Hardening

Hardening

[Ludovic Courtès]

Alex Vong <alexvong1995@gmail.com> skribis:

> ludo@gnu.org (Ludovic Courtès) writes:

[...]

>> Alex Vong <alexvong1995@gmail.com> skribis:
>>
>>> From 6ad35e245c374ff828f167bb3467ce68559ccefd Mon Sep 17 00:00:00 2001
>>> From: Alex Vong <alexvong1995@gmail.com>
>>> Date: Sat, 31 Oct 2015 19:44:13 +0800
>>> Subject: [PATCH 1/2] Add (guix build build-flags).
>>>
>>> A module to manipulate build flags, similar to dpkg-buildflags.
>>>
>>> * guix/build/build-flags.scm: New file.
>>> * Makefile.am (MODULES): Register it.
>>
>> [...]
>>
>>> +;;; Module to manipulate build flags, similar to dpkg-buildflags.
>>
>> It doesn’t really help to refer to dpkg-buildflags, at least for me.  ;-)
>>
> Sure, I should have elaborated more on it. What I am looking for are
> ways to avoid repeating a lot of flags in different packages, something
> like `use this set of flags, please'. For example, in Debian, if you
> type
>
> $ dpkg-buildflags --get CFLAGS
>
> you get
>
> -g -O2 -fstack-protector-strong -Wformat -Werror=format-security
>
> which are thr default flags to be exported during package
> build. Moroever, maintainer can alter the default behaviour by setting
> DEB_BUILD_MAINT_OPTIONS. For example,
>
> $ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags --get CFLAGS
>
> will return
>
> -g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security

I see.

My comment was more about the code itself, whose documentation should be
self-contained as much as possible.

[...]

>> I’ve been thinking we should experiment with these various options.  The
>> way I’d do it now would be by running:
>>
>>   ./configure x y z CPPFLAGS=-D_FORTIFY_SOURCE=2 CFLAGS=-fstack-protector
>>
>> This would be just automatically added to #:configure-flags in
>> gnu-build-system.scm.
>>
>> Of course, some packages would ignore them and others would break, but
>> that’s part of the game.  It largely have to be approached on a
>> case-by-case basis.
>>
> Yes, I grep for `fstack-protector-strong' in the guix code base and no
> matches are found. It appears no packages are setting this flag
> currently. I think this flag (perhaps also a couple others) should be
> set by default since they help protect against buffer overflow
> <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.

I definitely agree, that’s something I’ve been wanting to try out.

The question is more how.  Do we change the default #:configure-flags
for ‘gnu-build-system’ to something like:

  '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
    "CFLAGS=-O2 -g -fstack-protector-strong")

?

That sounds like a good starting point, but I expect that (1) one third
of the packages will fail to build, and (2) another third of the
packages will not get these flags, for instance because they pass their
own #:configure-flags.

IOW, it will take a whole rebuild to find out exactly what’s going on
and to fix any issues.

Would you like to start working on it?  Then we could create a branch,
have Hydra build it, and incrementally fix things.

Thanks,
Ludo’.

Re: Hardening

[Leo Famulari]

On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
> Alex Vong <alexvong1995@gmail.com> skribis:
> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
> > matches are found. It appears no packages are setting this flag
> > currently. I think this flag (perhaps also a couple others) should be
> > set by default since they help protect against buffer overflow
> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
> 
> I definitely agree, that’s something I’ve been wanting to try out.
> 
> The question is more how.  Do we change the default #:configure-flags
> for ‘gnu-build-system’ to something like:
> 
>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>     "CFLAGS=-O2 -g -fstack-protector-strong")
> 
> ?
> 
> That sounds like a good starting point, but I expect that (1) one third
> of the packages will fail to build, and (2) another third of the
> packages will not get these flags, for instance because they pass their
> own #:configure-flags.
> 
> IOW, it will take a whole rebuild to find out exactly what’s going on
> and to fix any issues.
> 
> Would you like to start working on it?  Then we could create a branch,
> have Hydra build it, and incrementally fix things.

We should pick this project back up. I was suprised to find we haven't
done anything like this after reading this recent blog post about Nix's
hardening effort:

https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter

Re: Hardening

[Ricardo Wurmus]

Leo Famulari <leo@famulari.name> writes:

> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>> Alex Vong <alexvong1995@gmail.com> skribis:
>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>> > matches are found. It appears no packages are setting this flag
>> > currently. I think this flag (perhaps also a couple others) should be
>> > set by default since they help protect against buffer overflow
>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>> 
>> I definitely agree, that’s something I’ve been wanting to try out.
>> 
>> The question is more how.  Do we change the default #:configure-flags
>> for ‘gnu-build-system’ to something like:
>> 
>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>> 
>> ?
>> 
>> That sounds like a good starting point, but I expect that (1) one third
>> of the packages will fail to build, and (2) another third of the
>> packages will not get these flags, for instance because they pass their
>> own #:configure-flags.
>> 
>> IOW, it will take a whole rebuild to find out exactly what’s going on
>> and to fix any issues.
>> 
>> Would you like to start working on it?  Then we could create a branch,
>> have Hydra build it, and incrementally fix things.
>
> We should pick this project back up. I was suprised to find we haven't
> done anything like this after reading this recent blog post about Nix's
> hardening effort:
>
> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter

Are the above flags the only flags we’d like to play with?  There’s no
harm in letting hydra rebuild the world with these flags on a separate
branch — provided that all build nodes are usable.

