Skip to content

Commit 66ad7ae

Browse files
KornevNikitaAlexeySachkov
KornevNikita
and
AlexeySachkov
authored
[SYCL] Refresh hardening flags applied to the project (#18398)
Co-authored-by: Alexey Sachkov <alexey.sachkov@intel.com>
1 parent 87a681e commit 66ad7ae

1 file changed

Lines changed: 189 additions & 55 deletions

File tree

‎llvm/cmake/modules/AddSecurityFlags.cmake‎

Lines changed: 189 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
macro(add_compile_option_ext flag name)
2-
cmake_parse_arguments(ARG "" "" "" ${ARGN})
2+
cmake_parse_arguments(ARG "" "" "" ${ARGN})
33
set(CHECK_STRING "${flag}")
4-
if (MSVC)
4+
if(MSVC)
55
set(CHECK_STRING "/WX ${CHECK_STRING}")
66
else()
77
set(CHECK_STRING "-Werror ${CHECK_STRING}")
88
endif()
99

1010
check_c_compiler_flag("${CHECK_STRING}" "C_SUPPORTS_${name}")
1111
check_cxx_compiler_flag("${CHECK_STRING}" "CXX_SUPPORTS_${name}")
12-
if (C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
12+
if(C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
1313
message(STATUS "Building with ${flag}")
1414
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${flag}")
1515
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${flag}")
@@ -31,73 +31,207 @@ macro(add_link_option_ext flag name)
3131
endif()
3232
endmacro()
3333

