<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:16.0pt">From: Yongkui Han <yonhan@cisco.com><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">Introduce a configuration option to build a "hardened" OpenWRT with ASLR PIE support.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">A new option PKG_ASLR_PIE to enable Address Space Layout Randomization (ASLR)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">Position Independent Executables (PIE) support has been introduced.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">This new option protects against "return-to-text" attacks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">Tested with GCC 4.4.7, uClibc and a subset of the available packages.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">Signed-off-by: Yongkui Han <yonhan@cisco.com><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">config/Config-build.in | 15 +++++++++++++++<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">include/hardened-build-ld | 2 ++<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">include/hardening.mk | 7 +++++++<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">3 files changed, 24 insertions(+)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">diff --git a/config/Config-build.in b/config/Config-build.in<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">index 23cf83b..fa7ecfb 100644<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">--- a/config/Config-build.in<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+++ b/config/Config-build.in<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">@@ -221,6 +221,21 @@ menu "Global build settings"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> Makefile.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ config PKG_ASLR_PIE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ bool<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ prompt "User space ASLR PIE compilation"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ default n<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ help<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ This enables package build as Position Independent Executables (PIE)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ to protect against "return-to-text" attacks. This belongs to the<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ feature of Address Space Layout Randomisation (ASLR), which is<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ implemented by the kernel and the ELF loader by randomising the<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ location of memory allocations. This makes memory addresses harder<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ to predict when an attacker is attempting a memory-corruption exploit.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ You can disable this per package by adding PKG_ASLR_PIE:=0 in the package<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ Makefile.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> choice<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> prompt "User space Stack-Smashing Protection"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> depends on USE_MUSL<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">diff --git a/include/hardening.mk b/include/hardening.mk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">index c277081..7b09c3e 100644<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">--- a/include/hardening.mk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+++ b/include/hardening.mk<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">@@ -6,6 +6,7 @@<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">#<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> PKG_CHECK_FORMAT_SECURITY ?= 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+PKG_ASLR_PIE ?= 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">PKG_SSP ?= 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">PKG_FORTIFY_SOURCE ?= 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">PKG_RELRO ?= 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">@@ -15,6 +16,12 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> TARGET_CFLAGS += -Wformat -Werror=format-security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> endif<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">endif<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ifdef CONFIG_PKG_ASLR_PIE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ ifeq ($(strip $(PKG_ASLR_PIE)),1)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ TARGET_CFLAGS += -fPIC<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ TARGET_LDFLAGS += -specs=$(INCLUDE_DIR)/hardened-build-ld<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+ endif<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+endif<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> ifeq ($(strip $(PKG_SSP)),1)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"> TARGET_CFLAGS += -fstack-protector<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">diff --git a/include/hardened-build-ld b/include/hardened-build-ld<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">new file mode 100644<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">index 0000000..97dbd92<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">--- /dev/null<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+++ b/include/hardened-build-ld<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">@@ -0,0 +1,2 @@<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">+*self_spec:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">++ %{!static:%{!shared:-pie}}<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>