This commit is contained in:
parent
1327d1915a
commit
56734f4b27
|
@ -26,6 +26,9 @@ OSX_QT_TRANSLATIONS = da,de,es,hu,ru,uk,zh_CN,zh_TW
|
|||
|
||||
DIST_DOCS = $(wildcard doc/*.md) $(wildcard doc/release-notes/*.md)
|
||||
|
||||
BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
|
||||
$(top_srcdir)/contrib/devtools/security-check.py
|
||||
|
||||
WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \
|
||||
$(top_srcdir)/share/pixmaps/nsis-header.bmp \
|
||||
$(top_srcdir)/share/pixmaps/nsis-wizard.bmp \
|
||||
|
@ -222,7 +225,7 @@ endif
|
|||
|
||||
dist_noinst_SCRIPTS = autogen.sh
|
||||
|
||||
EXTRA_DIST = $(top_srcdir)/share/genbuild.sh qa/pull-tester/rpc-tests.sh qa/pull-tester/run-bitcoin-cli qa/rpc-tests qa/zcash $(DIST_DOCS) $(WINDOWS_PACKAGING) $(OSX_PACKAGING)
|
||||
EXTRA_DIST = $(top_srcdir)/share/genbuild.sh qa/pull-tester/rpc-tests.sh qa/pull-tester/run-bitcoin-cli qa/rpc-tests qa/zcash $(DIST_DOCS) $(WINDOWS_PACKAGING) $(OSX_PACKAGING) $(BIN_CHECKS)
|
||||
|
||||
CLEANFILES = $(OSX_DMG) $(BITCOIN_WIN_INSTALLER)
|
||||
|
||||
|
|
|
@ -69,6 +69,8 @@ AC_PATH_PROG([GIT], [git])
|
|||
AC_PATH_PROG(CCACHE,ccache)
|
||||
AC_PATH_PROG(XGETTEXT,xgettext)
|
||||
AC_PATH_PROG(HEXDUMP,hexdump)
|
||||
AC_PATH_TOOL(READELF,readelf)
|
||||
AC_PATH_TOOL(CPPFILT,c++filt)
|
||||
|
||||
dnl pkg-config check.
|
||||
PKG_PROG_PKG_CONFIG
|
||||
|
@ -896,6 +898,7 @@ AM_CONDITIONAL([USE_LCOV],[test x$use_lcov = xyes])
|
|||
AM_CONDITIONAL([USE_COMPARISON_TOOL],[test x$use_comparison_tool != xno])
|
||||
AM_CONDITIONAL([USE_COMPARISON_TOOL_REORG_TESTS],[test x$use_comparison_tool_reorg_test != xno])
|
||||
AM_CONDITIONAL([GLIBC_BACK_COMPAT],[test x$use_glibc_compat = xyes])
|
||||
AM_CONDITIONAL([HARDEN],[test x$use_hardening = xyes])
|
||||
|
||||
AC_DEFINE(CLIENT_VERSION_MAJOR, _CLIENT_VERSION_MAJOR, [Major version])
|
||||
AC_DEFINE(CLIENT_VERSION_MINOR, _CLIENT_VERSION_MINOR, [Minor version])
|
||||
|
|
|
@ -0,0 +1,181 @@
|
|||
#!/usr/bin/python2
|
||||
'''
|
||||
Perform basic ELF security checks on a series of executables.
|
||||
Exit status will be 0 if successful, and the program will be silent.
|
||||
Otherwise the exit status will be 1 and it will log which executables failed which checks.
|
||||
Needs `readelf` (for ELF) and `objdump` (for PE).
|
||||
'''
|
||||
from __future__ import division,print_function,unicode_literals
|
||||
import subprocess
|
||||
import sys
|
||||
import os
|
||||
|
||||
READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
|
||||
OBJDUMP_CMD = os.getenv('OBJDUMP', '/usr/bin/objdump')
|
||||
|
||||
def check_ELF_PIE(executable):
|
||||
'''
|
||||
Check for position independent executable (PIE), allowing for address space randomization.
