[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Minios-devel] [UNIKRAFT PATCH 1/3] lib/uksecurity: Introduce uksecurity library


  • To: "minios-devel@xxxxxxxxxxxxx" <minios-devel@xxxxxxxxxxxxx>
  • From: Vlad-Andrei BĂDOIU (78692) <vlad_andrei.badoiu@xxxxxxxxxxxxxxx>
  • Date: Tue, 13 Aug 2019 09:54:43 +0000
  • Accept-language: en-US
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=stud.acs.upb.ro; dmarc=pass action=none header.from=stud.acs.upb.ro; dkim=pass header.d=stud.acs.upb.ro; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=97mH7kezve6Pnhb0XaZ8cczPsPdMHTbWITGNBcPiwz8=; b=kMfggvUOp+JT8j79UGmHybLcYpmyIxnAIAV9Cjr5fe/Yoyl4OxdMv27wkICfnRG+K1O9Tq782HZFUbNu75NYrqsevyd+oLur4YRt0MKfMmT59+Cmf56pPOJGjUfwMy//6w2FD6+y5uNoK69bSGJ2iw7ZgP0ypfSUH4lZiTRSkqNyGR3owU7U3lTgQJ0YZtOsgT+DqlXGU0iAjhHMJPj+5JgLTuOaUo6ggIbzBPeqYvCv9/HW0FryQiDXCJrlOZeTzTdxP4NbkFVbmbAMd5JpZwVCEWFKmJHdix/xFRXc+a82GubDEB8Tos2udpwGkiWpjx7ZNRF+0CexJL1x9EfCMA==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eEyNklLah/9FLzF7u474wtmpv0jSEu0ANNW9GRYi1cZm0SbYV4zqAQwsuGPqbdhb/9ovQTD6MaVtu9xTNhaLddQVhl6dZWM3Mt9ez8xdshSfzF4kTFJqnBEi978Cix2bHar+S3jrwudEZSucbIlhxTXn1LqtYU+MDgIE+UpoFIH4aoseMKWMY8rneACvzZgB0fjxWeMzL1ZqMYFANDbMz7vc2nzDnHcFah1iwGGWGj3qVmo+wyLyROkY46TjtY9WfZ2lEHEnjolnTdXK7pBiZqDnzxas+mtUmEAQeFlW/gYC9Anm1AZEzti6I7Ht0bOeoKsU4zH46BqDtIoJIf/cgA==
  • Authentication-results: spf=none (sender IP is ) smtp.mailfrom=vlad_andrei.badoiu@xxxxxxxxxxxxxxx;
  • Cc: "felipe.huici@xxxxxxxxx" <felipe.huici@xxxxxxxxx>, "simon.kuenzer@xxxxxxxxx" <simon.kuenzer@xxxxxxxxx>, Vlad-Andrei BĂDOIU (78692) <vlad_andrei.badoiu@xxxxxxxxxxxxxxx>, "costin.lupu@xxxxxxxxx" <costin.lupu@xxxxxxxxx>
  • Delivery-date: Tue, 13 Aug 2019 09:54:53 +0000
  • List-id: Mini-os development list <minios-devel.lists.xenproject.org>
  • Thread-index: AQHVUb0hFTYTQWHZhUS7a9z/PuCrbg==
  • Thread-topic: [UNIKRAFT PATCH 1/3] lib/uksecurity: Introduce uksecurity library

Library to provide different security related functionalities. Only
the stack smashing protection is implemented for now. This option
increases the size of the final binary(hello world) by around 9%.

A make clean is required when toggling the stack smashing protection
option.

Signed-off-by: Vlad-Andrei Badoiu <vlad_andrei.badoiu@xxxxxxxxxxxxxxx>
---
 lib/Config.uk                                 |  1 +
 lib/Makefile.uk                               |  1 +
 lib/uksecurity/Config.uk                      | 12 ++++
 lib/uksecurity/Makefile.uk                    | 13 +++++
 lib/uksecurity/exportsyms.uk                  |  2 +
 .../include/uksecurity/stackprotector.h       | 58 +++++++++++++++++++
 lib/uksecurity/ssp.c                          | 43 ++++++++++++++
 7 files changed, 130 insertions(+)
 create mode 100644 lib/uksecurity/Config.uk
 create mode 100644 lib/uksecurity/Makefile.uk
 create mode 100644 lib/uksecurity/exportsyms.uk
 create mode 100644 lib/uksecurity/include/uksecurity/stackprotector.h
 create mode 100644 lib/uksecurity/ssp.c

