From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS4713 221.184.0.0/13 X-Spam-Status: No, score=-2.8 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_PASS,URIBL_SBL,URIBL_SBL_A shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from neon.ruby-lang.org (neon.ruby-lang.org [221.186.184.75]) by dcvr.yhbt.net (Postfix) with ESMTP id 4AAF920A1E for ; Wed, 12 Dec 2018 00:00:28 +0000 (UTC) Received: from neon.ruby-lang.org (localhost [IPv6:::1]) by neon.ruby-lang.org (Postfix) with ESMTP id 582C312154C; Wed, 12 Dec 2018 09:00:26 +0900 (JST) Received: from o1678948x4.outbound-mail.sendgrid.net (o1678948x4.outbound-mail.sendgrid.net [167.89.48.4]) by neon.ruby-lang.org (Postfix) with ESMTPS id 03C56121547 for ; Wed, 12 Dec 2018 09:00:24 +0900 (JST) Received: by filter0120p3las1.sendgrid.net with SMTP id filter0120p3las1-9477-5C104F96-3C 2018-12-12 00:00:22.713024463 +0000 UTC m=+93861.825952523 Received: from herokuapp.com (ec2-54-196-137-133.compute-1.amazonaws.com [54.196.137.133]) by ismtpd0010p1iad1.sendgrid.net (SG) with ESMTP id ix1YUYr8SNeJpH_KjCea1w Wed, 12 Dec 2018 00:00:22.575 +0000 (UTC) Date: Wed, 12 Dec 2018 00:00:23 +0000 (UTC) From: samuel@oriontransfer.net To: ruby-core@ruby-lang.org Message-ID: References: Mime-Version: 1.0 X-Redmine-MailingListIntegration-Message-Ids: 65835 X-Redmine-Project: ruby-trunk X-Redmine-Issue-Id: 15335 X-Redmine-Issue-Author: vo.x X-Redmine-Issue-Assignee: ioquatix X-Redmine-Sender: ioquatix X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-SG-EID: ync6xU2WACa70kv/Ymy4QrNMhiuLXJG8OTL2vJD1yS6qjAYCRKn83E5Q/2xn1uFw8/i51x34Yc3SbK iYB9USDC3XbH2zUH8tJvLrqAKiumnPlBKraFGPWZ351SwFZqWeLdGeEgJ2+JsI6kE8rF8+qF23k4Cv d2+czyI4y9qnIQZVUGU1gh1qHQmxP/mcBKIkf0RDHWw/kVJA6cTkw2FQUg== X-ML-Name: ruby-core X-Mail-Count: 90430 Subject: [ruby-core:90430] [Ruby trunk Bug#15335] Ruby 2.6.0 is not properly fortified X-BeenThere: ruby-core@ruby-lang.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Ruby developers List-Id: Ruby developers List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ruby-core-bounces@ruby-lang.org Sender: "ruby-core" Issue #15335 has been updated by ioquatix (Samuel Williams). @vo.x I'm so sorry but I edit your last post rather than creating new one. Now it's changed, I can't revert it back. :( I've fixed x86 implementation too, now that it was confirmed the previous effort to fix x64 worked as expected. This issue should be completely resolved now (dc6908ab44c3a3fc78319422410b57d3b7fb6c0c / r66341). ---------------------------------------- Bug #15335: Ruby 2.6.0 is not properly fortified https://bugs.ruby-lang.org/issues/15335#change-75584 * Author: vo.x (Vit Ondruch) * Status: Closed * Priority: Normal * Assignee: ioquatix (Samuel Williams) * Target version: * ruby -v: ruby 2.6.0dev (2018-11-22 trunk 65928) [x86_64-linux] * Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN ---------------------------------------- For some while, we carry this test in Fedora package [1]: ~~~ checksec -f libruby.so.%{ruby_version} | \ grep "Full RELRO.*Canary found.*NX enabled.*DSO.*No RPATH.*No RUNPATH.*Yes.*\d*.*\d*.*libruby.so.%{ruby_version}" ~~~ This should ensure, that the library is properly fortified [2]. This test was passing with preview3, but it started to fail, testing with r65928: ~~~ $ checksec -f libruby.so.2.6.0 WARNING: 'openssl' not found! It's required for most checks. WARNING: Not all necessary commands found. Some tests might not work! RELRO STACK CANARY NX PIE RPATH RUNPATH FORTIFY Fortified Fortifiable FILE Full RELRO Canary found NX disabled DSO No RPATH No RUNPATH Yes 16 42 libruby.so.2.6.0 ~~~ The `NX disabled` is the difference. Looking at the log, it is definitely not about configuration options. So if I should point finger at something, it seems to me that this must be it: ~~~ ... snip ... assembling coroutine/amd64/Context.s gcc -I. -I.ext/include/x86_64-linux -I./include -I. -I./enc/unicode/10.0.0 -o coroutine/amd64/Context.o -c coroutine/amd64/Context.s ... snip ... gcc -shared -Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-soname,libruby.so.2.6 -fstack-protector-strong -m64 dln.o localeinit.o loadpath.o array.o ast.o bignum.o class.o compar.o compile.o complex.o cont.o debug.o debug_counter.o dir.o dln_find.o encoding.o enum.o enumerator.o error.o eval.o file.o gc.o hash.o inits.o io.o iseq.o load.o marshal.o math.o mjit.o mjit_compile.o node.o numeric.o object.o pack.o parse.o proc.o process.o random.o range.o rational.o re.o regcomp.o regenc.o regerror.o regexec.o regparse.o regsyntax.o ruby.o safe.o signal.o sprintf.o st.o strftime.o string.o struct.o symbol.o thread.o time.o transcode.o transient_heap.o util.o variable.o version.o vm.o vm_backtrace.o vm_dump.o vm_trace.o coroutine/amd64/Context.o probes.o enc/ascii.o enc/us_ascii.o enc/unicode.o enc/utf_8.o enc/trans/newline.o setproctitle.o strlcat.o strlcpy.o addr2line.o prelude.o dmyext.o dmyenc.o -lpthread -lrt -lrt -lgmp -ldl -lcrypt -lm -o libruby.so.2.6.0 ... snip ... ~~~ I.e. the coroutines assembly. Not sure how to prove it nor fix it. [1]: https://src.fedoraproject.org/rpms/ruby/blob/c80ecd9db905f328079a9c8afee70a34e1dcc18c/f/ruby.spec#_735 [2]: https://fedoraproject.org/wiki/Changes/Harden_All_Packages#How_To_Test -- https://bugs.ruby-lang.org/