|
||||
'''
|
||||
p = subprocess.Popen([READELF_CMD, '-h', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if p.returncode:
|
||||
raise IOError('Error opening file')
|
||||
|
||||
ok = False
|
||||
for line in stdout.split(b'\n'):
|
||||
line = line.split()
|
||||
if len(line)>=2 and line[0] == b'Type:' and line[1] == b'DYN':
|
||||
ok = True
|
||||
return ok
|
||||
|
||||
def get_ELF_program_headers(executable):
|
||||
'''Return type and flags for ELF program headers'''
|
||||
p = subprocess.Popen([READELF_CMD, '-l', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if p.returncode:
|
||||
raise IOError('Error opening file')
|
||||
in_headers = False
|
||||
count = 0
|
||||
headers = []
|
||||
for line in stdout.split(b'\n'):
|
||||
if line.startswith(b'Program Headers:'):
|
||||
in_headers = True
|
||||
if line == b'':
|
||||
in_headers = False
|
||||
if in_headers:
|
||||
if count == 1: # header line
|
||||
ofs_typ = line.find(b'Type')
|
||||
ofs_offset = line.find(b'Offset')
|
||||
ofs_flags = line.find(b'Flg')
|
||||
ofs_align = line.find(b'Align')
|
||||
if ofs_typ == -1 or ofs_offset == -1 or ofs_flags == -1 or ofs_align == -1:
|
||||
raise ValueError('Cannot parse elfread -lW output')
|
||||
elif count > 1:
|
||||
typ = line[ofs_typ:ofs_offset].rstrip()
|
||||
flags = line[ofs_flags:ofs_align].rstrip()
|
||||
headers.append((typ, flags))
|
||||
count += 1
|
||||
return headers
|
||||
|
||||
def check_ELF_NX(executable):
|
||||
'''
|
||||
Check that no sections are writable and executable (including the stack)
|
||||
'''
|
||||
have_wx = False
|
||||
have_gnu_stack = False
|
||||
for (typ, flags) in get_ELF_program_headers(executable):
|
||||
if typ == b'GNU_STACK':
|
||||
have_gnu_stack = True
|
||||
if b'W' in flags and b'E' in flags: # section is both writable and executable
|
||||
have_wx = True
|
||||
return have_gnu_stack and not have_wx
|
||||
|
||||
def check_ELF_RELRO(executable):
|
||||
'''
|
||||
Check for read-only relocations.
|
||||
GNU_RELRO program header must exist
|
||||
Dynamic section must have BIND_NOW flag
|
||||
'''
|
||||
have_gnu_relro = False
|
||||
for (typ, flags) in get_ELF_program_headers(executable):
|
||||
# Note: not checking flags == 'R': here as linkers set the permission differently
|
||||
# This does not affect security: the permission flags of the GNU_RELRO program header are ignored, the PT_LOAD header determines the effective permissions.
|
||||
# However, the dynamic linker need to write to this area so these are RW.
|
||||
# Glibc itself takes care of mprotecting this area R after relocations are finished.
|
||||
# See also http://permalink.gmane.org/gmane.comp.gnu.binutils/71347
|
||||
if typ == b'GNU_RELRO':
|
||||
have_gnu_relro = True
|
||||
|
||||
have_bindnow = False
|
||||
p = subprocess.Popen([READELF_CMD, '-d', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if p.returncode:
|
||||
raise IOError('Error opening file')
|
||||
for line in stdout.split(b'\n'):
|
||||
tokens = line.split()
|
||||
if len(tokens)>1 and tokens[1] == b'(BIND_NOW)' or (len(tokens)>2 and tokens[1] == b'(FLAGS)' and b'BIND_NOW' in tokens[2]):
|
||||
have_bindnow = True
|
||||
return have_gnu_relro and have_bindnow
|
||||
|
||||
def check_ELF_Canary(executable):
|
||||
'''
|
||||
Check for use of stack canary
|
||||
'''
|
||||
p = subprocess.Popen([READELF_CMD, '--dyn-syms', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if p.returncode:
|
||||
raise IOError('Error opening file')
|
||||
ok = False
|
||||
for line in stdout.split(b'\n'):
|
||||
if b'__stack_chk_fail' in line:
|
||||
ok = True
|
||||
return ok
|
||||
|
||||
def get_PE_dll_characteristics(executable):
|
||||
'''
|
||||
Get PE DllCharacteristics bits
|
||||
'''
|
||||
p = subprocess.Popen([OBJDUMP_CMD, '-x', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
if p.returncode:
|
||||
raise IOError('Error opening file')
|
||||
for line in stdout.split('\n'):
|
||||
tokens = line.split()
|
||||
if len(tokens)>=2 and tokens[0] == 'DllCharacteristics':
|
||||
return int(tokens[1],16)
|
||||
return 0
|
||||
|
||||
|
||||
def check_PE_PIE(executable):
|
||||
'''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)'''
|
||||
return bool(get_PE_dll_characteristics(executable) & 0x40)
|
||||
|
||||
def check_PE_NX(executable):