~~ Ricardo

Re: Hardening

[Alex Vong]

Hi,

Wow, this was long time ago. I've forgot this completely.

Ricardo Wurmus <rekado@elephly.net> writes:

> Leo Famulari <leo@famulari.name> writes:
>
>> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>>> Alex Vong <alexvong1995@gmail.com> skribis:
>>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>>> > matches are found. It appears no packages are setting this flag
>>> > currently. I think this flag (perhaps also a couple others) should be
>>> > set by default since they help protect against buffer overflow
>>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>>> 
>>> I definitely agree, that’s something I’ve been wanting to try out.
>>> 
>>> The question is more how.  Do we change the default #:configure-flags
>>> for ‘gnu-build-system’ to something like:
>>> 
>>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>>> 
>>> ?
>>> 
>>> That sounds like a good starting point, but I expect that (1) one third
>>> of the packages will fail to build, and (2) another third of the
>>> packages will not get these flags, for instance because they pass their
>>> own #:configure-flags.
>>> 
>>> IOW, it will take a whole rebuild to find out exactly what’s going on
>>> and to fix any issues.
>>> 
>>> Would you like to start working on it?  Then we could create a branch,
>>> have Hydra build it, and incrementally fix things.
>>
>> We should pick this project back up. I was suprised to find we haven't
>> done anything like this after reading this recent blog post about Nix's
>> hardening effort:
>>
>> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter
>
> Are the above flags the only flags we’d like to play with?  There’s no
> harm in letting hydra rebuild the world with these flags on a separate
> branch — provided that all build nodes are usable.
>
There are indeed additional flags (for debian's hardening).


Here is the complete output (from the testing distribution):

alexvong1995@debian:~$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags
CFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2
CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
FCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
FFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
GCJFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now
OBJCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
OBJCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security


The `-fdebug-prefix-map' flag seems to be using the current working
directory.

> ~~ Ricardo

Cheers,
Alex

Re: Hardening

[ng0]

Alex Vong <alexvong1995@gmail.com> writes:

> Hi,
>
> Wow, this was long time ago. I've forgot this completely.
>
> Ricardo Wurmus <rekado@elephly.net> writes:
>
>> Leo Famulari <leo@famulari.name> writes:
>>
>>> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>>>> Alex Vong <alexvong1995@gmail.com> skribis:
>>>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>>>> > matches are found. It appears no packages are setting this flag
>>>> > currently. I think this flag (perhaps also a couple others) should be
>>>> > set by default since they help protect against buffer overflow
>>>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>>>> 
>>>> I definitely agree, that’s something I’ve been wanting to try out.
>>>> 
>>>> The question is more how.  Do we change the default #:configure-flags
>>>> for ‘gnu-build-system’ to something like:
>>>> 
>>>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>>>> 
>>>> ?
>>>> 
>>>> That sounds like a good starting point, but I expect that (1) one third
>>>> of the packages will fail to build, and (2) another third of the
>>>> packages will not get these flags, for instance because they pass their
>>>> own #:configure-flags.
>>>> 
>>>> IOW, it will take a whole rebuild to find out exactly what’s going on
>>>> and to fix any issues.
>>>> 
>>>> Would you like to start working on it?  Then we could create a branch,
>>>> have Hydra build it, and incrementally fix things.
>>>
>>> We should pick this project back up. I was suprised to find we haven't
>>> done anything like this after reading this recent blog post about Nix's
>>> hardening effort:
>>>
>>> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter
>>
>> Are the above flags the only flags we’d like to play with?  There’s no
>> harm in letting hydra rebuild the world with these flags on a separate
>> branch — provided that all build nodes are usable.
>>
> There are indeed additional flags (for debian's hardening).
>
>
> Here is the complete output (from the testing distribution):
>
> alexvong1995@debian:~$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags
> CFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
> CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2
> CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
> FCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
> FFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
> GCJFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
> LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now
> OBJCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
> OBJCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
>
>
> The `-fdebug-prefix-map' flag seems to be using the current working
> directory.
>
>> ~~ Ricardo
>
> Cheers,
> Alex
>

I think there's even more, I can add to this thread when I have access
to my hardened vm systems again.

