Skip to content

Commit 05e047c

Browse files
AlexeySachkovAlexeySachkov
authored
[SYCL][CMake] Fix and apply hardening flags to sycl-rel-6_2 (#19444)
This PR contains several cherry-picks and some unique changes which have not been applied to the `sycl` branch yet. The intent of this PR is to enable as much (quickly) possible hardening flags to be in better compliance with our SDL requirements. The main thing this PR is after are things like immediate bindings, fortify source, stack protection and `relro`. The thing that this PR is **not** after are extra warning flags - some of them we can't apply globally because LLVM itself isn't warning free, some of them we can't apply even locally to SYCL RT because we haven't fixed corresponding warnings yet. Patches which were cherry-picked from the `sycl` branch: - [SYCL] Fix AddSecurityFlags having no side effects (#17690) - Patch-By: Alexey Sachkov <[email protected]> - [SYCL] Refresh hardening flags applied to the project (#18398) - Patch-By: Nikita Kornev <[email protected]> - [SYCL][CMAKE] Refactor -fPIE handling (#19235) - Patch-By: Alexey Sachkov <[email protected]> - [SYCL][CMAKE] Drop nodlopen from hardening flags (#19357) - Patch-By: Alexey Sachkov <[email protected]> - [SYCL][CMAKE] Fix _FORTIFY_SOURCE=3 (#19268) - Patch-By: Alexey Sachkov <[email protected]> - [SYCL][CMake] Properly enable -pie hardening flag (#19447) - Patch-By: Alexey Sachkov <[email protected]> Additional changes which have **not** been applied to the `sycl` branch: - Adjusted `configure.py` to the new way of `-fPIE` handling - Dropped `/sdl` flag because LLVM isn't warning-free - it will be applied locally to SYCL RT in a separate PR against the `sycl` branch for future releases - Dropped `/analyze` flag because SYCL RT isn't warning-free - it will be applied locally to SYCL RT in a separate PR against the `sycl` branch for future releases
1 parent 36ad906 commit 05e047c

File tree

3 files changed

+190
-59
lines changed

3 files changed

+190
-59
lines changed

‎buildbot/configure.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,8 @@ def do_configure(args, passthrough_args):
236236
cmake_cmd += args.cmake_opt
237237

238238
if args.add_security_flags:
239+
if args.add_security_flags != 'none':
240+
cmake_cmd.extend(["-DCMAKE_POSITION_INDEPENDENT_CODE=ON"])
239241
cmake_cmd.extend(["-DEXTRA_SECURITY_FLAGS={}".format(args.add_security_flags)])
240242

241243
# Add path to root CMakeLists.txt

‎llvm/cmake/modules/AddSecurityFlags.cmake

Lines changed: 181 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
macro(add_compile_option_ext flag name)
2-
cmake_parse_arguments(ARG "" "" "" ${ARGN})
2+
cmake_parse_arguments(ARG "" "" "" ${ARGN})
33
set(CHECK_STRING "${flag}")
4-
if (MSVC)
4+
if(MSVC)
55
set(CHECK_STRING "/WX ${CHECK_STRING}")
66
else()
77
set(CHECK_STRING "-Werror ${CHECK_STRING}")
88
endif()
99

1010
check_c_compiler_flag("${CHECK_STRING}" "C_SUPPORTS_${name}")
1111
check_cxx_compiler_flag("${CHECK_STRING}" "CXX_SUPPORTS_${name}")
12-
if (C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
12+
if(C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
1313
message(STATUS "Building with ${flag}")
1414
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${flag}")
1515
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${flag}")
@@ -31,73 +31,196 @@ macro(add_link_option_ext flag name)
3131
endif()
3232
endmacro()
3333

