diff options
author | khorben <khorben@pkgsrc.org> | 2017-07-04 18:29:24 +0000 |
---|---|---|
committer | khorben <khorben@pkgsrc.org> | 2017-07-04 18:29:24 +0000 |
commit | e504de32d6dadead694949e633f537a84f02ef62 (patch) | |
tree | cc1a8a45554fd94c2cae87753a6c3c0ba19bf994 /mk/check/check-relro-elf.awk | |
parent | f9c7bc7d0cd2a028ed68aa615536d06954995cc8 (diff) | |
download | pkgsrc-e504de32d6dadead694949e633f537a84f02ef62.tar.gz |
Implement a check for RELRO
This is only performed if PKG_DEVELOPER and RELRO are in use.
After a suggestion during my talk at BSDCan 2017; thanks!
Also, submitted on tech-pkg@ for review mid-June.
As a next step, it seems this can be extended to libraries, just like the
check for SHLIBS does (from which this is inspired).
Diffstat (limited to 'mk/check/check-relro-elf.awk')
-rw-r--r-- | mk/check/check-relro-elf.awk | 91 |
1 files changed, 91 insertions, 0 deletions
diff --git a/mk/check/check-relro-elf.awk b/mk/check/check-relro-elf.awk new file mode 100644 index 00000000000..3c48ad1b020 --- /dev/null +++ b/mk/check/check-relro-elf.awk @@ -0,0 +1,91 @@ +# $NetBSD: check-relro-elf.awk,v 1.1 2017/07/04 18:29:24 khorben Exp $ +# +# Copyright (c) 2007 Joerg Sonnenberger <joerg@NetBSD.org>. +# Copyright (c) 2017 Pierre Pronchery <khorben@NetBSD.org>. +# All rights reserved. +# +# This code is derived from software contributed to The NetBSD Foundation +# by Joerg Sonnenberger. +# +# Originally developed as part of Google's Summer of Code 2007 program. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS +# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +# COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, +# INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, +# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED +# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT +# OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +# +# Read a list of potential ELF binaries from stdin. +# For each, extract the list of program headers. +# Check that the GNU_RELRO header is present. +# + +function shquote(IN, out) { + out = IN; + gsub("\\\\", "\\\\", out); + gsub("\\\n", "\\n", out); + gsub("\\\t", "\\t", out); + gsub(" ", "\\ ", out); + gsub("'", "\\'", out); + gsub("`", "\\`", out); + gsub("\"", "\\\"", out); + gsub(";", "\\;", out); + gsub("&", "\\&", out); + gsub("<", "\\<", out); + gsub(">", "\\>", out); + gsub("\\(", "\\(", out); + gsub("\\)", "\\)", out); + gsub("\\|", "\\|", out); + gsub("\\*", "\\*", out); + gsub("\\?", "\\?", out); + gsub("\\{", "\\{", out); + gsub("\\}", "\\}", out); + gsub("\\[", "\\[", out); + gsub("\\]", "\\]", out); + gsub("\\$", "\\$", out); + gsub("!", "\\!", out); + gsub("#", "\\#", out); + gsub("\\^", "\\^", out); + gsub("~", "\\~", out); + return out; +} + +function checkrelro(ELF, got_relro) { + cmd = readelf " -Wl " shquote(ELF) " 2> /dev/null" + while ((cmd | getline) > 0) { + if ($1 == "GNU_RELRO") { + got_relro = 1 + } + } + close(cmd) + if (got_relro != 1) { + print ELF ": missing RELRO" + } +} + +BEGIN { + readelf = ENVIRON["READELF"] + if (readelf == "") + readelf = "readelf" +} + +{ checkrelro($0); } |