Good to see that this is being picked up again.
-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: Hardening

[ng0]

ng0 <ng0@we.make.ritual.n0.is> writes:

> Alex Vong <alexvong1995@gmail.com> writes:
>
>> Hi,
>>
>> Wow, this was long time ago. I've forgot this completely.
>>
>> Ricardo Wurmus <rekado@elephly.net> writes:
>>
>>> Leo Famulari <leo@famulari.name> writes:
>>>
>>>> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>>>>> Alex Vong <alexvong1995@gmail.com> skribis:
>>>>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>>>>> > matches are found. It appears no packages are setting this flag
>>>>> > currently. I think this flag (perhaps also a couple others) should be
>>>>> > set by default since they help protect against buffer overflow
>>>>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>>>>> 
>>>>> I definitely agree, that’s something I’ve been wanting to try out.
>>>>> 
>>>>> The question is more how.  Do we change the default #:configure-flags
>>>>> for ‘gnu-build-system’ to something like:
>>>>> 
>>>>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>>>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>>>>> 
>>>>> ?
>>>>> 
>>>>> That sounds like a good starting point, but I expect that (1) one third
>>>>> of the packages will fail to build, and (2) another third of the
>>>>> packages will not get these flags, for instance because they pass their
>>>>> own #:configure-flags.
>>>>> 
>>>>> IOW, it will take a whole rebuild to find out exactly what’s going on
>>>>> and to fix any issues.
>>>>> 
>>>>> Would you like to start working on it?  Then we could create a branch,
>>>>> have Hydra build it, and incrementally fix things.
>>>>
>>>> We should pick this project back up. I was suprised to find we haven't
>>>> done anything like this after reading this recent blog post about Nix's
>>>> hardening effort:
>>>>
>>>> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter
>>>
>>> Are the above flags the only flags we’d like to play with?  There’s no
>>> harm in letting hydra rebuild the world with these flags on a separate
>>> branch — provided that all build nodes are usable.
>>>
>> There are indeed additional flags (for debian's hardening).
>>
>>
>> Here is the complete output (from the testing distribution):
>>
>> alexvong1995@debian:~$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags
>> CFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
>> CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2
>> CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
>> FCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
>> FFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
>> GCJFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong
>> LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now
>> OBJCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
>> OBJCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security
>>
>>
>> The `-fdebug-prefix-map' flag seems to be using the current working
>> directory.
>>
>>> ~~ Ricardo
>>
>> Cheers,
>> Alex
>>
>
> I think there's even more, I can add to this thread when I have access
> to my hardened vm systems again.

I mean there is more, but it depends on what we want. What I can share
is in the direction of Gentoo Hardened
( https://wiki.gentoo.org/wiki/Project:Hardened ,
https://wiki.gentoo.org/wiki/Project:Hardened/PaX_Quickstart )
and there are repos at https://gitweb.gentoo.org of the hardened project
showing the depths you can go to. Depending on what you will apply,
certain applications become difficult to compile but with patches
applied they succeed. Runtime gets difficult once you apply on top of a
PaX enabled kernel with GRSec the addtional useful things like paxctl-ng
for XATTR_PAX markings.

Gentoo hardened has not stabilized the gcc we use and use some other
version as stable, gcc-6 is testing in gentoo if I remember correctly.
If desired, I can setup a hardened gentoo again (my VM is currently
busy) and look at what their patches do in practice.

> Good to see that this is being picked up again.


-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: Hardening

[Alex Vong]

ng0 <ng0@we.make.ritual.n0.is> writes:

