devtools: Add security-check.py #6854

Performs the following ELF security checks:

• PIE: Check for position independent executable (PIE), allowing for address space randomization
• NX: Check that no sections are writable and executable (including the stack)
• RELRO: Check for read-only relocations, binding at startup
• Canary: Check for use of stack canary

Also add a check to symbol-check.py that checks that only the subset of allowed libraries is imported (to avoid incompatibilities).

This needs to be integrated into Travis, or at least the gitian build so that we won't do releases that don't pass these checks. We also need similar checks for OSX and Windows at some point.

Nice. Concept ACK.

ASLR/PIE check on OSX can be done with otool -hv <file>. Not sure how we would execute otools in gitian. NX checks can be done over a vmmap check. For Travis we should create a native osx build (which could run otools to check the executable).

Nice! So testing this would be: Recompile with --disable-hardening (or subsets of those flags) and making sure security-check.py complains?

How to check security for Windows ?

@gavinandresen Right, to speed up testing you could use any C file:

cat >  test1.c << EOF
#include <stdio.h>

int main()
{
    printf("the quick brown fox jumps over the lazy god\n");
    return 0;
}
EOF
gcc test1.c -o test1 -Wl,-zexecstack;
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all -pie -fPIE
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all -pie -fPIE -Wl,-zrelro  -Wl,-z,now
contrib/devtools/security-check.py test1; echo $?

Output:

test1: failed PIE NX RELRO Canary
1
test1: failed PIE RELRO Canary
1
test1: failed PIE RELRO
1
test1: failed RELRO
1
0

@LongShao007 yes, how? (readelf doesn't, but objdump -x does in fact work for PE files, but I wouldn't know what flags to look for)

On windows:

NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP):

-DllCharacteristics     00000100
+DllCharacteristics     00000000

PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR):

+DllCharacteristics     00000000
-DllCharacteristics     00000040

Not sure whether there is a RELRO equivalent, Canary is there but difficult to check from the outside as the mingw library is linked statically.

Edit: Ok, added the windows checks above for PE executables, and converted the above test to a test script test-security-check.py.

@theuni paths to tools like READELF, OBJDUMP can now be overridden

concept ACK

Looks good other than the comment above. Something to note: The libevent brought in a dependency on clock_gettime, which is a glibc compat issue. Once we bump to a newer gcc, we'll have to work that out for releases.

As discussed on IRC, this should also be hooked up to a make target for easier testing w/ travis and gitian. That can be done as a next step.