There will be a new option in gcc 4.9 named
-fstack-protector-strong , which offers an improved version of
-fstack-protector without going all the way to
-fstack-protector-all . The stack protector feature itself adds a known canary to the stack during function preamble, and checks it when the function returns. If it changed, there was a stack overflow, and the program aborts. This is fine, but figuring out when to include it is the reason behind the various options.
Since traditionally stack overflows happen with string-based manipulations, the default (
-fstack-protector), only includes the canary code when a function defines an 8 (
--param=ssp-buffer-size=N, N=8 by default) or more byte local character array. This means just a few functions get the checking, but they re probably the most likely to need it, so it s an okay balance. Various distributions ended up lowering their default
--param=ssp-buffer-size option down to 4, since there were still cases of functions that should have been protected but the conservative gcc upstream default of 8 wasn t covering them.
However, even with the increased function coverage, there are rare cases when a stack overflow happens on other kinds of stack variables. To handle this more paranoid concern,
-fstack-protector-all was defined to add the canary to all functions. This results in substantial use of stack space for saving the canary on deep stack users, and measurable (though surprisingly still relatively low) performance hit due to all the saving/checking. For a long time, Chrome OS used this, since we re paranoid. :)
In the interest of gaining back some of the lost performance and not hitting our Chrome OS build images with such a giant stack-protector hammer, Han Shen from the Chrome OS compiler team
created the new option
-fstack-protector-strong, which enables the canary in many more
conditions:
- local variable s address used as part of the right hand side of an assignment or function argument
- local variable is an array (or union containing an array), regardless of array type or length
- uses register local variables
This meant we were covering all the more paranoid conditions that might lead to a stack overflow. Chrome OS has been using this option instead of
-fstack-protector-all for about 10 months now.
As a quick demonstration of the options, you can see this example program under various conditions. It tries to show off an example of shoving serialized data into a non-character variable, like might happen in some network address manipulations or streaming data parsing. Since I m using
memcpy here for clarity, the builds will need to turn off FORTIFY_SOURCE, which would also notice the overflow.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
struct no_chars
unsigned int len;
unsigned int data;
;
int main(int argc, char * argv[])
struct no_chars info = ;
if (argc < 3)
fprintf(stderr, "Usage: %s LENGTH DATA...\n", argv[0]);
return 1;
info.len = atoi(argv[1]);
memcpy(&info.data, argv[2], info.len);
return 0;
Built with everything disabled, this faults trying to return to an invalid VMA:
$ gcc -Wall -O2 -U_FORTIFY_SOURCE -fno-stack-protector /tmp/boom.c -o /tmp/boom
$ /tmp/boom 64 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault (core dumped)
Built with FORTIFY_SOURCE enabled, we see the expected catch of the overflow in
memcpy:
$ gcc -Wall -O2 -D_FORTIFY_SOURCE=2 -fno-stack-protector /tmp/boom.c -o /tmp/boom
$ /tmp/boom 64 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** buffer overflow detected ***: /tmp/boom terminated
...
So, we ll leave FORTIFY_SOURCE disabled for our comparisons. With pre-4.9 gcc, we can see that
-fstack-protector does not get triggered to protect this function:
$ gcc -Wall -O2 -U_FORTIFY_SOURCE -fstack-protector /tmp/boom.c -o /tmp/boom
$ /tmp/boom 64 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault (core dumped)
However, using
-fstack-protector-all does trigger the protection, as expected:
$ gcc -Wall -O2 -U_FORTIFY_SOURCE -fstack-protector-all /tmp/boom.c -o /tmp/boom
$ /tmp/boom 64 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** stack smashing detected ***: /tmp/boom terminated
Aborted (core dumped)
And finally, using the gcc snapshot of 4.9, here is
-fstack-protector-strong doing its job:
$ /usr/lib/gcc-snapshot/bin/gcc -Wall -O2 -U_FORTIFY_SOURCE -fstack-protector-strong /tmp/boom.c -o /tmp/boom
$ /tmp/boom 64 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** stack smashing detected ***: /tmp/boom terminated
Aborted (core dumped)
For Linux 3.14, I ve
added support for
-fstack-protector-strong via the new
CONFIG_CC_STACKPROTECTOR_STRONG option. The old
CONFIG_CC_STACKPROTECTOR will be available as
CONFIG_CC_STACKPROTECTOR_REGULAR. When comparing the results on builds via
size and
objdump -d analysis, here s what I found with gcc 4.9:
A normal x86_64 defconfig build, without stack protector had a kernel text size of 11430641 bytes with 36110 function bodies. Adding
CONFIG_CC_STACKPROTECTOR_REGULAR increased the kernel text size to 11468490 (a +0.33% change), with 1015 of 36110 functions stack-protected (2.81%). Using
CONFIG_CC_STACKPROTECTOR_STRONG increased the kernel text size to 11692790 (+2.24%), with 7401 of 36110 functions stack-protected (20.5%). And 20% is a far-cry from 100% if support for
-fstack-protector-all was added back to the kernel.
