linux-kernel - [tip: x86/build] arch/x86/boot: Use prefix map to avoid embedded paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 01 Oct 2019 09:35:07 -0000
From:   "tip-bot2 for Bruce Ashfield" <tip-bot2@...utronix.de>
To:     linux-tip-commits@...r.kernel.org
Cc:     Bruce Ashfield <bruce.ashfield@...il.com>,
        Ross Burton <ross.burton@...el.com>,
        Borislav Petkov <bp@...e.de>, "H. Peter Anvin" <hpa@...or.com>,
        George Rimar <grimar@...esssoftek.com>,
        Ingo Molnar <mingo@...hat.com>,
        Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Nathan Chancellor <natechancellor@...il.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "x86-ml" <x86@...nel.org>, Ingo Molnar <mingo@...nel.org>,
        Borislav Petkov <bp@...en8.de>, linux-kernel@...r.kernel.org
Subject: [tip: x86/build] arch/x86/boot: Use prefix map to avoid embedded paths

The following commit has been merged into the x86/build branch of tip:

Commit-ID:     9e2276fa6eb39817dcc4cda415f0199fb7016b37
Gitweb:        https://git.kernel.org/tip/9e2276fa6eb39817dcc4cda415f0199fb7016b37
Author:        Bruce Ashfield <bruce.ashfield@...il.com>
AuthorDate:    Thu, 26 Sep 2019 10:32:26 +01:00
Committer:     Borislav Petkov <bp@...e.de>
CommitterDate: Tue, 01 Oct 2019 11:19:40 +02:00

arch/x86/boot: Use prefix map to avoid embedded paths

It was observed that the kernel embeds the absolute build path in the
x86 boot image when the __FILE__ macro is expanded.

> From https://bugzilla.yoctoproject.org/show_bug.cgi?id=13458:

  If you turn on the buildpaths QA test, or try a reproducible build, you
  discover that the kernel image contains build paths.

  $ strings bzImage-5.0.19-yocto-standard |grep tmp/
  out of pgt_buf in
  /data/poky-tmp/reproducible/tmp/work-shared/qemux86-64/kernel-source/arch/x86/boot/compressed/kaslr_64.c!?

  But what's this in the top-level Makefile:

  $ git grep prefix-map
  Makefile:KBUILD_CFLAGS  += $(call
  cc-option,-fmacro-prefix-map=$(srctree)/=)

  So the __FILE__ shouldn't be using the full path.  However
  arch/x86/boot/compressed/Makefile has this:

  KBUILD_CFLAGS := -m$(BITS) -O2

  So that clears KBUILD_FLAGS, removing the -fmacro-prefix-map option.

Use -fmacro-prefix-map to have relative paths in the boot image too.

 [ bp: Massage commit message and put the KBUILD_CFLAGS addition in
   ..boot/Makefile after the KBUILD_AFLAGS assignment because gas
   doesn't support -fmacro-prefix-map. ]

Signed-off-by: Bruce Ashfield <bruce.ashfield@...il.com>
Signed-off-by: Ross Burton <ross.burton@...el.com>
Signed-off-by: Borislav Petkov <bp@...e.de>
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: George Rimar <grimar@...esssoftek.com>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc: Nathan Chancellor <natechancellor@...il.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: x86-ml <x86@...nel.org>
Link: https://lkml.kernel.org/r/20190926093226.8568-1-ross.burton@intel.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204333
---
 arch/x86/boot/Makefile            | 1 +
 arch/x86/boot/compressed/Makefile | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index e2839b5..3e9f554 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -67,6 +67,7 @@ clean-files += cpustr.h
 
 KBUILD_CFLAGS	:= $(REALMODE_CFLAGS) -D_SETUP
 KBUILD_AFLAGS	:= $(KBUILD_CFLAGS) -D__ASSEMBLY__
+KBUILD_CFLAGS	+= $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
 GCOV_PROFILE := n
 UBSAN_SANITIZE := n
 
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 6b84afd..b246f18 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -38,6 +38,7 @@ KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
 KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member)
 KBUILD_CFLAGS += $(call cc-disable-warning, gnu)
 KBUILD_CFLAGS += -Wno-pointer-sign
+KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
 
 KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
 GCOV_PROFILE := n