34+
set(is_gcc FALSE)
35+
set(is_clang FALSE)
36+
set(is_msvc FALSE)
37+
set(is_icpx FALSE)
38+
39+
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
40+
set(is_clang TRUE)
41+
endif()
42+
if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
43+
set(is_gcc TRUE)
44+
endif()
45+
if(CMAKE_CXX_COMPILER_ID MATCHES "IntelLLVM")
46+
set(is_icpx TRUE)
47+
endif()
48+
if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
49+
set(is_msvc TRUE)
50+
endif()
51+
3452
macro(append_common_extra_security_flags)
35-
if( LLVM_ON_UNIX )
53+
# Compiler Warnings and Error Detection
54+
# Note: in intel/llvm we build both linux and win with --ci-defaults.
55+
# This flag also enables -Werror or /WX.
56+
if(is_gcc
57+
OR is_clang
58+
OR (is_icpx AND MSVC))
59+
add_compile_option_ext("-Wall" WALL)
60+
add_compile_option_ext("-Wextra" WEXTRA)
61+
elseif(is_icpx)
62+
add_compile_option_ext("/Wall" WALL)
63+
elseif(is_msvc)
64+
add_compile_option_ext("/W4" WALL)
65+
endif()
66+
67+
if(CMAKE_BUILD_TYPE MATCHES "Release")
68+
if(is_gcc
69+
OR is_clang
70+
OR (is_icpx AND MSVC))
71+
add_compile_option_ext("-Wconversion" WCONVERSION)
72+
add_compile_option_ext("-Wimplicit-fallthrough" WIMPLICITFALLTHROUGH)
73+
endif()
74+
endif()
75+
76+
# Control Flow Integrity
77+
if(is_gcc
78+
OR is_clang
79+
OR (is_icpx AND MSVC))
80+
add_compile_option_ext("-fcf-protection=full" FCFPROTECTION)
81+
elseif(is_icpx)
82+
add_compile_option_ext("/Qcf-protection:full" FCFPROTECTION)
83+
elseif(is_msvc)
84+
add_link_option_ext("/LTCG" LTCG CMAKE_EXE_LINKER_FLAGS
85+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
86+
add_compile_option_ext("/sdl" SDL)
87+
add_compile_option_ext("/guard:cf" GUARDCF)
88+
add_link_option_ext("/CETCOMPAT" CETCOMPAT CMAKE_EXE_LINKER_FLAGS
89+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
90+
endif()
91+
92+
# Format String Defense
93+
if(is_gcc
94+
OR is_clang
95+
OR (is_icpx AND MSVC))
96+
add_compile_option_ext("-Wformat" WFORMAT)
97+
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
98+
elseif(is_icpx)
99+
add_compile_option_ext("/Wformat" WFORMAT)
100+
add_compile_option_ext("/Wformat-security" WFORMATSECURITY)
101+
elseif(is_msvc)
102+
add_compile_option_ext("/analyze" ANALYZE)
103+
endif()
104+
105+
if(CMAKE_BUILD_TYPE MATCHES "Release")
106+
if(is_gcc
107+
OR is_clang
108+
OR (is_icpx AND MSVC))
109+
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
110+
endif()
111+
endif()
112+
113+
# Inexecutable Stack
114+
if(CMAKE_BUILD_TYPE MATCHES "Release")
115+
if(is_gcc
116+
OR is_clang
117+
OR (is_icpx AND MSVC))
118+
add_link_option_ext(
119+
"-Wl,-z,noexecstack" NOEXECSTACK CMAKE_EXE_LINKER_FLAGS
120+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
121+
endif()
122+
endif()
123+
124+
# Position Independent Code
125+
if(is_gcc
126+
OR is_clang
127+
OR (is_icpx AND MSVC))
128+
add_compile_option_ext("-fPIC" FPIC)
129+
elseif(is_msvc)
130+
add_compile_option_ext("/Gy" GY)
131+
endif()
132+
133+
# Position Independent Execution
134+
if(is_gcc
135+
OR is_clang
136+
OR (is_icpx AND MSVC))
137+
# The project should be configured with -DCMAKE_POSITION_INDEPENDENT_CODE=ON
138+
add_compile_option_ext("-fPIE" FPIE)
139+
add_link_option_ext("-pie" PIE CMAKE_EXE_LINKER_FLAGS
140+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
141+
elseif(is_msvc)
142+
add_link_option_ext("/DYNAMICBASE" DYNAMICBASE CMAKE_EXE_LINKER_FLAGS
143+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
144+
endif()
145+
146+
if(CMAKE_BUILD_TYPE MATCHES "Release")
147+
if(is_msvc)
148+
add_link_option_ext("/NXCOMPAT" NXCOMPAT CMAKE_EXE_LINKER_FLAGS
149+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
150+
endif()
151+
endif()
152+
153+
# Stack Protection
154+
if(is_msvc)
155+
add_compile_option_ext("/GS" GS)
156+
elseif(
157+
is_gcc
158+
OR is_clang
159+
OR (is_icpx AND MSVC))
160+
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
161+
add_compile_option_ext("-fstack-protector" FSTACKPROTECTOR)
162+
elseif(CMAKE_BUILD_TYPE MATCHES "Release")
163+
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
164+
add_compile_option_ext("-fstack-clash-protection" FSTACKCLASHPROTECTION)
165+
endif()
166+
endif()
167+
168+
if(LLVM_ON_UNIX)
36169
# Fortify Source (strongly recommended):
37-
if (CMAKE_BUILD_TYPE STREQUAL "Debug")
38-
message(WARNING
39-
"-D_FORTIFY_SOURCE=2 can only be used with optimization.")
40-
message(WARNING "-D_FORTIFY_SOURCE=2 is not supported.")
170+
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
171+
message(WARNING "-D_FORTIFY_SOURCE=3 can only be used with optimization.")
172+
message(WARNING "-D_FORTIFY_SOURCE=3 is not supported.")
41173
else()
42-
# Sanitizers do not work with checked memory functions,
43-
# such as __memset_chk. We do not build release packages
44-
# with sanitizers, so just avoid -D_FORTIFY_SOURCE=2
45-
# under LLVM_USE_SANITIZER.
46-
if (NOT LLVM_USE_SANITIZER)
47-
message(STATUS "Building with -D_FORTIFY_SOURCE=2")
48-
add_definitions(-D_FORTIFY_SOURCE=2)
174+
# Sanitizers do not work with checked memory functions, such as
175+
# __memset_chk. We do not build release packages with sanitizers, so just
176+
# avoid -D_FORTIFY_SOURCE=3 under LLVM_USE_SANITIZER.
177+
if(NOT LLVM_USE_SANITIZER)
178+
message(STATUS "Building with -D_FORTIFY_SOURCE=3")
179+
add_definitions(-D_FORTIFY_SOURCE=3)
49180
else()
50-
message(WARNING
51-
"-D_FORTIFY_SOURCE=2 dropped due to LLVM_USE_SANITIZER.")
181+
message(
182+
WARNING "-D_FORTIFY_SOURCE=3 dropped due to LLVM_USE_SANITIZER.")
52183
endif()
53184
endif()
54185