The next bit of work will be figuring out the best way to detect the version of gcc in use when doing Debian package builds, and using
-fstack-protector-strong instead of
-fstack-protector. For Ubuntu, it s much simpler because it ll just be the compiler default.
2014, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
Now that the madness is mostly
over, I have some time to catch up on reading my newspaper.
Last week, one article in De Standaard talks about the
nuclear weapons on Belgian soil which officially didn't exist (until
wikileaks proved otherwise) and which are now apparently going to be
modernized. The newer model would be "nuclear precision weapons".
Ignoring the question of whether today's world still requires nuclear
bombs (this may or may not be true, I don't care), I question the logic
which leads to that phrase. A nuclear weapon is a weapon of mass
destruction. By definition, a weapon of mass destruction causes
collateral damage. By definition, a precision weapon is a weapon that
does not cause collateral damage or, at the very lease,
where every effort is made to limit the amount of collateral damage.
Even the very first nuclear bombs were capable of destroying entire
cities. Today's nuclear weapons, even the smaller ones, are far more
powerful than those.
Don't get me wrong: I'm not a peace activist. In fact, I have been
contracted by companies who produce military equipment, and don't feel
bad about that. But to claim that it is possible to create "nuclear
precision weapons" is to deceive oneself. A nuclear weapon is
not very precise.
Human nature is hard to change. Very hard. We can talk about it for ages, but mistakes repeat again and again. In the end it's mostly by mistakes how we learn, so I doubt this could ever be changed without losing our own nature. One of these is trying to fix some social issue with a technical measure. Unfortunately, given the technical orientation of most of the developers, this appears from time to time in our Debian private mailing list, and yesterday I realized it's our own version of 
Another busy day today.
I saw my girlfriend off in the morning, and then got stuck into cleaning the
bathrooms. I ducked out to Jaycar to have another attempt at getting
components.
Got home, did some more cleaning, and had my chiropractic adjustment.
Then I had my exit interview for work via video conference, and did some
administrivia while I still had my work computer.
Then the guy from Pack & Send came to take all the work equipment away. Now
I feel very disconnected.
Had some lunch, did more cleaning. Mum and Dad came around to go with me for
pick up today, so they could see the new Kindergarten.
Zoe was again fast asleep at pick up, and the kids who were awake were all in
the other room eating birthday cake, so we let Zoe wake up as gently as
possible and then collected Megan and squeezed everyone into the car and headed
home.
Zoe and Megan had a great time playing with each other again, and Megan's Dad
picked her up at about 4:30pm and I started on dinner.
We all had dinner and then Mum and Dad headed off, and I gave Zoe a bath and
put her to bed. She was a bit emotional at bedtime, so it took a while to
get her settled. Here's hoping she sleeps okay tonight.
A new major release 0.4.0 of
Another 3 hours later, the most obvious bugs were weeded out and the code
successfully cloned an entire mirror for the first time. I verified the
correctness by running debmirror afterwards, and no files were downloaded that
had not actually arrived on the mirror in the meantime.
Features
Just to recap my life since December:
