| author |  Andrew Kelley <andrew@ziglang.org> 2022-06-08 15:21:22-04:00 |
| committer |  GitHub <noreply@github.com> 2022-06-08 15:21:22-04:00 |
| log | f5d97e5e4865d454f468c352e671d2e4a15cf4e4 |
| tree | 17491aa83b86bc81fe87f1310b49de1f45d1ea7f |
| parent | 61844b6bd405b4cca3ab673284609aa6a651d506 |
| parent | d8cae4d1974ae0948cfd4cad5a2bb6e8c4248609 |
| signature |  Signed by PGP key 4AEE18F83AFDEB23 |
Merge pull request #11825 from ifreund/std-build-relro
Enable full RELRO by default, expose in std.build4 files changed, 35 insertions(+), 11 deletions(-)
lib- std
lib/std/build.zig+14
| ... | @@ -1570,6 +1570,12 @@ pub const LibExeObjStep = struct { | ... | @@ -1570,6 +1570,12 @@ pub const LibExeObjStep = struct { |
| 1570 | /// Permit read-only relocations in read-only segments. Disallowed by default. | 1570 | /// Permit read-only relocations in read-only segments. Disallowed by default. |
| 1571 | link_z_notext: bool = false, | 1571 | link_z_notext: bool = false, |
| 1572 | 1572 | ||
| 1573 | /// Force all relocations to be read-only after processing. | ||
| 1574 | link_z_relro: bool = true, | ||
| 1575 | |||
| 1576 | /// Allow relocations to be lazily processed after load. | ||
| 1577 | link_z_lazy: bool = false, | ||
| 1578 | |||
| 1573 | /// (Darwin) Install name for the dylib | 1579 | /// (Darwin) Install name for the dylib |
| 1574 | install_name: ?[]const u8 = null, | 1580 | install_name: ?[]const u8 = null, |
| 1575 | 1581 | ||
| ... | @@ -2577,6 +2583,14 @@ pub const LibExeObjStep = struct { | ... | @@ -2577,6 +2583,14 @@ pub const LibExeObjStep = struct { |
| 2577 | try zig_args.append("-z"); | 2583 | try zig_args.append("-z"); |
| 2578 | try zig_args.append("notext"); | 2584 | try zig_args.append("notext"); |
| 2579 | } | 2585 | } |
| 2586 | if (!self.link_z_relro) { | ||
| 2587 | try zig_args.append("-z"); | ||
| 2588 | try zig_args.append("norelro"); | ||
| 2589 | } | ||
| 2590 | if (self.link_z_lazy) { | ||
| 2591 | try zig_args.append("-z"); | ||
| 2592 | try zig_args.append("lazy"); | ||
| 2593 | } | ||
| 2580 | 2594 | ||
| 2581 | if (self.libc_file) |libc_file| { | 2595 | if (self.libc_file) |libc_file| { |
| 2582 | try zig_args.append("--libc"); | 2596 | try zig_args.append("--libc"); |
src/Compilation.zig+2-2
| ... | @@ -763,8 +763,8 @@ pub const InitOptions = struct { | ... | @@ -763,8 +763,8 @@ pub const InitOptions = struct { |
| 763 | linker_z_defs: bool = false, | 763 | linker_z_defs: bool = false, |
| 764 | linker_z_origin: bool = false, | 764 | linker_z_origin: bool = false, |
| 765 | linker_z_noexecstack: bool = false, | 765 | linker_z_noexecstack: bool = false, |
| 766 | linker_z_now: bool = false, | 766 | linker_z_now: bool = true, |
| 767 | linker_z_relro: bool = false, | 767 | linker_z_relro: bool = true, |
| 768 | linker_z_nocopyreloc: bool = false, | 768 | linker_z_nocopyreloc: bool = false, |
| 769 | linker_tsaware: bool = false, | 769 | linker_tsaware: bool = false, |
| 770 | linker_nxcompat: bool = false, | 770 | linker_nxcompat: bool = false, |
src/link/Elf.zig+5-5
| ... | @@ -1517,12 +1517,12 @@ fn linkWithLLD(self: *Elf, comp: *Compilation, prog_node: *std.Progress.Node) !v | ... | @@ -1517,12 +1517,12 @@ fn linkWithLLD(self: *Elf, comp: *Compilation, prog_node: *std.Progress.Node) !v |
| 1517 | try argv.append("noexecstack"); | 1517 | try argv.append("noexecstack"); |
| 1518 | } | 1518 | } |
| 1519 | if (self.base.options.z_now) { | 1519 | if (self.base.options.z_now) { |
| 1520 | try argv.append("-z"); | 1520 | // LLD defaults to -zlazy |
| 1521 | try argv.append("now"); | 1521 | try argv.append("-znow"); |
| 1522 | } | 1522 | } |
| 1523 | if (self.base.options.z_relro) { | 1523 | if (!self.base.options.z_relro) { |
| 1524 | try argv.append("-z"); | 1524 | // LLD defaults to -zrelro |
| 1525 | try argv.append("relro"); | 1525 | try argv.append("-znorelro"); |
| 1526 | } | 1526 | } |
| 1527 | 1527 | ||
