Linux: build with and test for control flow instrumentation on x86_64 #23839

pull fanquake wants to merge 3 commits into bitcoin:master from fanquake:control_flow_linux_x86_64 changing 3 files +52 −17
  1. fanquake commented at 7:30 AM on December 22, 2021: member

    Closes #21888.

    TODO:

    • Duplication in security-check-tests

    Guix build:

    bash-5.1# find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
8025e2e6859247eaf865a4a5009d0a39570ec5e8ab51739fa4da0d8ee4ab2117  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/SHA256SUMS.part
75576482994493262dbf7d3567b0450c0804bdc75c186d6b4c6a856bd0d8f0a3  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu-debug.tar.gz
7cb89c9327cc540859334b597c041a2250156e3e83ce2aa7d16177376056302f  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu.tar.gz
e264053e4c7a5d65340dd7bbd2c664bcd596292ab80f00a0bf0026bfe0c480bc  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/SHA256SUMS.part
6c3ee9b3c0c4583620301b183226678f1618605dd07dbed0bbdf7d06d3591314  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf-debug.tar.gz
f217cb8d8e233a8dbdbfde7dabf12c5d867d7de53e8c652b8ed1d4a55da82fd9  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf.tar.gz
48b4b2a1b52b3098f4e92c11cb60f1e5e9696a2a960560cd6adea72277eaa4a4  guix-build-5a8f907c93f1/output/dist-archive/bitcoin-5a8f907c93f1.tar.gz
40832db2446e129879caa9fbc9d682c53069876dbb2e0d4d76592e5dcb40bb12  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/SHA256SUMS.part
26fdfa9b7b77d5db415ef34054cf6f6d020a5dab73239db6dd05539f654bc5d5  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu-debug.tar.gz
3adbdb9d3eb1cb5f9adc38b29450054f286bd6d74cef8619adaee89494853605  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu.tar.gz
8ec2baf82483a698350bfdabf530cd9b5241690c916f597c746210e95ac451de  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/SHA256SUMS.part
1797e75e1f66ec9068fa4e57e0108960475e863f8f054fbe854358b1f995c4df  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu-debug.tar.gz
448bd289ef26c777a1fc4498e7ba7fb17d0f6a932dcac91b2f89cbba63704bb8  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu.tar.gz
a23ee91eeae515c2a6a31eb25d659fab833839aaafa4676ccee364bdad2a468c  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/SHA256SUMS.part
82df1b6d5020d0af8268ecc8e823f752f20dec308277763b2dd675804dfa4bbd  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu-debug.tar.gz
09a6098ce83896a6ee6d5c8aff12eaca51595bd724c8e0b2a6f90b6410dc168c  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu.tar.gz
4fac2951f80eaa2bd1747a263be6be1b76282cac5062f7d86db631a2fb80f8db  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/SHA256SUMS.part
3392f417b09efca5916c384f0b2d0c177a72ec4921399c62e84484f0054cc8c4  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.dmg
bfb4f8ade6107996ec4bc9efdb53959151b8fb19b6790c34472fe218dd02383d  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.tar.gz
4de92e149bad46fc863efb3b650753d194aad96be991d020e0b859452cf27457  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx64.tar.gz
9329549a2f275a59e329afc8744ff8cbc297f3042e0ad03b47626805c7aae2e8  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/SHA256SUMS.part
d87deb1eca8a1d3780f02edde78350d27f700e13c7ff444be0bfb34e7369904a  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu-debug.tar.gz
76f3bc2fad010d9373e854d941e8205b68fa6c9a8ecaff34c4978ae3ae76c806  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu.tar.gz
2948631081c4bd475529da2b7bc2b32b5aa2e44de46dfdaa6cf9432b3c9fe869  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/SHA256SUMS.part
c5d56fac163b73c00e9745aa7b0f9a0bd9fcac7517e39b677869b6e76faf7218  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win-unsigned.tar.gz
f12c7cd72511544c67f4934981c090cee0d9c17e931c059edbbbef6e843dd651  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-debug.zip
eb952cc4554f92ba6787353f4305d7cbcb1c6dafc4a3867b3088106252a573b8  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-setup-unsigned.exe
7bd2b071f1cdf9410535e6a10dd1da519f942bd2c1e47ed52c5b8c4f977e8f27  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64.zip
  2. fanquake added the label Scripts and tools on Dec 22, 2021
  3. MarcoFalke added the label DrahtBot Guix build requested on Dec 22, 2021
  4. MarcoFalke removed the label DrahtBot Guix build requested on Dec 22, 2021
  5. DrahtBot commented at 1:01 PM on December 22, 2021: member

