linux-kernel - Re: [kernel-hardening] [PATCH v8 2/4] GCC plugin infrastructure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <573C2CFE.8060305@au1.ibm.com>
Date:	Wed, 18 May 2016 18:51:10 +1000
From:	Andrew Donnellan <andrew.donnellan@....ibm.com>
To:	kernel-hardening@...ts.openwall.com, linux-kbuild@...r.kernel.org
Cc:	pageexec@...email.hu, spender@...ecurity.net, mmarek@...e.com,
	keescook@...omium.org, linux@...musvillemoes.dk,
	fengguang.wu@...el.com, dvyukov@...gle.com,
	linux-kernel@...r.kernel.org, david.brown@...aro.org,
	yamada.masahiro@...ionext.com,
	linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>,
	Michael Ellerman <mpe@...erman.id.au>,
	Daniel Axtens <dja@...ens.net>
Subject: Re: [kernel-hardening] [PATCH v8 2/4] GCC plugin infrastructure

On 13/05/16 09:57, Emese Revfy wrote:
> This patch allows to build the whole kernel with GCC plugins. It was ported from
> grsecurity/PaX. The infrastructure supports building out-of-tree modules and
> building in a separate directory. Cross-compilation is supported too.
> Currently the x86, arm, arm64 and uml architectures enable plugins.
>
> The directory of the gcc plugins is scripts/gcc-plugins. You can use a file or a directory
> there. The plugins compile with these options:
>   * -fno-rtti: gcc is compiled with this option so the plugins must use it too
>   * -fno-exceptions: this is inherited from gcc too
>   * -fasynchronous-unwind-tables: this is inherited from gcc too
>   * -ggdb: it is useful for debugging a plugin (better backtrace on internal
>      errors)
>   * -Wno-narrowing: to suppress warnings from gcc headers (ipa-utils.h)
>   * -Wno-unused-variable: to suppress warnings from gcc headers (gcc_version
>      variable, plugin-version.h)
>
> The infrastructure introduces a new Makefile target called gcc-plugins. It
> supports all gcc versions from 4.5 to 6.0. The scripts/gcc-plugin.sh script
> chooses the proper host compiler (gcc-4.7 can be built by either gcc or g++).
> This script also checks the availability of the included headers in
> scripts/gcc-plugins/gcc-common.h.
>
> The gcc-common.h header contains frequently included headers for GCC plugins
> and it has a compatibility layer for the supported gcc versions.
>
> The gcc-generate-*-pass.h headers automatically generate the registration
> structures for GIMPLE, SIMPLE_IPA, IPA and RTL passes.
>
> Note that 'make clean' keeps the *.so files (only the distclean or mrproper
> targets clean all) because they are needed for out-of-tree modules.
>
> The arm and arm64 architectures were tested by David Brown <david.brown@...aro.org>.
>
> Signed-off-by: Emese Revfy <re.emese@...il.com>

I've done some basic sanity testing on powerpc with the cyclomatic 
complexity plugin (with LE native + cross-compilers) and it seems to 
work with the patch below.

Signed-off-by: Andrew Donnellan <andrew.donnellan@....ibm.com>

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a18a0dc..0cfed5b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -97,6 +97,7 @@ config PPC
         select HAVE_DYNAMIC_FTRACE_WITH_REGS if MPROFILE_KERNEL
         select HAVE_FUNCTION_TRACER
         select HAVE_FUNCTION_GRAPH_TRACER
+       select HAVE_GCC_PLUGINS
         select SYSCTL_EXCEPTION_TRACE
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select VIRT_TO_BUS if !PPC64

-- 
Andrew Donnellan              OzLabs, ADL Canberra
andrew.donnellan@....ibm.com  IBM Australia Limited