> Alex Vong <alexvong1995@gmail.com> writes:
>
>> Hi,
>>
>> Wow, this was long time ago. I've forgot this completely.
>>
>> Ricardo Wurmus <rekado@elephly.net> writes:
>>
>>> Leo Famulari <leo@famulari.name> writes:
>>>
>>>> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>>>>> Alex Vong <alexvong1995@gmail.com> skribis:
>>>>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>>>>> > matches are found. It appears no packages are setting this flag
>>>>> > currently. I think this flag (perhaps also a couple others) should be
>>>>> > set by default since they help protect against buffer overflow
>>>>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>>>>> 
>>>>> I definitely agree, that’s something I’ve been wanting to try out.
>>>>> 
>>>>> The question is more how.  Do we change the default #:configure-flags
>>>>> for ‘gnu-build-system’ to something like:
>>>>> 
>>>>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>>>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>>>>> 
>>>>> ?
>>>>> 
>>>>> That sounds like a good starting point, but I expect that (1) one third
>>>>> of the packages will fail to build, and (2) another third of the
>>>>> packages will not get these flags, for instance because they pass their
>>>>> own #:configure-flags.
>>>>> 
>>>>> IOW, it will take a whole rebuild to find out exactly what’s going on
>>>>> and to fix any issues.
>>>>> 
>>>>> Would you like to start working on it?  Then we could create a branch,
>>>>> have Hydra build it, and incrementally fix things.
>>>>
>>>> We should pick this project back up. I was suprised to find we haven't
>>>> done anything like this after reading this recent blog post about Nix's
>>>> hardening effort:
>>>>
>>>> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter
>>>
>>> Are the above flags the only flags we’d like to play with?  There’s no
>>> harm in letting hydra rebuild the world with these flags on a separate
>>> branch — provided that all build nodes are usable.
>>>
>> There are indeed additional flags (for debian's hardening).
>>
>>
>> Here is the complete output (from the testing distribution):
>>
>> alexvong1995@debian:~$ DEB_BUILD_MAINT_OPTIONS=hardening=+all dpkg-buildflags
>> CFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong -Wformat -Werror=format-security
>> CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2
>> CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong -Wformat -Werror=format-security
>> FCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong
>> FFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong
>> GCJFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong
>> LDFLAGS=-fPIE -pie -Wl,-z,relro -Wl,-z,now
>> OBJCFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong -Wformat -Werror=format-security
>> OBJCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/alexvong1995=. -fPIE
>> -fstack-protector-strong -Wformat -Werror=format-security
>>
>>
>> The `-fdebug-prefix-map' flag seems to be using the current working
>> directory.
>>
>>> ~~ Ricardo
>>
>> Cheers,
>> Alex
>>
>
> I think there's even more, I can add to this thread when I have access
> to my hardened vm systems again.
>
Yes, I think people running guix on top of another distro can tell how
their distro do the hardening, so we can see what are the existing
practices.

> Good to see that this is being picked up again.

Re: Hardening

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>> Alex Vong <alexvong1995@gmail.com> skribis:
>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>> > matches are found. It appears no packages are setting this flag
>> > currently. I think this flag (perhaps also a couple others) should be
>> > set by default since they help protect against buffer overflow
>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>> 
>> I definitely agree, that’s something I’ve been wanting to try out.
>> 
>> The question is more how.  Do we change the default #:configure-flags
>> for ‘gnu-build-system’ to something like:
>> 
>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>> 
>> ?
>> 
>> That sounds like a good starting point, but I expect that (1) one third
>> of the packages will fail to build, and (2) another third of the
>> packages will not get these flags, for instance because they pass their
>> own #:configure-flags.
>> 
>> IOW, it will take a whole rebuild to find out exactly what’s going on
>> and to fix any issues.
>> 
>> Would you like to start working on it?  Then we could create a branch,
>> have Hydra build it, and incrementally fix things.
>
> We should pick this project back up. I was suprised to find we haven't
> done anything like this after reading this recent blog post about Nix's
> hardening effort:
>
> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter

Definitely!  As discussed on IRC, an option would be to add a keyword
parameter to ‘gnu-build-system’:

  #:hardening-flags '(fortify stack-protector)

Then ‘configure’ in (guix build gnu-build-system) would translate that
into CPPFLAGS and CFLAGS options for ‘configure’, as shown above.

The main difficulty with this is that many packages will break.  Thus,
if we make it opt-out, we’ll have to fix packages one by one.  It seems
unavoidable though.

Thoughts?

Ludo’.

Re: Hardening

[ng0]

Ludovic Courtès <ludo@gnu.org> writes:

> Leo Famulari <leo@famulari.name> skribis:
>
>> On Wed, Dec 30, 2015 at 05:06:30PM +0100, Ludovic Courtès wrote:
>>> Alex Vong <alexvong1995@gmail.com> skribis:
>>> > Yes, I grep for `fstack-protector-strong' in the guix code base and no
>>> > matches are found. It appears no packages are setting this flag
>>> > currently. I think this flag (perhaps also a couple others) should be
>>> > set by default since they help protect against buffer overflow
>>> > <https://en.wikipedia.org/wiki/Buffer_overflow_protection>.
>>> 
>>> I definitely agree, that’s something I’ve been wanting to try out.
>>> 
>>> The question is more how.  Do we change the default #:configure-flags
>>> for ‘gnu-build-system’ to something like:
>>> 
>>>   '("CPPFLAGS=-D_FORTIFY_SOURCE=2"
>>>     "CFLAGS=-O2 -g -fstack-protector-strong")
>>> 
>>> ?
>>> 
>>> That sounds like a good starting point, but I expect that (1) one third
>>> of the packages will fail to build, and (2) another third of the
>>> packages will not get these flags, for instance because they pass their
>>> own #:configure-flags.
>>> 
>>> IOW, it will take a whole rebuild to find out exactly what’s going on
>>> and to fix any issues.
>>> 
>>> Would you like to start working on it?  Then we could create a branch,
>>> have Hydra build it, and incrementally fix things.
>>
>> We should pick this project back up. I was suprised to find we haven't
>> done anything like this after reading this recent blog post about Nix's
>> hardening effort:
>>
>> https://blog.mayflower.de/5800-Hardening-Compiler-Flags-for-NixOS.html?utm_source=twitterfeed&utm_medium=twitter
>
> Definitely!  As discussed on IRC, an option would be to add a keyword
> parameter to ‘gnu-build-system’:
>
>   #:hardening-flags '(fortify stack-protector)
>
> Then ‘configure’ in (guix build gnu-build-system) would translate that
> into CPPFLAGS and CFLAGS options for ‘configure’, as shown above.
>
> The main difficulty with this is that many packages will break.  Thus,
> if we make it opt-out, we’ll have to fix packages one by one.  It seems
> unavoidable though.

