[#109095] [Ruby master Misc#18888] Migrate ruby-lang.org mail services to Google Domains and Google Workspace — "shugo (Shugo Maeda)" <noreply@...>
Issue #18888 has been reported by shugo (Shugo Maeda).
16 messages
2022/06/30
[ruby-core:109013] [Ruby master Bug#18061] Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found
From:
"ioquatix (Samuel Williams)" <noreply@...>
Date:
2022-06-20 03:24:01 UTC
List:
ruby-core #109013
Issue #18061 has been updated by ioquatix (Samuel Williams). While it was passing, it's now failing: ## Previously Passing https://github.com/ruby/ruby/runs/6956677552?check_suite_focus=true#step:20:54 ``` ================================================================================ Package Architecture Version Repository Size ================================================================================ Installing: annobin-annocheck x86_64 10.73-1.fc36 updates 165 k Installing dependencies: annobin-docs noarch 10.73-1.fc36 updates 90 k cpio x86_64 2.13-12.fc36 fedora 270 k Transaction Summary ================================================================================ ... snip ... annocheck: Version 10.73. Hardened: ruby: PASS: optimization test Hardened: ruby: PASS: pic test Hardened: ruby: PASS: stack-prot test Hardened: ruby: PASS: cf-protection test because correct flags found in .note.gnu.property note Hardened: ruby: PASS: writable-got test Hardened: ruby: PASS: dynamic-segment test Hardened: ruby: PASS: bind-now test Hardened: ruby: PASS: run-path test because the DT_RUNPATH dynamic tag is present and correct Hardened: ruby: PASS: entry test Hardened: ruby: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: ruby: PASS: gnu-relro test Hardened: ruby: skip: branch-protection test because not an AArch64 binary Hardened: ruby: skip: dynamic-tags test because AArch64 specific Hardened: ruby: skip: fortify test because no C/C++ compiled code found Hardened: ruby: skip: glibcxx-assertions test because source language not C++ Hardened: ruby: skip: go-revision test because no GO compiled code found Hardened: ruby: PASS: instrumentation test Hardened: ruby: skip: lto test because not compiled C/C++ code Hardened: ruby: skip: only-go test because no GO compiled code found Hardened: ruby: PASS: production test Hardened: ruby: PASS: property-note test because CET enabled property note found Hardened: ruby: PASS: rwx-seg test Hardened: ruby: PASS: short-enums test Hardened: ruby: skip: stack-clash test because no C/C++ compiled code found Hardened: ruby: skip: stack-realign test because not a 32-bit i686 executable Hardened: ruby: PASS: textrel test Hardened: ruby: PASS: threads test Hardened: ruby: PASS: unicode test Hardened: ruby: skip: warnings test because no C/C++ compiled code found Hardened: ruby: Overall: PASS. ``` ## Now Failing https://github.com/ruby/ruby/runs/6959694909?check_suite_focus=true#step:20:53 ``` ================================================================================ Package Architecture Version Repository Size ================================================================================ Installing: annobin-annocheck x86_64 10.76-1.fc36 updates 167 k Installing dependencies: annobin-docs noarch 10.76-1.fc36 updates 91 k cpio x86_64 2.13-12.fc36 fedora 270 k Transaction Summary ================================================================================ ... snip ... annocheck: Version 10.76. Hardened: ruby: PASS: optimization test Hardened: ruby: PASS: pic test Hardened: ruby: PASS: stack-prot test Hardened: ruby: PASS: cf-protection test because correct flags found in .note.gnu.property note Hardened: ruby: PASS: writable-got test Hardened: ruby: PASS: dynamic-segment test Hardened: ruby: PASS: bind-now test Hardened: ruby: PASS: run-path test because the DT_RUNPATH dynamic tag is present and correct Hardened: ruby: PASS: entry test Hardened: ruby: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: ruby: PASS: gnu-relro test Hardened: ruby: MAYB: test: gaps because no notes found Hardened: ruby: info: For more information visit: https://sourceware.org/annobin/annobin.html/Test-gaps.html Hardened: ruby: skip: branch-protection test because not an AArch64 binary Hardened: ruby: skip: dynamic-tags test because AArch64 specific Hardened: ruby: skip: fortify test because no C/C++ compiled code found Hardened: