178 lines
8.7 KiB
Diff
178 lines
8.7 KiB
Diff
Description: Enable security flags by default
|
|
Author: Stephen Kitt <skitt@debian.org>
|
|
Bug-Debian: https://bugs.debian.org/836365
|
|
|
|
This patch enables the PE flags for ASLR (including 64-bit ASLR on
|
|
64-bit Windows) and NX by default. Since the corresponding linker
|
|
parameters aren't toggles, the patch adds "no-" variants to disable
|
|
this: "no-dynamicbase", "no-nxcompat", "no-high-entropy-va".
|
|
|
|
--- a/upstream/ld/emultempl/pe.em
|
|
+++ b/upstream/ld/emultempl/pe.em
|
|
@@ -129,7 +129,9 @@
|
|
static int support_old_code = 0;
|
|
static char * thumb_entry_symbol = NULL;
|
|
static lang_assignment_statement_type *image_base_statement = 0;
|
|
-static unsigned short pe_dll_characteristics = 0;
|
|
+static unsigned short pe_dll_characteristics = \
|
|
+ IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE | \
|
|
+ IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
static bfd_boolean insert_timestamp = TRUE;
|
|
static const char *emit_build_id;
|
|
|
|
@@ -259,9 +261,11 @@
|
|
(OPTION_ENABLE_LONG_SECTION_NAMES + 1)
|
|
/* DLLCharacteristics flags. */
|
|
#define OPTION_DYNAMIC_BASE (OPTION_DISABLE_LONG_SECTION_NAMES + 1)
|
|
-#define OPTION_FORCE_INTEGRITY (OPTION_DYNAMIC_BASE + 1)
|
|
+#define OPTION_NO_DYNAMIC_BASE (OPTION_DYNAMIC_BASE + 1)
|
|
+#define OPTION_FORCE_INTEGRITY (OPTION_NO_DYNAMIC_BASE + 1)
|
|
#define OPTION_NX_COMPAT (OPTION_FORCE_INTEGRITY + 1)
|
|
-#define OPTION_NO_ISOLATION (OPTION_NX_COMPAT + 1)
|
|
+#define OPTION_NO_NX_COMPAT (OPTION_NX_COMPAT + 1)
|
|
+#define OPTION_NO_ISOLATION (OPTION_NO_NX_COMPAT + 1)
|
|
#define OPTION_NO_SEH (OPTION_NO_ISOLATION + 1)
|
|
#define OPTION_NO_BIND (OPTION_NO_SEH + 1)
|
|
#define OPTION_WDM_DRIVER (OPTION_NO_BIND + 1)
|
|
@@ -341,8 +345,10 @@
|
|
{"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
|
|
{"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
|
|
{"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
|
|
+ {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
|
|
{"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
|
|
{"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
|
|
+ {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
|
|
{"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
|
|
{"no-seh", no_argument, NULL, OPTION_NO_SEH},
|
|
{"no-bind", no_argument, NULL, OPTION_NO_BIND},
|
|
@@ -412,7 +418,8 @@
|
|
D(SizeOfHeapReserve,"__size_of_heap_reserve__", 0x100000, FALSE),
|
|
D(SizeOfHeapCommit,"__size_of_heap_commit__", 0x1000, FALSE),
|
|
D(LoaderFlags,"__loader_flags__", 0x0, FALSE),
|
|
- D(DllCharacteristics, "__dll_characteristics__", 0x0, FALSE),
|
|
+ D(DllCharacteristics, "__dll_characteristics__",
|
|
+ IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLL_CHARACTERISTICS_NX_COMPAT, FALSE),
|
|
{ NULL, 0, 0, NULL, 0 , FALSE}
|
|
};
|
|
|
|
@@ -483,8 +490,10 @@
|
|
in object files\n"));
|
|
fprintf (file, _(" --dynamicbase Image base address may be relocated using\n\
|
|
address space layout randomization (ASLR)\n"));
|
|
+ fprintf (file, _(" --no-dynamicbase Image base address may not be relocated\n"));
|
|
fprintf (file, _(" --forceinteg Code integrity checks are enforced\n"));
|
|
fprintf (file, _(" --nxcompat Image is compatible with data execution prevention\n"));
|
|
+ fprintf (file, _(" --no-nxcompat Image is not compatible with data execution prevention\n"));
|
|
fprintf (file, _(" --no-isolation Image understands isolation but do not isolate the image\n"));
|
|
fprintf (file, _(" --no-seh Image does not use SEH. No SE handler may\n\
|
|
be called in this image\n"));
|
|
@@ -856,12 +865,18 @@
|
|
case OPTION_DYNAMIC_BASE:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
|
|
break;
|
|
+ case OPTION_NO_DYNAMIC_BASE:
|
|
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
|
|
+ break;
|
|
case OPTION_FORCE_INTEGRITY:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
|
|
break;
|
|
case OPTION_NX_COMPAT:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
break;
|
|
+ case OPTION_NO_NX_COMPAT:
|
|
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
+ break;
|
|
case OPTION_NO_ISOLATION:
|
|
pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
|
|
break;
|
|
