[ruby-core:97559] Re: [Ruby master Bug#16694] JIT vs hardened GCC with PCH

On 2020-03-18 4:30 a.m., [e-mail] wrote:
> As it turns out, this is because GCC in RHEL is fully hardened. Unfortunately, due to GCC design, when GCC is fully hardened, it cannot properly handle PCH due to memory address relocation. Moreover, PCH are also security risk, so it seems they are going to be disabled entirely on RHEL.

I thought about the risk for quite some time.In brief, I don't think 
there is a security problem.

Any program creating and reading a file which somehow affects program 
behaviour has the same security risk. For an attacker it would be easier 
to corrupt some ruby source (or byte) code file loaded during CRuby work 
because

 * PCH is created for a short period of time only during one CRuby 
process work vs a Ruby source (or byte code) file which can be created 
for much longer period of time and by another process

 * PCH has hard to understand format vs well defined Ruby source (or 
byte) code file

 * PCH has a simple mechanism to check its integrity and it works in 
case when Linux uses page randominazation for GCC processes

We could add signing PCH by some cryptographic hash and check the hash 
every time we use PCH.But as I wrote before it would be probably an 
overkill when there are weaker places to attack.

Unfortunately PCH for PIE GCC can not work with page randominazation.
And this is the current RHEL environment. Besides CRuby, there are other 
projects where PCH is used (mostly by big C/C++ program developers).I 
don't see that somebody in GCC community will re-implement PCH in the 
same way as it is done in Clang.Although there is a possibility that 
coming C++ modules can be used for C too.

There are several ways to solve this problem besides switching JIT off:

* use only clang for such environments

* use simple (non-PCH) header although it can probably slowdown JIT 
compilation speed significantly.The slowdown can be facilitated by

 * header minimization (I used it originally but it does not improve 
JIT speed compilation when PCH is used)

 * may be some threshold tuning (when to start JIT for a method) to 
avoid more important methods waiting more in JIT pipeline queue

* use one more approach based on non-fat LTO object file generated from 
the header as LTO works for GCC (and Clang) when page randomization 
(ASLR) is used.LTO object is processed even more that PCH.So it 
might increase JIT compilation speed even more than PCH usage.Although 
this approach needs some investigation (how well inlining will work in LTO).

Unfortunately, besides the advices I can not help solving this problem 
in the near future as I am currently busy with GCC and the light-weight 
JIT compiler project.

> Now I wonder what is the impact on Ruby JIT. I worry that with disabled PCH, the Ruby performance with JIT will be even worser without JIT. May be it is not good idea to use GCC for JIT. What are your thoughts?
>
> The original ticket with all the details is here [1].
>
> [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1721553
>
>
>


Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>