34-
function(append_common_extra_security_flags)
35-
if( LLVM_ON_UNIX )
36-
# Fortify Source (strongly recommended):
37-
if (CMAKE_BUILD_TYPE STREQUAL "Debug")
38-
message(WARNING
39-
"-D_FORTIFY_SOURCE=2 can only be used with optimization.")
40-
message(WARNING "-D_FORTIFY_SOURCE=2 is not supported.")
34+
set(is_gcc FALSE)
35+
set(is_clang FALSE)
36+
set(is_msvc FALSE)
37+
set(is_icpx FALSE)
38+
39+
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
40+
set(is_clang TRUE)
41+
endif()
42+
if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
43+
set(is_gcc TRUE)
44+
endif()
45+
if(CMAKE_CXX_COMPILER_ID MATCHES "IntelLLVM")
46+
set(is_icpx TRUE)
47+
endif()
48+
if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
49+
set(is_msvc TRUE)
50+
endif()
51+
52+
macro(append_common_extra_security_flags)
53+
# Control Flow Integrity
54+
if(is_gcc
55+
OR is_clang
56+
OR (is_icpx AND MSVC))
57+
add_compile_option_ext("-fcf-protection=full" FCFPROTECTION)
58+
elseif(is_icpx)
59+
add_compile_option_ext("/Qcf-protection:full" FCFPROTECTION)
60+
elseif(is_msvc)
61+
add_link_option_ext("/LTCG" LTCG CMAKE_EXE_LINKER_FLAGS
62+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
63+
add_compile_option_ext("/guard:cf" GUARDCF)
64+
add_link_option_ext("/CETCOMPAT" CETCOMPAT CMAKE_EXE_LINKER_FLAGS
65+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
66+
endif()
67+
68+
# Format String Defense
69+
if(is_gcc
70+
OR is_clang
71+
OR (is_icpx AND MSVC))
72+
add_compile_option_ext("-Wformat" WFORMAT)
73+
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
74+
elseif(is_icpx)
75+
add_compile_option_ext("/Wformat" WFORMAT)
76+
add_compile_option_ext("/Wformat-security" WFORMATSECURITY)
77+
endif()
78+
79+
if(CMAKE_BUILD_TYPE MATCHES "Release")
80+
if(is_gcc
81+
OR is_clang
82+
OR (is_icpx AND MSVC))
83+
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
84+
endif()
85+
endif()
86+
87+
# Inexecutable Stack
88+
if(CMAKE_BUILD_TYPE MATCHES "Release")
89+
if(is_gcc
90+
OR is_clang
91+
OR (is_icpx AND MSVC))
92+
add_link_option_ext(
93+
"-Wl,-z,noexecstack" NOEXECSTACK CMAKE_EXE_LINKER_FLAGS
94+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
95+
endif()
96+
endif()
97+
98+
# Position Independent Code
99+
if(is_gcc
100+
OR is_clang
101+
OR (is_icpx AND MSVC))
102+
add_compile_option_ext("-fPIC" FPIC)
103+
elseif(is_msvc)
104+
add_compile_option_ext("/Gy" GY)
105+
endif()
106+
107+
# Position Independent Execution
108+
# We rely on CMake to set the right -fPIE flags for us, but it must be
109+
# explicitly requested
110+
if (CMAKE_POSITION_INDEPENDENT_CODE)
111+
include(CheckPIESupported)
112+
check_pie_supported()
113+
else()
114+
message(FATAL_ERROR "To enable all necessary security flags, CMAKE_POSITION_INDEPENDENT_CODE must be set to ON")
115+
endif()
116+
117+
if(is_msvc)
118+
add_link_option_ext("/DYNAMICBASE" DYNAMICBASE CMAKE_EXE_LINKER_FLAGS
119+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
120+
endif()
121+
122+
if(CMAKE_BUILD_TYPE MATCHES "Release")
123+
if(is_msvc)
124+
add_link_option_ext("/NXCOMPAT" NXCOMPAT CMAKE_EXE_LINKER_FLAGS
125+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
126+
endif()
127+
endif()
128+
129+
# Stack Protection
130+
if(is_msvc)
131+
add_compile_option_ext("/GS" GS)
132+
elseif(
133+
is_gcc
134+
OR is_clang
135+
OR (is_icpx AND MSVC))
136+
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
137+
add_compile_option_ext("-fstack-protector" FSTACKPROTECTOR)
138+
elseif(CMAKE_BUILD_TYPE MATCHES "Release")
139+
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
140+
add_compile_option_ext("-fstack-clash-protection" FSTACKCLASHPROTECTION)
141+
endif()
142+
endif()
143+
144+
# Fortify Source (strongly recommended):
145+
if (NOT WIN32)
146+
# Strictly speaking, _FORTIFY_SOURCE is a glibc feature and not a compiler
147+
# feature. However, we experienced some issues (warnings about redefined macro
148+
# which are problematic under -Werror) when setting it to value '3' with older
149+
# gcc versions. Hence the check.
150+
# Value '3' became supported in glibc somewhere around gcc 12, so that is
151+
# what we are looking for.
152+
if (is_gcc AND CMAKE_CXX_COMPILER_VERSION VERSION_LESS 12)
153+
set(FORTIFY_SOURCE "-D_FORTIFY_SOURCE=2")
154+
else()
155+
# Assuming that the problem is not reproducible with other compilers
156+
set(FORTIFY_SOURCE "-D_FORTIFY_SOURCE=3")
157+
endif()
158+
159+
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
160+
message(WARNING "${FORTIFY_SOURCE} can only be used with optimization.")
161+
message(WARNING "${FORTIFY_SOURCE} is not supported.")
41162
else()
42-
# Sanitizers do not work with checked memory functions,
43-
# such as __memset_chk. We do not build release packages
44-
# with sanitizers, so just avoid -D_FORTIFY_SOURCE=2
45-
# under LLVM_USE_SANITIZER.
46-
if (NOT LLVM_USE_SANITIZER)
47-
message(STATUS "Building with -D_FORTIFY_SOURCE=2")
48-
add_definitions(-D_FORTIFY_SOURCE=2)
163+
# Sanitizers do not work with checked memory functions, such as
164+
# __memset_chk. We do not build release packages with sanitizers, so just
165+
# avoid -D_FORTIFY_SOURCE=N under LLVM_USE_SANITIZER.
166+
if(NOT LLVM_USE_SANITIZER)
167+
message(STATUS "Building with ${FORTIFY_SOURCE}")
168+
add_definitions(${FORTIFY_SOURCE})
49169
else()
50-
message(WARNING
51-
"-D_FORTIFY_SOURCE=2 dropped due to LLVM_USE_SANITIZER.")
170+
message(
171+
WARNING "${FORTIFY_SOURCE} dropped due to LLVM_USE_SANITIZER.")
52172
endif()
53173
endif()
174+
endif()
54175

