Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consider -Wl,-z,separate-code for C and C++ Compiler Hardening Guide #588

Open
thomasnyman opened this issue Aug 22, 2024 · 1 comment
Open

Consider -Wl,-z,separate-code for C and C++ Compiler Hardening Guide #588

thomasnyman opened this issue Aug 22, 2024 · 1 comment
Labels
Enhancement Product: Compiler Hardening Guide

Comments

@thomasnyman
Copy link
Contributor

Splitting this off from Dominik Czarnota's extensive feedback in #330.

The -Wl,-z,separate-code option ensures that the ELF header is not mapped with executable rights. This is effectively a complement to RELRO but instead of applying read-only permissions to sensitive parts of the data segment, it applies read-only permissions to potentially dangerous areas of the code segment.

Resources:
@thomasnyman thomasnyman mentioned this issue Aug 22, 2024
Closed
@thesamesam
Copy link
Contributor

thesamesam commented Aug 27, 2024 •
edited
Loading

Some notes:

@thesamesam thesamesam mentioned this issue Sep 21, 2024
Closed
thesamesam added a commit to thesamesam/wg-best-practices-os-developers that referenced this issue Sep 22, 2024
@thesamesam
Compiler-Options-Hardening-Guide-for-C-and-C++.md: describe linker co…
34ec9d3 
…nfiguration options

Add a section similar to "What should you do when compiling compilers?" but
for linkers.

LLVM doesn't accept new configure (CMake) options for default behaviour
like this and instead asks distributors to use Clang configuration files,
so this section is (currently) only for GNU Binutils.

Per ossf#588, I've
not included separate-code/rosegment, as we should handle that separately
once there is consensus.

Closes: ossf#623
Signed-off-by: Sam James <[email protected]>
@thesamesam thesamesam mentioned this issue Sep 22, 2024
Merged
thesamesam added a commit to thesamesam/wg-best-practices-os-developers that referenced this issue Oct 4, 2024
@thesamesam
Compiler-Options-Hardening-Guide-for-C-and-C++.md: describe linker co…
6ebc871 
…nfiguration options

Add a section similar to "What should you do when compiling compilers?" but
for linkers.

LLVM doesn't accept new configure (CMake) options for default behaviour
like this and instead asks distributors to use Clang configuration files,
so this section is (currently) only for GNU Binutils.

Per ossf#588, I've
not included separate-code/rosegment, as we should handle that separately
once there is consensus.

Closes: ossf#623
Signed-off-by: Sam James <[email protected]>
thomasnyman pushed a commit that referenced this issue Oct 4, 2024
@thesamesam @thomasnyman
Compiler-Options-Hardening-Guide-for-C-and-C++.md: describe linker co…
2cf0a46 
…nfiguration options

Add a section similar to "What should you do when compiling compilers?" but
for linkers.

LLVM doesn't accept new configure (CMake) options for default behaviour
like this and instead asks distributors to use Clang configuration files,
so this section is (currently) only for GNU Binutils.

Per #588, I've
not included separate-code/rosegment, as we should handle that separately
once there is consensus.

Closes: #623
Signed-off-by: Sam James <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Enhancement Product: Compiler Hardening Guide
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@thomasnyman @thesamesam