From b6420480a57ec062d7bb47eb4f2d7607fb0d0f03 Mon Sep 17 00:00:00 2001 From: Omair Majid Date: Oct 16 2019 18:36:31 +0000 Subject: [PATCH 1/2] Harden built binaries to pass annocheck After building and installing all the built packages (including -debuginfo* and -debugsources*), annocheck -v reports no FAILs or MAYBs on my system. This doesn't mean that .NET Core has been completely hardened. annocheck can only partially check binaries produced by non-gcc compilers. It requires code to have been compiled by gcc to be able to accurately verify binaries. Additionally, clang lacks several hardening flags. For more information about annocheck, see: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files/ --- diff --git a/core-setup-hardening-flags.patch b/core-setup-hardening-flags.patch new file mode 100644 index 0000000..3f6b91c --- /dev/null +++ b/core-setup-hardening-flags.patch @@ -0,0 +1,11 @@ +diff --git a/src/settings.cmake b/src/settings.cmake +--- a/src/settings.cmake ++++ b/src/settings.cmake +@@ -218,6 +218,7 @@ if(${CMAKE_SYSTEM_NAME} MATCHES "Linux") + set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Xlinker -Bsymbolic -Bsymbolic-functions") + set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,--build-id=sha1") + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,--build-id=sha1") ++ set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -pie") + add_compile_options(-fstack-protector-strong) + elseif(${CMAKE_SYSTEM_NAME} MATCHES "Darwin") + add_compile_options(-fstack-protector) diff --git a/coreclr-hardening-flags.patch b/coreclr-hardening-flags.patch new file mode 100644 index 0000000..d58d735 --- /dev/null +++ b/coreclr-hardening-flags.patch @@ -0,0 +1,11 @@ +diff --git a/src/debug/createdump/CMakeLists.txt b/src/debug/createdump/CMakeLists.txt +--- a/src/debug/createdump/CMakeLists.txt ++++ b/src/debug/createdump/CMakeLists.txt +@@ -21,6 +21,7 @@ include_directories(BEFORE ${VM_DIR}) + add_definitions(-DPAL_STDCPP_COMPAT) + + add_compile_options(-fPIE) ++add_link_options(-pie) + + set(CREATEDUMP_SOURCES + createdump.cpp diff --git a/dotnet3.0.spec b/dotnet3.0.spec index 54cefab..5f71c6e 100644 --- a/dotnet3.0.spec +++ b/dotnet3.0.spec @@ -52,7 +52,7 @@ Name: dotnet3.0 Version: %{sdk_rpm_version} -Release: 2%{?dist} +Release: 3%{?dist} Summary: .NET Core CLI tools and runtime License: MIT and ASL 2.0 and BSD URL: https://github.com/dotnet/ @@ -65,7 +65,10 @@ Source2: dotnet.sh.in Patch100: corefx-optflags-support.patch +Patch200: coreclr-hardening-flags.patch + Patch300: core-setup-do-not-strip.patch +Patch301: core-setup-hardening-flags.patch Patch500: cli-telemetry-optout.patch @@ -301,10 +304,12 @@ pushd src/corefx.* popd pushd src/coreclr.* +%patch200 -p1 popd pushd src/core-setup.* %patch300 -p1 +%patch301 -p1 popd pushd src/cli.* @@ -431,6 +436,9 @@ echo "Testing build results for debug symbols..." %dir %{_libdir}/dotnet/packs %changelog +* Wed Oct 16 2019 Omair Majid - 3.0.100-3 +- Harden built binaries to pass annocheck + * Fri Oct 11 2019 Omair Majid - 3.0.100-2 - Export DOTNET_ROOT in profile to make apphost lookup work From df27114eaea7fa277ca62dc1b2c5cf9711d77c0d Mon Sep 17 00:00:00 2001 From: Omair Majid Date: Oct 17 2019 14:32:12 +0000 Subject: [PATCH 2/2] Fix coreclr to build on Fedora 32 --- diff --git a/coreclr-27048-sysctl-deprecation.patch b/coreclr-27048-sysctl-deprecation.patch new file mode 100644 index 0000000..e1fdb5a --- /dev/null +++ b/coreclr-27048-sysctl-deprecation.patch @@ -0,0 +1,42 @@ +From 3dd725eca0079e2b49821dfeb0ec1cb166cc7414 Mon Sep 17 00:00:00 2001 +From: Omair Majid +Date: Fri, 4 Oct 2019 19:29:53 -0400 +Subject: [PATCH] Handle glibc sys/sysctl.h deprecation + +glibc has deprecated sys/sysctl.h: + + In file included from /coreclr/src/pal/src/misc/sysinfo.cpp:32: + /usr/include/sys/sysctl.h:21:2: error: "The header is deprecated and will be removed." [-Werror,-W#warnings] + #warning "The header is deprecated and will be removed." + ^ + 1 error generated. + +Fix that by preferring sysconf and only including sys/sysctl.h if +HAVE_SYSCONF is not true. This mirrors the order of the implementation +code in this file (sysinfo.cpp) which checks for HAVE_SYSCONF +before HAVE_SYSCTL. + +Fixes #27008 +--- + src/pal/src/misc/sysinfo.cpp | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/pal/src/misc/sysinfo.cpp b/src/pal/src/misc/sysinfo.cpp +index e1c949e38d53..50ccf3a75e16 100644 +--- a/src/pal/src/misc/sysinfo.cpp ++++ b/src/pal/src/misc/sysinfo.cpp +@@ -28,9 +28,12 @@ Revision History: + #include + #include + #include +-#if HAVE_SYSCTL ++ ++#if HAVE_SYSCONF ++// already included above ++#elif HAVE_SYSCTL + #include +-#elif !HAVE_SYSCONF ++#else + #error Either sysctl or sysconf is required for GetSystemInfo. + #endif + diff --git a/dotnet3.0.spec b/dotnet3.0.spec index 5f71c6e..6f5cc10 100644 --- a/dotnet3.0.spec +++ b/dotnet3.0.spec @@ -52,7 +52,7 @@ Name: dotnet3.0 Version: %{sdk_rpm_version} -Release: 3%{?dist} +Release: 4%{?dist} Summary: .NET Core CLI tools and runtime License: MIT and ASL 2.0 and BSD URL: https://github.com/dotnet/ @@ -65,7 +65,8 @@ Source2: dotnet.sh.in Patch100: corefx-optflags-support.patch -Patch200: coreclr-hardening-flags.patch +Patch200: coreclr-27048-sysctl-deprecation.patch +Patch201: coreclr-hardening-flags.patch Patch300: core-setup-do-not-strip.patch Patch301: core-setup-hardening-flags.patch @@ -305,6 +306,7 @@ popd pushd src/coreclr.* %patch200 -p1 +%patch201 -p1 popd pushd src/core-setup.* @@ -436,6 +438,9 @@ echo "Testing build results for debug symbols..." %dir %{_libdir}/dotnet/packs %changelog +* Wed Oct 16 2019 Omair Majid - 3.0.100-4 +- Include fix from coreclr for building on Fedora 32 + * Wed Oct 16 2019 Omair Majid - 3.0.100-3 - Harden built binaries to pass annocheck