maxmustermann/dogecoin
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge #18796: scripts: security-check.py refactors

Browse source 
eacedfb023 scripts: add additional type annotations to security-check.py (fanquake)
83d063e954 scripts: add run_command to security-check.py (fanquake)
13f606b4f9 scripts: remove NONFATAL from security-check.py (fanquake)
061acf62a1 scripts: no-longer check for 32 bit windows in security-check.py (fanquake)

Pull request description:

  * Remove 32-bit Windows checks.
  * Remove NONFATAL checking. Added in #8249, however unused since #13764.
  * Add `run_command` to de-duplicate all of the subprocess calls. Mentioned in #18713.
  * Add additional type annotations.
  * Print stderr when there is an issue running a command.

ACKs for top commit:
  laanwj:
    ACK eacedfb023

Tree-SHA512: 69a7ccfdf346ee202b3e8f940634c5daed1d2b5a5d15ac9800252866ba3284ec66e391a66a0b341f5a4e5e8482fe1b614d4671e8e766112ff059405081184a85
This commit is contained in:
Wladimir J. van der Laan 2020-05-14 19:59:54 +02:00
parent 4dd2e5255a eacedfb023
commit 2d7489be8f
No known key found for this signature in database
GPG key ID: 1E4AED62986CD25D
1 changed files with 45 additions and 79 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

