|
Hi, This is underwhelming and I have several questions inline On 12/5/22 20:58, Ben Cotton wrote:
https://fedoraproject.org/wiki/Changes/Add_FORTIFY_SOURCE%3D3_to_distribution_build_flags This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Replace the current `_FORTIFY_SOURCE=2` with `_FORTIFY_SOURCE=3` to improve mitigation of security issues arising from buffer overflows in packages in Fedora. == Owner == * Name: [[User:siddhesh| Siddhesh Poyarekar]] * Email: sipoyare@xxxxxxxxxx == Detailed Description == Default C and C++ compiler flags to build packages in Fedora currently includes `-Wp,-D_FORTIFY_SOURCE=2`, which enables fortification of some functions in glibc, thus providing some mitigation against buffer overflows. Since glibc 2.34 and GCC 12, there has been a new fortification level (`_FORTIFY_SOURCE=3`) which improves the coverage of this mitigation. The core change to bring in this mitigation is to change the default build flags in `redhat-rpm-config` so that packages build by default with `-Wp,-D_FORTIFY_SOURCE=3`. There are packages (e.g. `systemd`) that do not interact well with `_FORTIFY_SOURCE` and will also need a workaround to downgrade fortification to level 2. The change will also include this override. How come systemd gets an exception? If it is a security option, it should be enabled everywhere. I do not see benefit in a security change that ignores PID 1 process, If the feature, on the GCC side, is not 100% done. I do not have the knowledge or the time to be able to say that
GCC generated the wrong machine code and therefore it is not a
bug with my package. I assume that by the package providing the exception, packagers
get to choose themselves and we do not need to go through FESCO == Benefit to Fedora == [https://docs.google.com/spreadsheets/d/1nPSmbEf3HVB91zI8yBraMqVry3_ILmlV2Z5K7FZeHZg/edit?usp=sharing Analysis of packages] in Fedora rawhide indicate that the improvement of mitigation coverage is on average over 2.4x, in some cases protecting more than half of the fortified glibc calls in the target application. This change will thus harden Fedora to a significant extent, thus making it a more secure distribution out of the box. 1) Is there some complete source for all these findings? If
google sheets cannot handle all the "raw data" as noted in the
comment, 2) What does *anything* on that google sheet mean. I have
managed to figure out, from the article, that bos and bdos
correspond to level 2 and 3 of _FORTIFY_SOURCE. 3) I cannot speak to much else than Ruby, I do not see ruby in neither the failures or "All x86_64". Should we attempt to test it ourselves? Please provide a proper "how to test" section, I cannot fix
what I cannot test or compare results when I have no idea what I
am seeing. Actually, last time I heard about number of packages, it was
around 50k (not source, build result), and as I stated, If we also filter rubygem-* packages that depend on the
*libruby.so* (and most probably contain a binary extension
written in C/C++ that links to Ruby), I get 68 packages. I'll just ask, what is a false positive. How can I tell. What are the steps for this.== Scope == * Proposal owners: Post a merge request to redhat-rpm-config with the actual change to build flags. * Other developers: Resolve bugs filed for build failures, either by fixing the bug exposed by `_FORTIFY_SOURCE=3` or by disabling `_FORTIFY_SOURCE=3` for the package if it is a false positive or if the package is unable to adapt to the change. * Release engineering: Mass rebuild required * Policies and guidelines: Guidelines should include workaround for packages that fail to build with `-Wp,-D_FORTIFY_SOURCE=3` due to a false positive. This does not describe how to test, e.g. ahead of time, just that the packagers are to deal with the fallout...* Trademark approval: N/A (not needed for this Change) == Upgrade/compatibility impact == No ABI change, so there should be no impact on compatibility in a mixed environment. == How To Test == * Smoke testing of packages to ensure that they continue to work correctly. Some packages may have overflows exposed at runtime, which may need to be fixed. == User Experience == No noticeable change to users. I beg to differ. From what I am able to tell, from the limited provided sources, packages can have a runtime crash. A LOT of GUI packages use C or the likes that respond to the
flags of "fortify source". == Dependencies == None. == Contingency Plan == * Contingency mechanism: (What to do? Who will do it?) If too many packages are found to be broken at runtime, the default for fortification will be left at `_FORTIFY_SOURCE=2` for Fedora 38. Change owner will do this in `redhat-rpm-config` * Contingency deadline: Beta freeze * Blocks release? Yes * Blocks product? No == Documentation == [https://developers.redhat.com/articles/2022/09/17/gccs-new-fortification-level# More context on `_FORTIFY_SOURCE=3` improvements]. == Release Notes == Regards, Jarek Prokop |
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