|
||||
'''NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP)'''
|
||||
return bool(get_PE_dll_characteristics(executable) & 0x100)
|
||||
|
||||
CHECKS = {
|
||||
'ELF': [
|
||||
('PIE', check_ELF_PIE),
|
||||
('NX', check_ELF_NX),
|
||||
('RELRO', check_ELF_RELRO),
|
||||
('Canary', check_ELF_Canary)
|
||||
],
|
||||
'PE': [
|
||||
('PIE', check_PE_PIE),
|
||||
('NX', check_PE_NX)
|
||||
]
|
||||
}
|
||||
|
||||
def identify_executable(executable):
|
||||
with open(filename, 'rb') as f:
|
||||
magic = f.read(4)
|
||||
if magic.startswith(b'MZ'):
|
||||
return 'PE'
|
||||
elif magic.startswith(b'\x7fELF'):
|
||||
return 'ELF'
|
||||
return None
|
||||
|
||||
if __name__ == '__main__':
|
||||
retval = 0
|
||||
for filename in sys.argv[1:]:
|
||||
try:
|
||||
etype = identify_executable(filename)
|
||||
if etype is None:
|
||||
print('%s: unknown format' % filename)
|
||||
retval = 1
|
||||
continue
|
||||
|
||||
failed = []
|
||||
for (name, func) in CHECKS[etype]:
|
||||
if not func(filename):
|
||||
failed.append(name)
|
||||
if failed:
|
||||
print('%s: failed %s' % (filename, ' '.join(failed)))
|
||||
retval = 1
|
||||
except IOError:
|
||||
print('%s: cannot open' % filename)
|
||||
retval = 1
|
||||
exit(retval)
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
#!/usr/bin/python2
|
||||
'''
|
||||
Test script for security-check.py
|
||||
'''
|
||||
from __future__ import division,print_function
|
||||
import subprocess
|
||||
import sys
|
||||
import unittest
|
||||
|
||||
def write_testcode(filename):
|
||||
with open(filename, 'w') as f:
|
||||
f.write('''
|
||||
#include <stdio.h>
|
||||
int main()
|
||||
{
|
||||
printf("the quick brown fox jumps over the lazy god\\n");
|
||||
return 0;
|
||||
}
|
||||
''')
|
||||
|
||||
def call_security_check(cc, source, executable, options):
|
||||
subprocess.check_call([cc,source,'-o',executable] + options)
|
||||
p = subprocess.Popen(['./security-check.py',executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
|
||||
(stdout, stderr) = p.communicate()
|
||||
return (p.returncode, stdout.rstrip())
|
||||
|
||||
class TestSecurityChecks(unittest.TestCase):
|
||||
def test_ELF(self):
|
||||
source = 'test1.c'
|
||||
executable = 'test1'
|
||||
cc = 'gcc'
|
||||
write_testcode(source)
|
||||
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro']),
|
||||
(1, executable+': failed PIE NX RELRO Canary'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro']),
|
||||
(1, executable+': failed PIE RELRO Canary'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro']),
|
||||
(1, executable+': failed PIE RELRO'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE']),
|
||||
(1, executable+': failed RELRO'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE']),
|
||||
(0, ''))
|
||||
|
||||
def test_PE(self):
|
||||
source = 'test1.c'
|
||||
executable = 'test1.exe'
|
||||
cc = 'i686-w64-mingw32-gcc'
|
||||
write_testcode(source)
|
||||
|
||||
self.assertEqual(call_security_check(cc, source, executable, []),
|
||||
(1, executable+': failed PIE NX'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat']),
|
||||
(1, executable+': failed PIE'))
|
||||
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--dynamicbase']),
|
||||
(0, ''))
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
|
|
@ -103,6 +103,7 @@ script: |
|
|||
|
||||
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
|
||||
make ${MAKEOPTS}
|
||||
make ${MAKEOPTS} -C src check-security
|
||||
make install-strip
|
||||
cd installed
|
||||
find . -name "lib*.la" -delete
|
||||
|
|
|
@ -100,6 +100,7 @@ script: |
|
|||
|
||||
./configure --prefix=${BASEPREFIX}/${i} --bindir=${INSTALLPATH}/bin --includedir=${INSTALLPATH}/include --libdir=${INSTALLPATH}/lib --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS}
|
||||
make ${MAKEOPTS}
|
||||
make ${MAKEOPTS} -C src check-security
|
||||
make deploy
|
||||
make install-strip
|
||||
cp -f bitcoin-*setup*.exe $OUTDIR/
|
||||
|
|
|
@ -4,12 +4,12 @@ set -e
|
|||
|
||||
REPOROOT="$(readlink -f "$(dirname "$0")"/../../)"
|
||||
|
||||
function test_basic_hardening {
|
||||
if "${REPOROOT}/qa/zcash/checksec.sh" --file "$1" | grep -q "Full RELRO.*Canary found.*NX enabled.*No RPATH.*No RUNPATH"; then
|
||||
echo PASS: "$1" has basic hardening features enabled.