124
contrib/devtools/security-check.py
View file

@ -12,33 +12,33 @@ import subprocess
import sys import sys
import os import os
from typing import List, Optional
READELF_CMD = os.getenv('READELF', '/usr/bin/readelf') READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
OBJDUMP_CMD = os.getenv('OBJDUMP', '/usr/bin/objdump') OBJDUMP_CMD = os.getenv('OBJDUMP', '/usr/bin/objdump')
OTOOL_CMD = os.getenv('OTOOL', '/usr/bin/otool') OTOOL_CMD = os.getenv('OTOOL', '/usr/bin/otool')
NONFATAL = {} # checks which are non-fatal for now but only generate a warning
def check_ELF_PIE(executable): def run_command(command) -> str:
p = subprocess.run(command, stdout=subprocess.PIPE, check=True, universal_newlines=True)
return p.stdout
def check_ELF_PIE(executable) -> bool:
''' '''
Check for position independent executable (PIE), allowing for address space randomization. Check for position independent executable (PIE), allowing for address space randomization.
''' '''
p = subprocess.Popen([READELF_CMD, '-h', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([READELF_CMD, '-h', '-W', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
ok = False ok = False
for line in stdout.splitlines(): for line in stdout.splitlines():
line = line.split() tokens = line.split()
if len(line)>=2 and line[0] == 'Type:' and line[1] == 'DYN': if len(line)>=2 and tokens[0] == 'Type:' and tokens[1] == 'DYN':
ok = True ok = True
return ok return ok
def get_ELF_program_headers(executable): def get_ELF_program_headers(executable):
'''Return type and flags for ELF program headers''' '''Return type and flags for ELF program headers'''
p = subprocess.Popen([READELF_CMD, '-l', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([READELF_CMD, '-l', '-W', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
in_headers = False in_headers = False
count = 0 count = 0
headers = [] headers = []
@ -62,7 +62,7 @@ def get_ELF_program_headers(executable):
count += 1 count += 1
return headers return headers
def check_ELF_NX(executable): def check_ELF_NX(executable) -> bool:
''' '''
Check that no sections are writable and executable (including the stack) Check that no sections are writable and executable (including the stack)
''' '''
@ -75,7 +75,7 @@ def check_ELF_NX(executable):
have_wx = True have_wx = True
return have_gnu_stack and not have_wx return have_gnu_stack and not have_wx
def check_ELF_RELRO(executable): def check_ELF_RELRO(executable) -> bool:
''' '''
Check for read-only relocations. Check for read-only relocations.
GNU_RELRO program header must exist GNU_RELRO program header must exist
@ -84,7 +84,8 @@ def check_ELF_RELRO(executable):
have_gnu_relro = False have_gnu_relro = False
for (typ, flags) in get_ELF_program_headers(executable): for (typ, flags) in get_ELF_program_headers(executable):
# Note: not checking flags == 'R': here as linkers set the permission differently # Note: not checking flags == 'R': here as linkers set the permission differently
# This does not affect security: the permission flags of the GNU_RELRO program header are ignored, the PT_LOAD header determines the effective permissions. # This does not affect security: the permission flags of the GNU_RELRO program
# header are ignored, the PT_LOAD header determines the effective permissions.
# However, the dynamic linker need to write to this area so these are RW. # However, the dynamic linker need to write to this area so these are RW.
# Glibc itself takes care of mprotecting this area R after relocations are finished. # Glibc itself takes care of mprotecting this area R after relocations are finished.
# See also https://marc.info/?l=binutils&m=1498883354122353 # See also https://marc.info/?l=binutils&m=1498883354122353
@ -92,93 +93,69 @@ def check_ELF_RELRO(executable):
have_gnu_relro = True have_gnu_relro = True
have_bindnow = False have_bindnow = False
p = subprocess.Popen([READELF_CMD, '-d', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([READELF_CMD, '-d', '-W', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
for line in stdout.splitlines(): for line in stdout.splitlines():
tokens = line.split() tokens = line.split()
if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2:]): if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2:]):
have_bindnow = True have_bindnow = True
return have_gnu_relro and have_bindnow return have_gnu_relro and have_bindnow
def check_ELF_Canary(executable): def check_ELF_Canary(executable) -> bool:
''' '''
Check for use of stack canary Check for use of stack canary
''' '''
p = subprocess.Popen([READELF_CMD, '--dyn-syms', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([READELF_CMD, '--dyn-syms', '-W', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
ok = False ok = False
for line in stdout.splitlines(): for line in stdout.splitlines():
if '__stack_chk_fail' in line: if '__stack_chk_fail' in line:
ok = True ok = True
return ok return ok
def get_PE_dll_characteristics(executable): def get_PE_dll_characteristics(executable) -> int:
''' '''Get PE DllCharacteristics bits'''
Get PE DllCharacteristics bits. stdout = run_command([OBJDUMP_CMD, '-x', executable])
Returns a tuple (arch,bits) where arch is 'i386:x86-64' or 'i386'
and bits is the DllCharacteristics value.
'''
p = subprocess.Popen([OBJDUMP_CMD, '-x', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
arch = ''
bits = 0 bits = 0
for line in stdout.splitlines(): for line in stdout.splitlines():
tokens = line.split() tokens = line.split()