    <!--e57a25ab6845829454e8d69fc972939a-->

    The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

    <!--174a7506f384e20aa4161008e828411d-->

    Conflicts

    No conflicts as of last run.

  6. fanquake referenced this in commit 2da97b271b on Dec 23, 2021
  7. fanquake force-pushed on Dec 23, 2021
  8. fanquake commented at 3:22 AM on December 23, 2021: member

    Rebased on top of #23845 which fixes the previous releases CI (by using GCC 8 instead of 7). Also fixed the linting issue and simplified the cxxflags_ usage.

  9. MarcoFalke referenced this in commit 7551ae81e1 on Dec 23, 2021
  10. fanquake force-pushed on Dec 24, 2021
  11. script rename control flow check to MACHO specific 6ca5efa8ed
  12. build: build x86_64 Linux Boost with -fcf-protection=full
    This is required so that we can test for control flow in our ELF
security checks. Otherwise test_bitcoin will fail, as it has a main that
is provided by Boost, and wont have been built with
-fcf-protection=full.

While here simplify to using -fcf-protection for all x86_64 builds.
    e13f8f775d
  13. scripts: add CONTROL_FLOW to ELF security checks 5a8f907c93
  14. fanquake force-pushed on Jan 4, 2022
  15. fanquake marked this as ready for review on Jan 10, 2022
  16. fanquake commented at 4:26 AM on January 10, 2022: member

    Un-drafted, now that the base PR's have been merged. Added Guix hashes to PR description.

  17. MarcoFalke added the label DrahtBot Guix build requested on Jan 10, 2022
  18. hebasto commented at 9:33 PM on January 10, 2022: member

    Guix builds:

