1520308 - mingw-clang builds do not have ASLR

Status: RESOLVED FIXED

(Firefox Build System :: General: Unsupported Platforms, enhancement, P5)

Description

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

mingw requires ASLR to be specified manually.

There seems to be two potential issues with this:

1. A problem I don't really know/understand that prevents it being enabled by default
2. An issue with relocations being stripped (as described here): https://insights.sei.cmu.edu/cert/2018/08/when-aslr-is-not-really-aslr---the-case-of-incorrect-assumptions-and-bad-defaults.html

We don't seem to be affected by (2) - I confirmed with Process Explorer that both the x86 and x64 opt builds[0] have ASLR on all modules and spot-checked several with winchecksec which checks for relocations.

I don't think we're affected by (1) either... the problem IIRC is with gcc/binutils and lld merely mirrors the default there.

[0] https://treeherder.mozilla.org/#/jobs?repo=try&revision=18c6aa91dd32be03d9f3f071ab63dcee4283b7b4 for reference

Comment 1

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: Bug 1520308 - Enable ASLR for mingw-clang builds r?Build

Comment 2

[(Away)]

Is there a reason that this needs to go under hardening flags, as opposed to just some general location?

Comment 3

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

(In reply to David Major [:dmajor] from comment #2)

Is there a reason that this needs to go under hardening flags, as opposed to just some general location?

No; it just seemed the most appropriate place. (I figured the fewer things that go in old-configure.in the better; and wasn't sure of a better place in a foo.configure.py)

Comment 4

[(Away)]

I'm on the fence so I'll leave it in the queue and see if anyone else has a strong opinion.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/326b73629e37
Enable ASLR for mingw-clang builds. r=froydnj

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/326b73629e37

Comment 7

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: Bug 1520308 - Enable ASLR for mingw-clang builds. r=froydnj (esr60)

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: Needed by Tor; brings central and esr60 in sync

User impact if declined: Tor will need to carry another patch

Fix Landed on Version: 66.0a1 / 20190119095933

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): mingw-clang build change only

((Note that this can wait until 60.6 just like Bug 1520310))

Comment 8

[Julien Cristau [:jcristau]]

Comment on attachment 9038261 [details] [diff] [review]
Bug 1520308 - Enable ASLR for mingw-clang builds. r=froydnj (esr60)

aslr for mingwclang, approved for 60.5esr build2.

Comment 9

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/e93a8e6c81dc