if len(tokens)>=2 and tokens[0] == 'architecture:':
arch = tokens[1].rstrip(',')
if len(tokens)>=2 and tokens[0] == 'DllCharacteristics': if len(tokens)>=2 and tokens[0] == 'DllCharacteristics':
bits = int(tokens[1],16) bits = int(tokens[1],16)
return (arch,bits) return bits
IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020 IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020
IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040 IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040
IMAGE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100 IMAGE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100
def check_PE_DYNAMIC_BASE(executable): def check_PE_DYNAMIC_BASE(executable) -> bool:
'''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)''' '''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)'''
(arch,bits) = get_PE_dll_characteristics(executable) bits = get_PE_dll_characteristics(executable)
reqbits = IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE return (bits & IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE) == IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE
return (bits & reqbits) == reqbits
# On 64 bit, must support high-entropy 64-bit address space layout randomization in addition to DYNAMIC_BASE # Must support high-entropy 64-bit address space layout randomization
# to have secure ASLR. # in addition to DYNAMIC_BASE to have secure ASLR.
def check_PE_HIGH_ENTROPY_VA(executable): def check_PE_HIGH_ENTROPY_VA(executable) -> bool:
'''PIE: DllCharacteristics bit 0x20 signifies high-entropy ASLR''' '''PIE: DllCharacteristics bit 0x20 signifies high-entropy ASLR'''
(arch,bits) = get_PE_dll_characteristics(executable) bits = get_PE_dll_characteristics(executable)
if arch == 'i386:x86-64': return (bits & IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA) == IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA
reqbits = IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA
else: # Unnecessary on 32-bit
assert(arch == 'i386')
reqbits = 0
return (bits & reqbits) == reqbits
def check_PE_RELOC_SECTION(executable) -> bool: def check_PE_RELOC_SECTION(executable) -> bool:
'''Check for a reloc section. This is required for functional ASLR.''' '''Check for a reloc section. This is required for functional ASLR.'''
p = subprocess.Popen([OBJDUMP_CMD, '-h', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([OBJDUMP_CMD, '-h', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
for line in stdout.splitlines(): for line in stdout.splitlines():
if '.reloc' in line: if '.reloc' in line:
return True return True
return False return False
def check_PE_NX(executable): def check_PE_NX(executable) -> bool:
'''NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP)''' '''NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP)'''
(arch,bits) = get_PE_dll_characteristics(executable) bits = get_PE_dll_characteristics(executable)
return (bits & IMAGE_DLL_CHARACTERISTICS_NX_COMPAT) == IMAGE_DLL_CHARACTERISTICS_NX_COMPAT return (bits & IMAGE_DLL_CHARACTERISTICS_NX_COMPAT) == IMAGE_DLL_CHARACTERISTICS_NX_COMPAT
def get_MACHO_executable_flags(executable): def get_MACHO_executable_flags(executable) -> List[str]:
p = subprocess.Popen([OTOOL_CMD, '-vh', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([OTOOL_CMD, '-vh', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
flags = [] flags = []
for line in stdout.splitlines(): for line in stdout.splitlines():
@ -222,10 +199,7 @@ def check_MACHO_LAZY_BINDINGS(executable) -> bool:
Check for no lazy bindings. Check for no lazy bindings.
We don't use or check for MH_BINDATLOAD. See #18295. We don't use or check for MH_BINDATLOAD. See #18295.
''' '''
p = subprocess.Popen([OTOOL_CMD, '-l', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([OTOOL_CMD, '-l', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
for line in stdout.splitlines(): for line in stdout.splitlines():
tokens = line.split() tokens = line.split()
@ -238,10 +212,8 @@ def check_MACHO_Canary(executable) -> bool:
''' '''
Check for use of stack canary Check for use of stack canary
''' '''
p = subprocess.Popen([OTOOL_CMD, '-Iv', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True) stdout = run_command([OTOOL_CMD, '-Iv', executable])
(stdout, stderr) = p.communicate()
if p.returncode:
raise IOError('Error opening file')
ok = False ok = False
for line in stdout.splitlines(): for line in stdout.splitlines():
if '___stack_chk_fail' in line: if '___stack_chk_fail' in line:
@ -270,7 +242,7 @@ CHECKS = {
] ]
} }
def identify_executable(executable): def identify_executable(executable) -> Optional[str]:
with open(filename, 'rb') as f: with open(filename, 'rb') as f:
magic = f.read(4) magic = f.read(4)
if magic.startswith(b'MZ'): if magic.startswith(b'MZ'):
@ -292,18 +264,12 @@ if __name__ == '__main__':
continue continue
failed = [] failed = []
warning = []
for (name, func) in CHECKS[etype]: for (name, func) in CHECKS[etype]:
if not func(filename): if not func(filename):
if name in NONFATAL: failed.append(name)
warning.append(name)
else:
failed.append(name)
if failed: if failed:
print('%s: failed %s' % (filename, ' '.join(failed))) print('%s: failed %s' % (filename, ' '.join(failed)))
retval = 1 retval = 1
if warning:
print('%s: warning %s' % (filename, ' '.join(warning)))
except IOError: except IOError:
print('%s: cannot open' % filename) print('%s: cannot open' % filename)
retval = 1 retval = 1