55-
# Format String Defense
56-
add_compile_option_ext("-Wformat" WFORMAT)
57-
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
58-
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
59-
60-
# Stack Protection
61-
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
176+
if(LLVM_ON_UNIX)
177+
if(LLVM_ENABLE_ASSERTIONS)
178+
add_definitions(-D_GLIBCXX_ASSERTIONS)
179+
endif()
62180

63181
# Full Relocation Read Only
64-
add_link_option_ext("-Wl,-z,relro" ZRELRO
65-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
66-
CMAKE_SHARED_LINKER_FLAGS)
182+
if(CMAKE_BUILD_TYPE MATCHES "Release")
183+
add_link_option_ext("-Wl,-z,relro" ZRELRO CMAKE_EXE_LINKER_FLAGS
184+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
185+
endif()
67186

68187
# Immediate Binding (Bindnow)
69-
add_link_option_ext("-Wl,-z,now" ZNOW
70-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
71-
CMAKE_SHARED_LINKER_FLAGS)
188+
if(CMAKE_BUILD_TYPE MATCHES "Release")
189+
add_link_option_ext("-Wl,-z,now" ZNOW CMAKE_EXE_LINKER_FLAGS
190+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
191+
endif()
72192
endif()
73-
endfunction()
193+
endmacro()
74194

75-
if ( EXTRA_SECURITY_FLAGS )
76-
if (EXTRA_SECURITY_FLAGS STREQUAL "none")
195+
if(EXTRA_SECURITY_FLAGS)
196+
if(EXTRA_SECURITY_FLAGS STREQUAL "none")
77197
# No actions.
78-
elseif (EXTRA_SECURITY_FLAGS STREQUAL "default")
79-
append_common_extra_security_flags()
80-
elseif (EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
81-
append_common_extra_security_flags()
82-
if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
83-
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
84-
add_link_option_ext("-fsanitize=cfi" FSANITIZE_CFI_LINK
85-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
86-
CMAKE_SHARED_LINKER_FLAGS)
87-
# Recommended option although linking a DSO with SafeStack is not currently supported by compiler.
88-
#add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
89-
#add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
90-
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
91-
# CMAKE_SHARED_LINKER_FLAGS)
92-
else()
93-
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
94-
# need to align compile and link option set, link now is set unconditionally
95-
add_link_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION_LINK
96-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
97-
CMAKE_SHARED_LINKER_FLAGS)
98-
endif()
198+
elseif(EXTRA_SECURITY_FLAGS STREQUAL "default")
199+
append_common_extra_security_flags()
200+
elseif(EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
201+
append_common_extra_security_flags()
202+
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
203+
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
204+
add_link_option_ext(
205+
"-fsanitize=cfi" FSANITIZE_CFI_LINK CMAKE_EXE_LINKER_FLAGS
206+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
207+
# Recommended option although linking a DSO with SafeStack is not
208+
# currently supported by compiler.
209+
# add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
210+
# add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
211+
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
212+
# CMAKE_SHARED_LINKER_FLAGS)
99213
else()
100-
message(FATAL_ERROR "Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
214+
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
215+
# need to align compile and link option set, link now is set
216+
# unconditionally
217+
add_link_option_ext(
218+
"-fcf-protection=full -mcet" FCF_PROTECTION_LINK CMAKE_EXE_LINKER_FLAGS
219+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
101220
endif()
221+
else()
222+
message(
223+
FATAL_ERROR
224+
"Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
225+
endif()
102226
endif()
103-

‎unified-runtime/cmake/helpers.cmake

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,13 @@ endif()
8888

8989
function(add_ur_target_compile_options name)
9090
if(NOT MSVC)
91-
target_compile_definitions(${name} PRIVATE -D_FORTIFY_SOURCE=2)
91+
if (NOT LLVM_ENABLE_PROJECTS)
92+
# If UR is built as part of LLVM (i.e. as part of SYCL), then
93+
# _FORTIFY_SOURCE will be set globally in advance to a potentially
94+
# different value. To avoid redefinition errors, only set the
95+
# macro for a "standalone" build.
96+
target_compile_definitions(${name} PRIVATE -D_FORTIFY_SOURCE=2)
97+
endif()
9298
target_compile_options(${name} PRIVATE
9399
# Warning options
94100
-Wall

0 commit comments

Comments
 (0)