1610148 - Add /DEPENDENTLOADFLAG linker flag to configure

Status: ASSIGNED

(Firefox Build System :: General, enhancement)

Description

[Masatoshi Kimura [:emk]]

This will mitigate DLL preload attacks.

Does lld-link support /DEPENDENTLOADFLAG?

Comment 1

[Masatoshi Kimura [:emk]]

(In reply to Masatoshi Kimura [:emk] from comment #0)

Does lld-link support /DEPENDENTLOADFLAG?

It doesn't :(

90:45.38 lld-link: warning: ignoring unknown argument '-DEPENDENTLOADFLAG:0xA00'

Comment 2

[Masatoshi Kimura [:emk]]

Apparently this option corresponds to IMAGE_LOAD_CONFIG_DIRECTORY.DependentLoadFlags.

Comment 3

[Masatoshi Kimura [:emk]]

We can define _load_config_used to customize the IMAGE_LOAD_CONFIG_DIRECTORY structure.

Comment 4

[[e-mail]]

(In reply to Masatoshi Kimura [:emk] from comment #0)

This will mitigate DLL preload attacks.

Does lld-link support /DEPENDENTLOADFLAG?

It supports since LLVM 18.

Comment 5

[Masatoshi Kimura [:emk]]

(In reply to [e-mail] from comment #4)

(In reply to Masatoshi Kimura [:emk] from comment #0)

This will mitigate DLL preload attacks.

Does lld-link support /DEPENDENTLOADFLAG?

It supports since LLVM 18.

Great news!

Comment 6

[Masatoshi Kimura [:emk]]

Attachment: Bug 1610148 - Add -DEPENDENTLOADFLAG:0x800 to DLL link flags. r?#build!

We can't add the flag to EXE files unless we fix bug 1733734 or fix bug
1691782 and 1710147.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/95da9894a2b1
Add -DEPENDENTLOADFLAG:0x800 to DLL link flags. r=firefox-build-system-reviewers,glandium

Comment 8

[Aron Cseh]

Backed out for causing mass failures

• Backout link
• Push with failures
• Failure Log for build bustages on js\src\jit-test\tests\bug1213574.js
• Failure Log for mochitest failures on runtests.py
• Failure Log for reftest failures on @ mozilla::ipc::UtilityProcessImpl::LoadLibraryOrCrash
• Failure Log for wpt failures on testrunner.py
• Failure Log for gtest failures on UtilityProcess.LaunchProcess
• Failure Log for reftests on None
• Failure Log for Xpcshell assertion failures

Comment 9

[Masatoshi Kimura [:emk]]

Candidates:
js.exe -> mozglue nspr4
pk12util -> nss3 -> mozglue
certutil -> nss3 -> mozglue
mozavcodec -> gkcodecs mozavutil (Fails at LoadLibraryOrCrash)
certutil.exe -> nss3 -> mozglue