[ruby-core:90000] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[ruby-core:90000] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[v.ondruch]

Issue #15335 has been reported by vo.x (Vit Ondruch).

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335

* Author: vo.x (Vit Ondruch)
* Status: Open
* Priority: Normal
* Assignee: 
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90026] [Ruby trunk Bug#15335][Assigned] Ruby 2.6.0 is not properly fortified

[mame]

Issue #15335 has been updated by mame (Yusuke Endoh).

Status changed from Open to Assigned
Assignee set to ioquatix (Samuel Williams)

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75131

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90027] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[samuel]

Issue #15335 has been updated by ioquatix (Samuel Williams).


How can we solve this problem?

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75132

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90028] Re: [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[Eric Wong]

> https://bugs.ruby-lang.org/issues/15335#change-75132

samuel@oriontransfer.net wrote:
> How can we solve this problem?

Fedora can configure with --disable-fiber-coroutine option
as a stopgap...

> I.e. the coroutines assembly. Not sure how to prove it nor fix it.

Maybe this can help?
https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart

[ruby-core:90032] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[samuel]

Issue #15335 has been updated by ioquatix (Samuel Williams).


Thanks Eric. Those two suggestions are really helpful. I'll investigate it now.

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75139

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90033] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[samuel]

Issue #15335 has been updated by ioquatix (Samuel Williams).


I'm attempting to fix this issue here: https://github.com/ruby/ruby/pull/2027

@vo.x do you mind trying to build that PR?

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75140

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90034] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[samuel]

Issue #15335 has been updated by ioquatix (Samuel Williams).


I've merged the first set of changes into trunk, for amd64 - @vo.x if you confirm this has fixed the issue I will extend to other architectures.

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75141

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90039] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[v.ondruch]

Issue #15335 has been updated by vo.x (Vit Ondruch).


Thx. I hope I'll be able to check it on Monday.

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75148

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90074] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[v.ondruch]

Issue #15335 has been updated by vo.x (Vit Ondruch).


Testing with r65990 on x86_64 and the test passed. I guess I should not try to build on other arches yet, right?

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75198

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90168] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[v.ondruch]

Issue #15335 has been updated by vo.x (Vit Ondruch).


Just FTR trying to build r66092 on Fedora Rawhide [1], x86_64, ppc64le, aarch64, s390x, and armv7hl were properly fortified while only i686 failed to pass [2] the fortification test.


[1]: https://koji.fedoraproject.org/koji/taskinfo?taskID=31176576
[2]: https://kojipkgs.fedoraproject.org//work/tasks/6595/31176595/build.log

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75287

* Author: vo.x (Vit Ondruch)
* Status: Assigned
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90430] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[samuel]

Issue #15335 has been updated by ioquatix (Samuel Williams).


@vo.x I'm so sorry but I edit your last post rather than creating new one. Now it's changed, I can't revert it back. :(

I've fixed x86 implementation too, now that it was confirmed the previous effort to fix x64 worked as expected. This issue should be completely resolved now (dc6908ab44c3a3fc78319422410b57d3b7fb6c0c / r66341).

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-75584

* Author: vo.x (Vit Ondruch)
* Status: Closed
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/

[ruby-core:90889] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified

[v.ondruch]

Issue #15335 has been updated by vo.x (Vit Ondruch).


ioquatix (Samuel Williams) wrote:
> I've fixed x86 implementation too.

Thx, I can build Ruby 2.6.0 on all platforms just fine.

----------------------------------------
Bug #15335: Ruby 2.6.0 is not properly fortified
https://bugs.ruby-lang.org/issues/15335#change-76077

* Author: vo.x (Vit Ondruch)
* Status: Closed
* Priority: Normal
* Assignee: ioquatix (Samuel Williams)
* Target version: 
* ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux]
* Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN
----------------------------------------
For some while, we carry this test in Fedora package [1]:

~~~
checksec -f libruby.so.%{ruby_version} | \	
  grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}"
~~~

This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928:

~~~
$ checksec -f libruby.so.2.6.0
WARNING: 'openssl' not found! It's required for most checks.

WARNING: Not all necessary commands found. Some tests might not work!

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	FORTIFY	Fortified Fortifiable  FILE
Full RELRO      Canary found      NX disabled   DSO             No RPATH   No RUNPATH   Yes	16		42	libruby.so.2.6.0
~~~

The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it:

~~~
... snip ...

assembling coroutine/amd64/Context.s
gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s

... snip ...

gcc -shared -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong  -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o  prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm  
  -o libruby.so.2.6.0

... snip ...
~~~

I.e. the coroutines assembly. Not sure how to prove it nor fix it.



[1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735
[2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test



-- 
https://bugs.ruby-lang.org/