAGS="$TARGET_CPPFLAGS -DGRUB_STACK_PROTECTOR=1"
fi
CFLAGS="$TARGET_CFLAGS"
@@ -2132,5 +2161,10 @@ echo "Without liblzma (no support for XZ-compressed mips images) ($liblzma_excus
else
echo "With liblzma from $LIBLZMA (support for XZ-compressed mips images)"
fi
if test "x$enable_stack_protector" != xno; then
echo "With stack smashing protector: Yes"
else
echo "With stack smashing protector: No"
fi
echo "*******************************************************"
]