    $ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
8025e2e6859247eaf865a4a5009d0a39570ec5e8ab51739fa4da0d8ee4ab2117  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/SHA256SUMS.part
75576482994493262dbf7d3567b0450c0804bdc75c186d6b4c6a856bd0d8f0a3  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu-debug.tar.gz
7cb89c9327cc540859334b597c041a2250156e3e83ce2aa7d16177376056302f  guix-build-5a8f907c93f1/output/aarch64-linux-gnu/bitcoin-5a8f907c93f1-aarch64-linux-gnu.tar.gz
e264053e4c7a5d65340dd7bbd2c664bcd596292ab80f00a0bf0026bfe0c480bc  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/SHA256SUMS.part
6c3ee9b3c0c4583620301b183226678f1618605dd07dbed0bbdf7d06d3591314  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf-debug.tar.gz
f217cb8d8e233a8dbdbfde7dabf12c5d867d7de53e8c652b8ed1d4a55da82fd9  guix-build-5a8f907c93f1/output/arm-linux-gnueabihf/bitcoin-5a8f907c93f1-arm-linux-gnueabihf.tar.gz
48b4b2a1b52b3098f4e92c11cb60f1e5e9696a2a960560cd6adea72277eaa4a4  guix-build-5a8f907c93f1/output/dist-archive/bitcoin-5a8f907c93f1.tar.gz
40832db2446e129879caa9fbc9d682c53069876dbb2e0d4d76592e5dcb40bb12  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/SHA256SUMS.part
26fdfa9b7b77d5db415ef34054cf6f6d020a5dab73239db6dd05539f654bc5d5  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu-debug.tar.gz
3adbdb9d3eb1cb5f9adc38b29450054f286bd6d74cef8619adaee89494853605  guix-build-5a8f907c93f1/output/powerpc64-linux-gnu/bitcoin-5a8f907c93f1-powerpc64-linux-gnu.tar.gz
8ec2baf82483a698350bfdabf530cd9b5241690c916f597c746210e95ac451de  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/SHA256SUMS.part
1797e75e1f66ec9068fa4e57e0108960475e863f8f054fbe854358b1f995c4df  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu-debug.tar.gz
448bd289ef26c777a1fc4498e7ba7fb17d0f6a932dcac91b2f89cbba63704bb8  guix-build-5a8f907c93f1/output/powerpc64le-linux-gnu/bitcoin-5a8f907c93f1-powerpc64le-linux-gnu.tar.gz
a23ee91eeae515c2a6a31eb25d659fab833839aaafa4676ccee364bdad2a468c  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/SHA256SUMS.part
82df1b6d5020d0af8268ecc8e823f752f20dec308277763b2dd675804dfa4bbd  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu-debug.tar.gz
09a6098ce83896a6ee6d5c8aff12eaca51595bd724c8e0b2a6f90b6410dc168c  guix-build-5a8f907c93f1/output/riscv64-linux-gnu/bitcoin-5a8f907c93f1-riscv64-linux-gnu.tar.gz
4fac2951f80eaa2bd1747a263be6be1b76282cac5062f7d86db631a2fb80f8db  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/SHA256SUMS.part
3392f417b09efca5916c384f0b2d0c177a72ec4921399c62e84484f0054cc8c4  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.dmg
bfb4f8ade6107996ec4bc9efdb53959151b8fb19b6790c34472fe218dd02383d  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx-unsigned.tar.gz
4de92e149bad46fc863efb3b650753d194aad96be991d020e0b859452cf27457  guix-build-5a8f907c93f1/output/x86_64-apple-darwin/bitcoin-5a8f907c93f1-osx64.tar.gz
9329549a2f275a59e329afc8744ff8cbc297f3042e0ad03b47626805c7aae2e8  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/SHA256SUMS.part
d87deb1eca8a1d3780f02edde78350d27f700e13c7ff444be0bfb34e7369904a  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu-debug.tar.gz
76f3bc2fad010d9373e854d941e8205b68fa6c9a8ecaff34c4978ae3ae76c806  guix-build-5a8f907c93f1/output/x86_64-linux-gnu/bitcoin-5a8f907c93f1-x86_64-linux-gnu.tar.gz
2948631081c4bd475529da2b7bc2b32b5aa2e44de46dfdaa6cf9432b3c9fe869  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/SHA256SUMS.part
c5d56fac163b73c00e9745aa7b0f9a0bd9fcac7517e39b677869b6e76faf7218  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win-unsigned.tar.gz
f12c7cd72511544c67f4934981c090cee0d9c17e931c059edbbbef6e843dd651  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-debug.zip
eb952cc4554f92ba6787353f4305d7cbcb1c6dafc4a3867b3088106252a573b8  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64-setup-unsigned.exe
7bd2b071f1cdf9410535e6a10dd1da519f942bd2c1e47ed52c5b8c4f977e8f27  guix-build-5a8f907c93f1/output/x86_64-w64-mingw32/bitcoin-5a8f907c93f1-win64.zip
  19. hebasto approved
  20. hebasto commented at 11:05 PM on January 10, 2022: member

    ACK 5a8f907c93f158c54e58706d6d8c6b0a1a3205ba, I have reviewed the code and it looks OK, I agree it can be merged.

  21. in contrib/devtools/security-check.py:121 in 5a8f907c93 
     116 | +    Check for control flow instrumentation
 117 | +    '''
 118 | +    main = binary.get_function_address('main')
 119 | +    content = binary.get_content_from_virtual_address(main, 4, lief.Binary.VA_TYPES.AUTO)
 120 | +
 121 | +    if content == [243, 15, 30, 250]: # endbr64
    luke-jr commented at 11:21 PM on January 11, 2022:

    This feels kind of ugly. Is there no better way to check it? Will this reliably check it with future compilers?

    fanquake commented at 2:20 AM on January 12, 2022:

    Is there no better way to check it?