| 1528 | if (getLDMOption(target)) |ldm| { | 1528 | if (getLDMOption(target)) |ldm| { |
src/main.zig+14-4
| ... | @@ -434,8 +434,10 @@ const usage_build_generic = | ... | @@ -434,8 +434,10 @@ const usage_build_generic = |
| 434 | \\ origin Indicate that the object must have its origin processed | 434 | \\ origin Indicate that the object must have its origin processed |
| 435 | \\ nocopyreloc Disable the creation of copy relocations | 435 | \\ nocopyreloc Disable the creation of copy relocations |
| 436 | \\ noexecstack Indicate that the object requires an executable stack | 436 | \\ noexecstack Indicate that the object requires an executable stack |
| 437 | \\ now Force all relocations to be processed on load | 437 | \\ now (default) Force all relocations to be processed on load |
| 438 | \\ relro Force all relocations to be resolved and be read-only on load | 438 | \\ lazy Don't force all relocations to be processed on load |
| 439 | \\ relro (default) Force all relocations to be read-only after processing | ||
| 440 | \\ norelro Don't force all relocations to be read-only after processing | ||
| 439 | \\ -dynamic Force output to be dynamically linked | 441 | \\ -dynamic Force output to be dynamically linked |
| 440 | \\ -static Force output to be statically linked | 442 | \\ -static Force output to be statically linked |
| 441 | \\ -Bsymbolic Bind global references locally | 443 | \\ -Bsymbolic Bind global references locally |
| ... | @@ -655,8 +657,8 @@ fn buildOutputType( | ... | @@ -655,8 +657,8 @@ fn buildOutputType( |
| 655 | var linker_z_defs = false; | 657 | var linker_z_defs = false; |
| 656 | var linker_z_origin = false; | 658 | var linker_z_origin = false; |
| 657 | var linker_z_noexecstack = false; | 659 | var linker_z_noexecstack = false; |
| 658 | var linker_z_now = false; | 660 | var linker_z_now = true; |
| 659 | var linker_z_relro = false; | 661 | var linker_z_relro = true; |
| 660 | var linker_tsaware = false; | 662 | var linker_tsaware = false; |
| 661 | var linker_nxcompat = false; | 663 | var linker_nxcompat = false; |
| 662 | var linker_dynamicbase = false; | 664 | var linker_dynamicbase = false; |
| ... | @@ -1209,8 +1211,12 @@ fn buildOutputType( | ... | @@ -1209,8 +1211,12 @@ fn buildOutputType( |
| 1209 | linker_z_noexecstack = true; | 1211 | linker_z_noexecstack = true; |
| 1210 | } else if (mem.eql(u8, z_arg, "now")) { | 1212 | } else if (mem.eql(u8, z_arg, "now")) { |
| 1211 | linker_z_now = true; | 1213 | linker_z_now = true; |
| 1214 | } else if (mem.eql(u8, z_arg, "lazy")) { | ||
| 1215 | linker_z_now = false; | ||
| 1212 | } else if (mem.eql(u8, z_arg, "relro")) { | 1216 | } else if (mem.eql(u8, z_arg, "relro")) { |
| 1213 | linker_z_relro = true; | 1217 | linker_z_relro = true; |
| 1218 | } else if (mem.eql(u8, z_arg, "norelro")) { | ||
| 1219 | linker_z_relro = false; | ||
| 1214 | } else { | 1220 | } else { |
| 1215 | warn("unsupported linker extension flag: -z {s}", .{z_arg}); | 1221 | warn("unsupported linker extension flag: -z {s}", .{z_arg}); |
| 1216 | } | 1222 | } |
| ... | @@ -1691,8 +1697,12 @@ fn buildOutputType( | ... | @@ -1691,8 +1697,12 @@ fn buildOutputType( |
| 1691 | linker_z_noexecstack = true; | 1697 | linker_z_noexecstack = true; |
| 1692 | } else if (mem.eql(u8, z_arg, "now")) { | 1698 | } else if (mem.eql(u8, z_arg, "now")) { |
| 1693 | linker_z_now = true; | 1699 | linker_z_now = true; |
| 1700 | } else if (mem.eql(u8, z_arg, "lazy")) { | ||
| 1701 | linker_z_now = false; | ||
| 1694 | } else if (mem.eql(u8, z_arg, "relro")) { | 1702 | } else if (mem.eql(u8, z_arg, "relro")) { |
| 1695 | linker_z_relro = true; | 1703 | linker_z_relro = true; |
| 1704 | } else if (mem.eql(u8, z_arg, "norelro")) { | ||
| 1705 | linker_z_relro = false; | ||
| 1696 | } else { | 1706 | } else { |
| 1697 | warn("unsupported linker extension flag: -z {s}", .{z_arg}); | 1707 | warn("unsupported linker extension flag: -z {s}", .{z_arg}); |
| 1698 | } | 1708 | } |