That's how everyone does it, enable per package or globally, test, apply
system-specific patches. Unavoidable but it works. I think we could
create a branch, let's call it 'hardening', globally harden everything
and see how much fails and how, look at how debian, gentoo, *bsd solve
the hardening fails and fix it for every individual packages.

> Thoughts?
>
> Ludo’.
>

-- 
ng0
For non-prism friendly talk find me on http://www.psyced.org

Re: Hardening

[ng0]

Ricardo Wurmus <rekado@elephly.net> writes:

> Leo Famulari <leo@famulari.name> writes:
>
>> On Tue, Jan 24, 2017 at 08:56:48PM +0000, ng0 wrote:
>>> Leo Famulari <leo@famulari.name> writes:
>>> > Should we build Tor with "--enable-expensive-hardening"?
>>>
>>> I will take a look later what can be applied other than the
>>> default configure flags.
>>>
>>> I'm all for hardening, but it seems that the first basic ideas
>>> for Guix are stuck in the idea state.
>>
>> As far as I can tell, --enable-expensive-hardening is specific to Tor,
>> so it's not relevant to the project of hardening all Guix packages.
>>
>>> It would be great to see some movement on this during this
>>> year. I volunteer to help with it, though I don't have as much
>>> experience with SELinux (and only basic experience with
>>> GrSecurity without a modular kernel like GuixSD uses).
>>
>> Yes, this effort needs a champion.
>
> I know SELinux and I have a couple of almost-ready packages for it.  The
> bigger problem for us is writing SELinux policies, because we cannot
> just use those from Fedora.

Oh, this is good to hear!

> SELinux policies are applied to file paths (which are not stable in
> Guix) and are “remembered” using extended file attributes.  This means
> we’d have to write policies that can deal with arbitrary prefixes and
> we’d have to add an optional service to automatically label all store
> items (that’s expensive but maybe it can be done incrementally).

Oh.

> However, this is completely separate from enabling a configure flag for
> Tor.

That's why I changed the subject of the email, I am aware that
this has nothing to do with tor configure-flags.

-- 
♥Ⓐ  ng0 -- https://www.inventati.org/patternsinthechaos/

Re: Hardening

[Ludovic Courtès]

Hi!

ng0 <contact.ng0@cryptolab.net> skribis:

> For starters, I think we could have an "hardened-wip" branch on
> savannah (I can't commit anyway directly) and that we can target
> SELinux for now, look at Hardened-gentoo and other systems how
> they solve issues.  Afterwards we need to address the toolchain
> level, which to our advantage can be an make and break by hydra
> and everyone who wants to contribute to fixing issues can run
> their system from the hardening-toolchain-wip branch to
> contribute to fixing all the breaking applications.
>
> Then we need to discuss wether we want to provide this by default
> (my choice) OR if we want to offer a branch-choice model.
> Supporting both vanilla and hardened might take some more burden
> on fixing issues, that's why I'm all for forming a team of people
> who work on this, and when they no longer want to, other people
> join the rest of the old team, etc.

Before creating a branch, I think we need a plan.  :-)

Alex Vong proposed ways to achieve it a while back:

  https://lists.gnu.org/archive/html/guix-devel/2015-12/msg00702.html

I suggest taking a look at the discussion and starting from there.

The best option is probably to start small (limited set of
features/flags/options) and then incrementally improve that.

Ludo’.

Re: Hardening

[ng0]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi!
>
> ng0 <contact.ng0@cryptolab.net> skribis:
>
>> For starters, I think we could have an "hardened-wip" branch on
>> savannah (I can't commit anyway directly) and that we can target
>> SELinux for now, look at Hardened-gentoo and other systems how
>> they solve issues.  Afterwards we need to address the toolchain
>> level, which to our advantage can be an make and break by hydra
>> and everyone who wants to contribute to fixing issues can run
>> their system from the hardening-toolchain-wip branch to
>> contribute to fixing all the breaking applications.
>>
>> Then we need to discuss wether we want to provide this by default
>> (my choice) OR if we want to offer a branch-choice model.
>> Supporting both vanilla and hardened might take some more burden
>> on fixing issues, that's why I'm all for forming a team of people
>> who work on this, and when they no longer want to, other people
>> join the rest of the old team, etc.
>
> Before creating a branch, I think we need a plan.  :-)
>
> Alex Vong proposed ways to achieve it a while back:
>
>   https://lists.gnu.org/archive/html/guix-devel/2015-12/msg00702.html
>
> I suggest taking a look at the discussion and starting from there.