    Do you have any suggestions? As far as I'm aware there's no standard way to check if a binary has control instrumentation or not. I think this is about the most direct way we can test for what we're looking for.

    Will this reliably check it with future compilers?

    I'm not going to try and guess what future compilers may or may not do, but I would be surprised if this did stop working. In any case, it would be immediately obvious, and would only occur when making changes to our Guix environment, so at that point we could figure out what to do.

    laanwj commented at 2:59 PM on January 25, 2022:

    I think this is the only way to do it. I also think it is future-proof, there's only one way to do control flow experimentation. And yeah, if not, we can check what to do. Compiler upgrades are an explicit choice anyhow.

  22. mzumsande referenced this in commit f83f213c05 on Jan 17, 2022
  23. laanwj commented at 2:57 PM on January 25, 2022: member

    Code review ACK 5a8f907c93f158c54e58706d6d8c6b0a1a3205ba

  24. laanwj merged this on Jan 25, 2022
  25. laanwj closed this on Jan 25, 2022
  26. fanquake deleted the branch on Jan 26, 2022
  27. fanquake removed the label DrahtBot Guix build requested on Jan 26, 2022
  28. DrahtBot commented at 5:35 PM on January 27, 2022: member

    <!--9cd9c72976c961c55c7acef8f6ba82cd-->

    Guix builds

    File commit 9ec3991ad3b2ae91997c696a4c2f187fe538eff0<br>(master) commit 489f4c2e8370ea957f4fc75308cce63e1a0df5ac<br>(master and this pull)
    SHA256SUMS.part 2e7b021f8a032087... dd95579be8377461...
    *-aarch64-linux-gnu-debug.tar.gz f04dbee73b174e6f... 3e15b272bbd19168...
    *-aarch64-linux-gnu.tar.gz c754b36e82e33a9c... 4955db939f975196...
    *-arm-linux-gnueabihf-debug.tar.gz 25013d4ae19fb6f3... 2467200bd67eb28d...
    *-arm-linux-gnueabihf.tar.gz ec025145858460ce... ed90126cf3b55ffa...
    *-osx-unsigned.dmg dd865c6fd4218a09... fa6f08b81bc5421f...
    *-osx-unsigned.tar.gz f2adf40f7d956e6e... f65a900ccd8d94e6...
    *-osx64.tar.gz 9bf700786395a8fb... cf4fa4b8732533ac...
    *-powerpc64-linux-gnu-debug.tar.gz eba65aa8eaec1c89... feb6ab49dc3f46f1...
    *-powerpc64-linux-gnu.tar.gz 3312edee780236ee... c5fa9771e1ba5d11...
    *-powerpc64le-linux-gnu-debug.tar.gz 4ccd57dd41f448eb... bb1112f5ae1d70fd...
    *-powerpc64le-linux-gnu.tar.gz 025f050dd642ca2f... 676a4c31bcc61481...
    *-riscv64-linux-gnu-debug.tar.gz 9c3dfcba4deadf0b... c09edf02e4b0f6d5...
    *-riscv64-linux-gnu.tar.gz 54f25a0d36c806fa... 292684088629ab21...
    *-x86_64-linux-gnu-debug.tar.gz 63ebd6c1a1137971... a94395a74d3f4339...
    *-x86_64-linux-gnu.tar.gz 1be184e1c61ed869... bf344859c483e953...
    *.tar.gz d399991ce771ba6c... c9fddc419f0c0be1...
    guix_build.log 334f236ac4ef766b... b949bcd590b647ee...
    guix_build.log.diff 048c4911dfbec4f0...
  29. sidhujag referenced this in commit 172f39e5ff on Jan 28, 2022
  30. rebroad referenced this in commit 4f42401429 on Feb 3, 2022
  31. DrahtBot locked this on Jan 27, 2023
Contributors
fanquakeDrahtBothebastoluke-jrlaanwj
Labels
Scripts and tools
Linked (view graph)
#21888 build: control flow instrumentation not always present in test_bitcoin main#23845 ci: use GCC 8 when building packages in native_qt5 CI
github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-04-21 21:14 UTC
This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me