diff --git a/lib/Config.uk b/lib/Config.uk
index f61d3b1..cf2fcdc 100644
--- a/lib/Config.uk
+++ b/lib/Config.uk
@@ -49,3 +49,4 @@ source "lib/ukswrand/Config.uk"
 source "lib/ukbus/Config.uk"
 source "lib/uksglist/Config.uk"
 source "lib/uknetdev/Config.uk"
+source "lib/uksecurity/Config.uk"
diff --git a/lib/Makefile.uk b/lib/Makefile.uk
index b7ad628..432fae4 100644
--- a/lib/Makefile.uk
+++ b/lib/Makefile.uk
@@ -26,3 +26,4 @@ $(eval $(call _import_lib,$(CONFIG_UK_BASE)/lib/ukmpi))
 $(eval $(call _import_lib,$(CONFIG_UK_BASE)/lib/ukbus))
 $(eval $(call _import_lib,$(CONFIG_UK_BASE)/lib/uksglist))
 $(eval $(call _import_lib,$(CONFIG_UK_BASE)/lib/uknetdev))
+$(eval $(call _import_lib,$(CONFIG_UK_BASE)/lib/uksecurity))
diff --git a/lib/uksecurity/Config.uk b/lib/uksecurity/Config.uk
new file mode 100644
index 0000000..d27ec87
--- /dev/null
+++ b/lib/uksecurity/Config.uk
@@ -0,0 +1,12 @@
+config LIBUKSECURITY
+       bool "uksecurity : security related functionalities"
+       default n
+
+if LIBUKSECURITY
+
+config LIBUKSECURITY_SSP
+       bool "Stack smashing protection:
+       select LIBUKSWRAND
+       default n
+
+endif
diff --git a/lib/uksecurity/Makefile.uk b/lib/uksecurity/Makefile.uk
new file mode 100644
index 0000000..9756136
--- /dev/null
+++ b/lib/uksecurity/Makefile.uk
@@ -0,0 +1,13 @@
+$(eval $(call addlib_s,libuksecurity,$(CONFIG_LIBUKSECURITY)))
+
+CINCLUDES-y += -I$(LIBUKSECURITY_BASE)/include
+
+ifdef CONFIG_LIBUKSECURITY_SSP
+
+LIBUKSECURITY_SRCS-y += $(LIBUKSECURITY_BASE)/ssp.c
+
+CFLAGS         += -fstack-protector-all -mstack-protector-guard=global
+CXXFLAGS       += -fstack-protector-all -mstack-protector-guard=global
+
+endif
+
diff --git a/lib/uksecurity/exportsyms.uk b/lib/uksecurity/exportsyms.uk
new file mode 100644
index 0000000..fbc319e
--- /dev/null
+++ b/lib/uksecurity/exportsyms.uk
@@ -0,0 +1,2 @@
+__stack_chk_fail
+__stack_chk_guard
diff --git a/lib/uksecurity/include/uksecurity/stackprotector.h 
b/lib/uksecurity/include/uksecurity/stackprotector.h
new file mode 100644
index 0000000..9ca7210
--- /dev/null
+++ b/lib/uksecurity/include/uksecurity/stackprotector.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/*
+ * Authors: Badoiu Vlad-Andrei <vlad_andrei.badoiu@xxxxxxxxxxxxxxx>
+ *
+ * Copyright (c) 2019, University Politehnica of Bucharest. All rights 
reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * THIS HEADER MAY NOT BE EXTRACTED OR MODIFIED IN ANY WAY.
+ */
+
+#ifndef __UK_STACKPROTECTOR_H__
+#define __UK_STACKPROTECTOR_H__
+
+#include <uk/swrand.h>
+#include <uk/config.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef CONFIG_LIBUKSECURITY_SSP
+extern unsigned long __stack_chk_guard;
+
+static __attribute__((always_inline)) void boot_init_stack_canary(void)
+{
+       __stack_chk_guard = uk_swrand_randr();
+}
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __UK_STACKPROTECTOR_H__ */
diff --git a/lib/uksecurity/ssp.c b/lib/uksecurity/ssp.c
new file mode 100644
index 0000000..79fd0e5
--- /dev/null
+++ b/lib/uksecurity/ssp.c
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/*
+ * Authors: Badoiu Vlad-Andrei <vlad_andrei.badoiu@xxxxxxxxxxxxxxx>
+ *
+ * Copyright (c) 2019, University Politehnica of Bucharest. All rights 
reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ * THIS HEADER MAY NOT BE EXTRACTED OR MODIFIED IN ANY WAY.
+ */
+
+#include <uk/assert.h>
+
+unsigned long __stack_chk_guard;
+
+__attribute__((noreturn))
+void __stack_chk_fail(void)
+{
+       UK_CRASH("Stack smashing detected\n");
+}
-- 
2.20.1


_______________________________________________
Minios-devel mailing list
Minios-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/minios-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.