Okay, I did and I don't see right now how this new (guix build
build-flags) module would be applied to the gnu build system for
example.
Would the (gnu build system) just use it somehow? I'd like to
test it, but I didn't write it.

I also would like to rename it to (guix build build-flags-glibc)
(or -gcc) as I want to see a point where we have more than just
glibc. We don't have to build them (the substitutes,packages) all
on hydra. musl and uclibc-ng can be without substitutes as long
as the means of distribution or diskspace are not working out for us.
And both can (and will) get hardened builds aswell.

> The best option is probably to start small (limited set of
> features/flags/options) and then incrementally improve that.
>
> Ludo’.

-- 
ng0 -- https://www.inventati.org/patternsinthechaos/

Re: Hardening

[ng0]

ng0 <contact.ng0@cryptolab.net> writes:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Hi!
>>
>> ng0 <contact.ng0@cryptolab.net> skribis:
>>
>>> For starters, I think we could have an "hardened-wip" branch on
>>> savannah (I can't commit anyway directly) and that we can target
>>> SELinux for now, look at Hardened-gentoo and other systems how
>>> they solve issues.  Afterwards we need to address the toolchain
>>> level, which to our advantage can be an make and break by hydra
>>> and everyone who wants to contribute to fixing issues can run
>>> their system from the hardening-toolchain-wip branch to
>>> contribute to fixing all the breaking applications.
>>>
>>> Then we need to discuss wether we want to provide this by default
>>> (my choice) OR if we want to offer a branch-choice model.
>>> Supporting both vanilla and hardened might take some more burden
>>> on fixing issues, that's why I'm all for forming a team of people
>>> who work on this, and when they no longer want to, other people
>>> join the rest of the old team, etc.
>>
>> Before creating a branch, I think we need a plan.  :-)
>>
>> Alex Vong proposed ways to achieve it a while back:
>>
>>   https://lists.gnu.org/archive/html/guix-devel/2015-12/msg00702.html
>>
>> I suggest taking a look at the discussion and starting from there.
>
> Okay, I did and I don't see right now how this new (guix build
> build-flags) module would be applied to the gnu build system for
> example.
> Would the (gnu build system) just use it somehow? I'd like to
> test it, but I didn't write it.

Sorry, correction:
I must have skipped the explanation at the beginning, I do
understand it.
And it makes sense… it's in the interest of my blend of GuixSD,
so unless someone really has a burning desire to work on this, I
will try to produce something functional with changes to the
build system(s) to use hardened flags by default, with opt-out
for: other build-systems I do not understand, and whatnot.
There's no harm in not providing something like:

  #:hardened? #f

for those applications which still need to be patched, but I
prefer to fix rather than provide the easy way out.

> I also would like to rename it to (guix build build-flags-glibc)
> (or -gcc) as I want to see a point where we have more than just
> glibc. We don't have to build them (the substitutes,packages) all
> on hydra. musl and uclibc-ng can be without substitutes as long
> as the means of distribution or diskspace are not working out for us.
> And both can (and will) get hardened builds aswell.
>
>> The best option is probably to start small (limited set of
>> features/flags/options) and then incrementally improve that.
>>
>> Ludo’.
>
> -- 
> ng0 -- https://www.inventati.org/patternsinthechaos/

-- 
ng0 -- https://www.inventati.org/patternsinthechaos/

hardening

[ng0]

Hi,

as we've long talked and not really taken action on hardening builds
I've started working on an opt-in way as last discussed in
september 2016, modifying the gnu-build-system with a
#:hardening-flags keyword.

For my testing purposes I will use

> CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,now -Wl,-z,relro"

which is used by Gentoo, but adjustments (wether to opt-in or
opt-out) will be made.
-- 
ng0 :: https://ea.n0.is
A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/

Re: hardening

[Joshua Branson]

Is this something anyone can start using now?  Like I can modify my config.scm file somehow and start enjoying a hardened guix?

On Mon, Jan 29, 2018, at 4:44 AM, ng0@n0.is wrote:
> Hi,
> 
> as we've long talked and not really taken action on hardening builds
> I've started working on an opt-in way as last discussed in
> september 2016, modifying the gnu-build-system with a
> #:hardening-flags keyword.
> 
> For my testing purposes I will use
> 
> > CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> 
> which is used by Gentoo, but adjustments (wether to opt-in or
> opt-out) will be made.
> -- 
> ng0 :: https://ea.n0.is
> A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/
> 

Re: hardening

[ng0]

Hi,

On Mon, 29 Jan 2018, Joshua Branson <jbranso@fastmail.com> wrote:
> Is this something anyone can start using now?  Like I can modify my config.scm file somehow and start enjoying a hardened guix?