ruby: skip: glibcxx-assertions test because source language not C++ Hardened: ruby: skip: go-revision test because no GO compiled code found Hardened: ruby: PASS: instrumentation test Hardened: ruby: skip: lto test because not compiled C/C++ code Hardened: ruby: skip: only-go test because no GO compiled code found Hardened: ruby: PASS: production test Hardened: ruby: PASS: property-note test because CET enabled property note found Hardened: ruby: PASS: rwx-seg test Hardened: ruby: PASS: short-enums test Hardened: ruby: skip: stack-clash test because no C/C++ compiled code found Hardened: ruby: skip: stack-realign test because not a 32-bit i686 executable Hardened: ruby: PASS: textrel test Hardened: ruby: PASS: threads test Hardened: ruby: PASS: unicode test Hardened: ruby: skip: warnings test because no C/C++ compiled code found Hardened: ruby: Overall: FAIL (due to MAYB results). ``` I haven't touched the implementation except for my PR. I don't think this is a matter of just adding notes, I think the coroutine implementation needs to maintain a shadow stack for the purpose of return value tracking etc. I don't know enough about the relevant technologies to implement this right now. We can't just enable the flags without the corresponding implementation - with CET enabled, I'd imagine it would crash. I did implement ASAN which has a similar shadow stack. With that in mind, it might be possible to follow a similar implementation. But this is not something I'm very familiar with. ---------------------------------------- Bug #18061: Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found https://bugs.ruby-lang.org/issues/18061#change-98124 * Author: jaruga (Jun Aruga) * Status: Open * Priority: Normal * Backport: 2.6: UNKNOWN, 2.7: REQUIRED, 3.0: REQUIRED ---------------------------------------- I found an issue in our company's internal test called "execshield" by a security tool annobin - annocheck command [1][2]. ``` Hardened: libruby.so.2.7.4: FAIL: property-note test because no .note.gnu.property section found ``` Here is the reproducer on the upstream latest master, commit is 5f2987d6c2ae9ace3178ac3e1bbb4ac7079101eb, ``` $ autoconf $ ./configure --enable-shared $ make $ ls libruby.so.3.1.0 libruby.so.3.1.0* ``` If you are using Red Hat based Linux distro, it's easy to install by the RPM package like this. ``` $ sudo dnf -y install annobin-annocheck ``` ``` $ sudo yum -y install annobin-annocheck ``` Then ``` $ annocheck libruby.so.3.1.0 ``` If you are using other Linux distros such as Ubuntu, you can use it by a container I prepared. Prepare the following `Dockerfile`. ``` $ cat Dockerfile FROM docker.io/fedora:34 RUN cat /etc/fedora-release RUN dnf -y install annobin-annocheck WORKDIR /work ``` Then build the container image with the `Dockerfile` and run the annocheck command for the `libruby.so.3.1.0` on your host environment. The `-v` is an option for bind mount between host and container environment. ``` $ docker build --rm -t fedora-annocheck . $ docker run --rm -t -v $(pwd):/work fedora-annocheck annocheck /work/libruby.so.3.1.0 annocheck: Version 9.79. Hardened: libruby.so.3.1.0: FAIL: bind-now test because not linked with -Wl,-z,now Hardened: libruby.so.3.1.0: FAIL: notes test because gaps were detected in the annobin coverage Hardened: libruby.so.3.1.0: FAIL: cf-protection test because no .note.gnu.property section = no control flow information Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found Hardened: Rerun annocheck with --verbose to see more information on the tests. ``` The message `Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found` is what I found in our internal test. For other FAIL messages, maybe it can be fixed by changing how to build. Asking a colleague, I was told that the `coroutine/*/Context.S` files such as [coroutine/x86/Context.S](https://github.com/ruby/ruby/blob/master/coroutine/x86/Context.S) cause the failure. Do you have any idea how to fix this? Thanks. * [1] https://sourceware.org/annobin/ * [2] You can see `man annocheck` or https://www.mankier.com/1/annocheck . ---Files-------------------------------- 0001-Add-.note.gnu.property-sections.patch (2.64 KB) 0001-Add-.note.gnu.property-sections.patch (3.69 KB) config-pie.log (11.4 KB) -- https://bugs.ruby-lang.org/ Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>