55-
# Format String Defense
56-
add_compile_option_ext("-Wformat" WFORMAT)
57-
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
58-
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
59-
60-
# Stack Protection
61-
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
186+
if(LLVM_ENABLE_ASSERTIONS)
187+
add_definitions(-D_GLIBCXX_ASSERTIONS)
188+
endif()
62189

63190
# Full Relocation Read Only
64-
add_link_option_ext("-Wl,-z,relro" ZRELRO
65-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
66-
CMAKE_SHARED_LINKER_FLAGS)
191+
if(CMAKE_BUILD_TYPE MATCHES "Release")
192+
add_link_option_ext("-Wl,-z,relro" ZRELRO CMAKE_EXE_LINKER_FLAGS
193+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
194+
endif()
67195

68196
# Immediate Binding (Bindnow)
69-
add_link_option_ext("-Wl,-z,now" ZNOW
70-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
71-
CMAKE_SHARED_LINKER_FLAGS)
197+
if(CMAKE_BUILD_TYPE MATCHES "Release")
198+
add_link_option_ext("-Wl,-z,now" ZNOW CMAKE_EXE_LINKER_FLAGS
199+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
200+
add_link_option_ext("-Wl,-z,nodlopen" ZDLOPEN CMAKE_EXE_LINKER_FLAGS
201+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
202+
endif()
72203
endif()
73204
endmacro()
74205

75-
if ( EXTRA_SECURITY_FLAGS )
76-
if (EXTRA_SECURITY_FLAGS STREQUAL "none")
206+
if(EXTRA_SECURITY_FLAGS)
207+
if(EXTRA_SECURITY_FLAGS STREQUAL "none")
77208
# No actions.
78-
elseif (EXTRA_SECURITY_FLAGS STREQUAL "default")
79-
append_common_extra_security_flags()
80-
elseif (EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
81-
append_common_extra_security_flags()
82-
if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
83-
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
84-
add_link_option_ext("-fsanitize=cfi" FSANITIZE_CFI_LINK
85-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
86-
CMAKE_SHARED_LINKER_FLAGS)
87-
# Recommended option although linking a DSO with SafeStack is not currently supported by compiler.
88-
#add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
89-
#add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
90-
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
91-
# CMAKE_SHARED_LINKER_FLAGS)
92-
else()
93-
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
94-
# need to align compile and link option set, link now is set unconditionally
95-
add_link_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION_LINK
96-
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
97-
CMAKE_SHARED_LINKER_FLAGS)
98-
endif()
209+
elseif(EXTRA_SECURITY_FLAGS STREQUAL "default")
210+
append_common_extra_security_flags()
211+
elseif(EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
212+
append_common_extra_security_flags()
213+
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
214+
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
215+
add_link_option_ext(
216+
"-fsanitize=cfi" FSANITIZE_CFI_LINK CMAKE_EXE_LINKER_FLAGS
217+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
218+
# Recommended option although linking a DSO with SafeStack is not
219+
# currently supported by compiler.
220+
# add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
221+
# add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
222+
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
223+
# CMAKE_SHARED_LINKER_FLAGS)
99224
else()
100-
message(FATAL_ERROR "Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
225+
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
226+
# need to align compile and link option set, link now is set
227+
# unconditionally
228+
add_link_option_ext(
229+
"-fcf-protection=full -mcet" FCF_PROTECTION_LINK CMAKE_EXE_LINKER_FLAGS
230+
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
101231
endif()
232+
else()
233+
message(
234+
FATAL_ERROR
235+
"Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
236+
endif()
102237
endif()
103-

0 commit comments

Comments
 (0)