|
||||
function test_rpath_runpath {
|
||||
if "${REPOROOT}/qa/zcash/checksec.sh" --file "$1" | grep -q "No RPATH.*No RUNPATH"; then
|
||||
echo PASS: "$1" has no RPATH or RUNPATH.
|
||||
return 0
|
||||
else
|
||||
echo FAIL: "$1" is missing basic hardening features.
|
||||
echo FAIL: "$1" has an RPATH or a RUNPATH.
|
||||
"${REPOROOT}/qa/zcash/checksec.sh" --file "$1"
|
||||
return 1
|
||||
fi
|
||||
|
@ -26,10 +26,15 @@ function test_fortify_source {
|
|||
fi
|
||||
}
|
||||
|
||||
test_basic_hardening "${REPOROOT}/src/zcashd"
|
||||
test_basic_hardening "${REPOROOT}/src/zcash-cli"
|
||||
test_basic_hardening "${REPOROOT}/src/zcash-gtest"
|
||||
test_basic_hardening "${REPOROOT}/src/bitcoin-tx"
|
||||
# PIE, RELRO, Canary, and NX are tested by make check-security.
|
||||
make -C "$REPOROOT/src" check-security
|
||||
|
||||
test_rpath_runpath "${REPOROOT}/src/zcashd"
|
||||
test_rpath_runpath "${REPOROOT}/src/zcash-cli"
|
||||
test_rpath_runpath "${REPOROOT}/src/zcash-gtest"
|
||||
test_rpath_runpath "${REPOROOT}/src/bitcoin-tx"
|
||||
test_rpath_runpath "${REPOROOT}/src/test/test_bitcoin"
|
||||
test_rpath_runpath "${REPOROOT}/src/zcash/GenerateParams"
|
||||
|
||||
# NOTE: checksec.sh does not reliably determine whether FORTIFY_SOURCE is
|
||||
# enabled for the entire binary. See issue #915.
|
||||
|
@ -37,3 +42,5 @@ test_fortify_source "${REPOROOT}/src/zcashd"
|
|||
test_fortify_source "${REPOROOT}/src/zcash-cli"
|
||||
test_fortify_source "${REPOROOT}/src/zcash-gtest"
|
||||
test_fortify_source "${REPOROOT}/src/bitcoin-tx"
|
||||
test_fortify_source "${REPOROOT}/src/test/test_bitcoin"
|
||||
test_fortify_source "${REPOROOT}/src/zcash/GenerateParams"
|
||||
|
|
|
@ -79,7 +79,7 @@ LIBZCASH_H = \
|
|||
zcash/prf.h \
|
||||
zcash/util.h
|
||||
|
||||
.PHONY: FORCE
|
||||
.PHONY: FORCE check-security
|
||||
# bitcoin core #
|
||||
BITCOIN_CORE_H = \
|
||||
addrman.h \
|
||||
|
@ -469,6 +469,12 @@ clean-local:
|
|||
$(AM_V_CXX) $(OBJCXX) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
|
||||
$(CPPFLAGS) $(AM_CXXFLAGS) $(QT_INCLUDES) $(CXXFLAGS) -c -o $@ $<
|
||||
|
||||
check-security: $(bin_PROGRAMS)
|
||||
if HARDEN
|
||||
@echo "Checking binary security of [$(bin_PROGRAMS)]..."
|
||||
$(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py < $(bin_PROGRAMS)
|
||||
endif
|
||||
|
||||
%.pb.cc %.pb.h: %.proto
|
||||
@test -f $(PROTOC)
|
||||
$(AM_V_GEN) $(PROTOC) --cpp_out=$(@D) --proto_path=$(abspath $(<D) $<)
|
||||
|
|
Loading…
Reference in New Issue