Sorry to disappoint you, I'd like to have it usable also right
now :) But: no. This takes some time and testing. I'll send
patches as soon as I have something to go with, today I only had
breakage on the bootstrap level ;)

> On Mon, Jan 29, 2018, at 4:44 AM, ng0@n0.is wrote:
>> Hi,
>> 
>> as we've long talked and not really taken action on hardening builds
>> I've started working on an opt-in way as last discussed in
>> september 2016, modifying the gnu-build-system with a
>> #:hardening-flags keyword.
>> 
>> For my testing purposes I will use
>> 
>> > CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,now -Wl,-z,relro"
>> 
>> which is used by Gentoo, but adjustments (wether to opt-in or
>> opt-out) will be made.
>> -- 
>> ng0 :: https://ea.n0.is
>> A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/
>> 
>
>

-- 
ng0 :: https://ea.n0.is
A88C8ADD129828D7EAC02E52E22F9BBFEE348588 :: https://ea.n0.is/keys/

Re: hardening

[Alex Vong]

Hello,

ng0@n0.is writes:

> Hi,
>
> as we've long talked and not really taken action on hardening builds
> I've started working on an opt-in way as last discussed in
> september 2016, modifying the gnu-build-system with a
> #:hardening-flags keyword.
>
> For my testing purposes I will use
>
>> CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2"
> LDFLAGS="-Wl,-z,now -Wl,-z,relro"
>
> which is used by Gentoo, but adjustments (wether to opt-in or
> opt-out) will be made.

The flags I use (suggested by Debian Wiki[0]) are:

  CPPFLAGS=-D_FORTIFY_SOURCE=2
  CFLAGS=-fstack-protector-strong
  CXXFLAGS=-fstack-protector-strong
  LDFLAGS=-Wl,-z,relro,-z,now,--as-needed

Also, should we use retpoline flags for all native binaries? This
article[1] suggests ``applying a software mitigation (e.g., Google's
Retpoline) to the hypervisor, operating system kernel, system programs
and libraries, and user applications''. I've sent a patch to do so when
bootstraping GCC 7 itself[2] but no reply are received yet (maybe I
should have open a new bug instead of changing the title of an old
bug).

[0]: https://wiki.debian.org/Hardening
[1]: https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html
[2]: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=30111

Re: hardening

[ng0]

Alex Vong transcribed 1.3K bytes:
> Hello,
> 
> ng0@n0.is writes:
> 
> > Hi,
> >
> > as we've long talked and not really taken action on hardening builds
> > I've started working on an opt-in way as last discussed in
> > september 2016, modifying the gnu-build-system with a
> > #:hardening-flags keyword.
> >
> > For my testing purposes I will use
> >
> >> CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2"
> > LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> >
> > which is used by Gentoo, but adjustments (wether to opt-in or
> > opt-out) will be made.
> 
> The flags I use (suggested by Debian Wiki[0]) are:
> 
>   CPPFLAGS=-D_FORTIFY_SOURCE=2

How does this differ from "-O2 -D_FORTIFY_SOURCE" in CFLAGS?
I know O2 is optimization and that FORTIFY_SOURCE requires optimization
to be specified.

>   CFLAGS=-fstack-protector-strong
>   CXXFLAGS=-fstack-protector-strong
>   LDFLAGS=-Wl,-z,relro,-z,now,--as-needed

What are your opinions about:
 -pipe -fPIE -fstack-shuffle -fstack-protector-all

> Also, should we use retpoline flags for all native binaries? This
> article[1] suggests ``applying a software mitigation (e.g., Google's
> Retpoline) to the hypervisor, operating system kernel, system programs
> and libraries, and user applications''. I've sent a patch to do so when
> bootstraping GCC 7 itself[2] but no reply are received yet (maybe I
> should have open a new bug instead of changing the title of an old
> bug).
> 
> [0]: https://wiki.debian.org/Hardening
> [1]: https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html
> [2]: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=30111
> 

-- 
A88C8ADD129828D7EAC02E52E22F9BBFEE348588
https://n0.is

Re: hardening

[ng0]

ng0 transcribed 1.6K bytes:
> Alex Vong transcribed 1.3K bytes:
> > Hello,
> > 
> > ng0@n0.is writes:
> > 
> > > Hi,
> > >
> > > as we've long talked and not really taken action on hardening builds
> > > I've started working on an opt-in way as last discussed in
> > > september 2016, modifying the gnu-build-system with a
> > > #:hardening-flags keyword.
> > >
> > > For my testing purposes I will use
> > >
> > >> CFLAGS="-fPIE -fstack-protector-all -D_FORTIFY_SOURCE=2"
> > > LDFLAGS="-Wl,-z,now -Wl,-z,relro"
> > >
> > > which is used by Gentoo, but adjustments (wether to opt-in or
> > > opt-out) will be made.
> > 
> > The flags I use (suggested by Debian Wiki[0]) are:
> > 
> >   CPPFLAGS=-D_FORTIFY_SOURCE=2
> 
> How does this differ from "-O2 -D_FORTIFY_SOURCE" in CFLAGS?
> I know O2 is optimization and that FORTIFY_SOURCE requires optimization
> to be specified.