--- a/upstream/ld/emultempl/pep.em
|
|
+++ b/upstream/ld/emultempl/pep.em
|
|
@@ -146,7 +146,10 @@
|
|
static flagword real_flags = IMAGE_FILE_LARGE_ADDRESS_AWARE;
|
|
static int support_old_code = 0;
|
|
static lang_assignment_statement_type *image_base_statement = 0;
|
|
-static unsigned short pe_dll_characteristics = 0;
|
|
+static unsigned short pe_dll_characteristics = \
|
|
+ IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA | \
|
|
+ IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE | \
|
|
+ IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
static bfd_boolean insert_timestamp = TRUE;
|
|
static const char *emit_build_id;
|
|
|
|
@@ -236,9 +239,12 @@
|
|
OPTION_ENABLE_LONG_SECTION_NAMES,
|
|
OPTION_DISABLE_LONG_SECTION_NAMES,
|
|
OPTION_HIGH_ENTROPY_VA,
|
|
+ OPTION_NO_HIGH_ENTROPY_VA,
|
|
OPTION_DYNAMIC_BASE,
|
|
+ OPTION_NO_DYNAMIC_BASE,
|
|
OPTION_FORCE_INTEGRITY,
|
|
OPTION_NX_COMPAT,
|
|
+ OPTION_NO_NX_COMPAT,
|
|
OPTION_NO_ISOLATION,
|
|
OPTION_NO_SEH,
|
|
OPTION_NO_BIND,
|
|
@@ -313,9 +319,12 @@
|
|
{"enable-long-section-names", no_argument, NULL, OPTION_ENABLE_LONG_SECTION_NAMES},
|
|
{"disable-long-section-names", no_argument, NULL, OPTION_DISABLE_LONG_SECTION_NAMES},
|
|
{"high-entropy-va", no_argument, NULL, OPTION_HIGH_ENTROPY_VA},
|
|
+ {"no-high-entropy-va", no_argument, NULL, OPTION_NO_HIGH_ENTROPY_VA},
|
|
{"dynamicbase",no_argument, NULL, OPTION_DYNAMIC_BASE},
|
|
+ {"no-dynamicbase", no_argument, NULL, OPTION_NO_DYNAMIC_BASE},
|
|
{"forceinteg", no_argument, NULL, OPTION_FORCE_INTEGRITY},
|
|
{"nxcompat", no_argument, NULL, OPTION_NX_COMPAT},
|
|
+ {"no-nxcompat", no_argument, NULL, OPTION_NO_NX_COMPAT},
|
|
{"no-isolation", no_argument, NULL, OPTION_NO_ISOLATION},
|
|
{"no-seh", no_argument, NULL, OPTION_NO_SEH},
|
|
{"no-bind", no_argument, NULL, OPTION_NO_BIND},
|
|
@@ -381,7 +390,9 @@
|
|
D(SizeOfHeapReserve,"__size_of_heap_reserve__", 0x100000, FALSE),
|
|
D(SizeOfHeapCommit,"__size_of_heap_commit__", 0x1000, FALSE),
|
|
D(LoaderFlags,"__loader_flags__", 0x0, FALSE),
|
|
- D(DllCharacteristics, "__dll_characteristics__", 0x0, FALSE),
|
|
+ D(DllCharacteristics, "__dll_characteristics__",
|
|
+ IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA | IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLL_CHARACTERISTICS_NX_COMPAT,
|
|
+ FALSE),
|
|
{ NULL, 0, 0, NULL, 0, FALSE}
|
|
};
|
|
|
|
@@ -445,10 +456,13 @@
|
|
in object files\n"));
|
|
fprintf (file, _(" --high-entropy-va Image is compatible with 64-bit address space\n\
|
|
layout randomization (ASLR)\n"));
|
|
+ fprintf (file, _(" --no-high-entropy-va Image is not compatible with 64-bit ASLR\n"));
|
|
fprintf (file, _(" --dynamicbase Image base address may be relocated using\n\
|
|
address space layout randomization (ASLR)\n"));
|
|
+ fprintf (file, _(" --no-dynamicbase Image base address may not be relocated\n"));
|
|
fprintf (file, _(" --forceinteg Code integrity checks are enforced\n"));
|
|
fprintf (file, _(" --nxcompat Image is compatible with data execution prevention\n"));
|
|
+ fprintf (file, _(" --no-nxcompat Image is not compatible with data execution prevention\n"));
|
|
fprintf (file, _(" --no-isolation Image understands isolation but do not isolate the image\n"));
|
|
fprintf (file, _(" --no-seh Image does not use SEH; no SE handler may\n\
|
|
be called in this image\n"));
|
|
@@ -799,15 +813,24 @@
|
|
case OPTION_HIGH_ENTROPY_VA:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA;
|
|
break;
|
|
+ case OPTION_NO_HIGH_ENTROPY_VA:
|
|
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA;
|
|
+ break;
|
|
case OPTION_DYNAMIC_BASE:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
|
|
break;
|
|
+ case OPTION_NO_DYNAMIC_BASE:
|
|
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE;
|
|
+ break;
|
|
case OPTION_FORCE_INTEGRITY:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY;
|
|
break;
|
|
case OPTION_NX_COMPAT:
|
|
pe_dll_characteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
break;
|
|
+ case OPTION_NO_NX_COMPAT:
|
|
+ pe_dll_characteristics &= ~IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
|
|
+ break;
|
|
case OPTION_NO_ISOLATION:
|
|
pe_dll_characteristics |= IMAGE_DLLCHARACTERISTICS_NO_ISOLATION;
|
|
break;
|