Okay, I've read some related commits and bug tickets, I understand
the difference now.

> >   CFLAGS=-fstack-protector-strong
> >   CXXFLAGS=-fstack-protector-strong
> >   LDFLAGS=-Wl,-z,relro,-z,now,--as-needed
> 
> What are your opinions about:
>  -pipe -fPIE -fstack-shuffle -fstack-protector-all
> 
> > Also, should we use retpoline flags for all native binaries? This
> > article[1] suggests ``applying a software mitigation (e.g., Google's
> > Retpoline) to the hypervisor, operating system kernel, system programs
> > and libraries, and user applications''. I've sent a patch to do so when
> > bootstraping GCC 7 itself[2] but no reply are received yet (maybe I
> > should have open a new bug instead of changing the title of an old
> > bug).
> > 
> > [0]: https://wiki.debian.org/Hardening
> > [1]: https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html
> > [2]: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=30111
> > 
> 
> -- 
> A88C8ADD129828D7EAC02E52E22F9BBFEE348588
> https://n0.is
> 

-- 
A88C8ADD129828D7EAC02E52E22F9BBFEE348588
https://n0.is

Re: hardening

[Ricardo Wurmus]

ng0 <ng0@n0.is> writes:

>> > The flags I use (suggested by Debian Wiki[0]) are:
>> >
>> >   CPPFLAGS=-D_FORTIFY_SOURCE=2
>>
>> How does this differ from "-O2 -D_FORTIFY_SOURCE" in CFLAGS?
>> I know O2 is optimization and that FORTIFY_SOURCE requires optimization
>> to be specified.
>
> Okay, I've read some related commits and bug tickets, I understand
> the difference now.

Please share.  Otherwise this comment isn’t really helpful for this
discussion.

--
Ricardo

Re: hardening

[ng0]

Ricardo Wurmus transcribed 486 bytes:
> 
> ng0 <ng0@n0.is> writes:
> 
> >> > The flags I use (suggested by Debian Wiki[0]) are:
> >> >
> >> >   CPPFLAGS=-D_FORTIFY_SOURCE=2
> >>
> >> How does this differ from "-O2 -D_FORTIFY_SOURCE" in CFLAGS?
> >> I know O2 is optimization and that FORTIFY_SOURCE requires optimization
> >> to be specified.
> >
> > Okay, I've read some related commits and bug tickets, I understand
> > the difference now.
> 
> Please share.  Otherwise this comment isn’t really helpful for this
> discussion.

Well there's the Debian wiki: https://wiki.debian.org/Hardening
and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=643632 as well
as the gcc Manual about it. Debian uses -D_FORTIFY_SOURCE -O1.
My use of -O2 -D_FORTIFY_SOURCE in CFLAGS was not correct.

> 
> --
> Ricardo
> 
> 
> 

-- 
A88C8ADD129828D7EAC02E52E22F9BBFEE348588
https://n0.is

Re: hardening

[ng0]

Let's keep this thread as the thread to discuss possible solutions and work
in that field.

Yesterday Marius wrote on IRC (https://gnunet.org/bot/log/guix/2018-03-21#T1657250):

[        ]	<mbakke>	This is a pretty good article about build flags (mainly hardening related): https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-...
[        ]	<mbakke>	It would be great to have a "#:hardening?" option with additional provisions for specific flags.

The link in full: https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-gcc/

Nix has an a functionality to disable hardening:
https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=harden&type=
for example visible here: https://github.com/NixOS/nixpkgs/commit/f5b04628f00e98e4c757466ab6be2c125d89feeb

I have some more notes on Gentoo I'll add next month.

Food for thought:
If we go all in, we might have to recompile the bootstrap binaries.


keyword #:hardening-flags is a good entry for manually fixing packages up to
the point where they work with hardened flags. Caveat is, not everything will
work good or even at all with hardened-flags and toolchain.
So we are presented with 2 options.
1) Selectively harden what is possible through the keyword mentioned above
or
2) harden by default and switch off flags through something like #:hardening-exclude
   which would default to the empty list and otherwise would remove the elements in its
   list from the list of flags.

Further thoughts:
#:hardened? could be a simple check so that having package-graphs which are not hardened
are possible. We would default to #t, off would be #f obviously.


My work in progress so far is to work this into the gnu-build-system, which seemed like
a good starting point.

I'm in favor of option 2 coupled with the keyword to disable hardening altogether.

WDYT?
-- 
A88C8ADD129828D7EAC02E52E22F9BBFEE348588
https://n0.is