mirror of
https://github.com/dashpay/dash.git
synced 2024-12-26 12:32:48 +01:00
bd7b5a3ad4
8334ee31f868f0f9baf0920d14d20174ed889dbe scripts: add MACHO LAZY_BINDINGS test to test-security-check.py (fanquake) 7b99c7454cdb74cd9cd7a5eedc2fb9d0a19df456 scripts: add MACHO Canary check to security-check.py (fanquake) Pull request description: 7b99c7454cdb74cd9cd7a5eedc2fb9d0a19df456 uses `otool -Iv` to check for `___stack_chk_fail` in the macOS binaries. Similar to the [ELF check](https://github.com/bitcoin/bitcoin/blob/master/contrib/devtools/security-check.py#L105). Note that looking for a triple underscore prefixed function (as opposed to two for ELF) is correct for the macOS binaries. i.e: ```bash otool -Iv bitcoind | grep chk 0x00000001006715b8 509 ___memcpy_chk 0x00000001006715be 510 ___snprintf_chk 0x00000001006715c4 511 ___sprintf_chk 0x00000001006715ca 512 ___stack_chk_fail 0x00000001006715d6 517 ___vsnprintf_chk 0x0000000100787898 513 ___stack_chk_guard ``` 8334ee31f868f0f9baf0920d14d20174ed889dbe is a follow up to #18295 and adds test cases to `test-security-check.py` that for some reason I didn't add at the time. I'll sort out #18434 so that we can run these tests in the CI. ACKs for top commit: practicalswift: ACK 8334ee31f868f0f9baf0920d14d20174ed889dbe: Mitigations are important. Important things are worth asserting :) jonasschnelli: utACK 8334ee31f868f0f9baf0920d14d20174ed889dbe. Tree-SHA512: 1aa5ded34bbd187eddb112b27278deb328bfc21ac82316b20fab6ad894f223b239a76b53dab0ac1770d194c1760fcc40d4da91ec09959ba4fc8eadedb173936a
300 lines
11 KiB
Python
Executable File
300 lines
11 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
# Copyright (c) 2015-2016 The Bitcoin Core developers
|
|
# Distributed under the MIT software license, see the accompanying
|
|
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
'''
|
|
Perform basic security checks on a series of executables.
|
|
Exit status will be 0 if successful, and the program will be silent.
|
|
Otherwise the exit status will be 1 and it will log which executables failed which checks.
|
|
Needs `readelf` (for ELF), `objdump` (for PE) and `otool` (for MACHO).
|
|
'''
|
|
import subprocess
|
|
import sys
|
|
import os
|
|
|
|
READELF_CMD = os.getenv('READELF', '/usr/bin/readelf')
|
|
OBJDUMP_CMD = os.getenv('OBJDUMP', '/usr/bin/objdump')
|
|
OTOOL_CMD = os.getenv('OTOOL', '/usr/bin/otool')
|
|
NONFATAL = {} # checks which are non-fatal for now but only generate a warning
|
|
|
|
def check_ELF_PIE(executable):
|
|
'''
|
|
Check for position independent executable (PIE), allowing for address space randomization.
|
|
'''
|
|
p = subprocess.Popen([READELF_CMD, '-h', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
|
|
ok = False
|
|
for line in stdout.splitlines():
|
|
line = line.split()
|
|
if len(line)>=2 and line[0] == 'Type:' and line[1] == 'DYN':
|
|
ok = True
|
|
return ok
|
|
|
|
def get_ELF_program_headers(executable):
|
|
'''Return type and flags for ELF program headers'''
|
|
p = subprocess.Popen([READELF_CMD, '-l', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
in_headers = False
|
|
count = 0
|
|
headers = []
|
|
for line in stdout.splitlines():
|
|
if line.startswith('Program Headers:'):
|
|
in_headers = True
|
|
if line == '':
|
|
in_headers = False
|
|
if in_headers:
|
|
if count == 1: # header line
|
|
ofs_typ = line.find('Type')
|
|
ofs_offset = line.find('Offset')
|
|
ofs_flags = line.find('Flg')
|
|
ofs_align = line.find('Align')
|
|
if ofs_typ == -1 or ofs_offset == -1 or ofs_flags == -1 or ofs_align == -1:
|
|
raise ValueError('Cannot parse elfread -lW output')
|
|
elif count > 1:
|
|
typ = line[ofs_typ:ofs_offset].rstrip()
|
|
flags = line[ofs_flags:ofs_align].rstrip()
|
|
headers.append((typ, flags))
|
|
count += 1
|
|
return headers
|
|
|
|
def check_ELF_NX(executable):
|
|
'''
|
|
Check that no sections are writable and executable (including the stack)
|
|
'''
|
|
have_wx = False
|
|
have_gnu_stack = False
|
|
for (typ, flags) in get_ELF_program_headers(executable):
|
|
if typ == 'GNU_STACK':
|
|
have_gnu_stack = True
|
|
if 'W' in flags and 'E' in flags: # section is both writable and executable
|
|
have_wx = True
|
|
return have_gnu_stack and not have_wx
|
|
|
|
def check_ELF_RELRO(executable):
|
|
'''
|
|
Check for read-only relocations.
|
|
GNU_RELRO program header must exist
|
|
Dynamic section must have BIND_NOW flag
|
|
'''
|
|
have_gnu_relro = False
|
|
for (typ, flags) in get_ELF_program_headers(executable):
|
|
# Note: not checking flags == 'R': here as linkers set the permission differently
|
|
# This does not affect security: the permission flags of the GNU_RELRO program header are ignored, the PT_LOAD header determines the effective permissions.
|
|
# However, the dynamic linker need to write to this area so these are RW.
|
|
# Glibc itself takes care of mprotecting this area R after relocations are finished.
|
|
# See also https://marc.info/?l=binutils&m=1498883354122353
|
|
if typ == 'GNU_RELRO':
|
|
have_gnu_relro = True
|
|
|
|
have_bindnow = False
|
|
p = subprocess.Popen([READELF_CMD, '-d', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
for line in stdout.splitlines():
|
|
tokens = line.split()
|
|
if len(tokens)>1 and tokens[1] == '(BIND_NOW)' or (len(tokens)>2 and tokens[1] == '(FLAGS)' and 'BIND_NOW' in tokens[2:]):
|
|
have_bindnow = True
|
|
return have_gnu_relro and have_bindnow
|
|
|
|
def check_ELF_Canary(executable):
|
|
'''
|
|
Check for use of stack canary
|
|
'''
|
|
p = subprocess.Popen([READELF_CMD, '--dyn-syms', '-W', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
ok = False
|
|
for line in stdout.splitlines():
|
|
if '__stack_chk_fail' in line:
|
|
ok = True
|
|
return ok
|
|
|
|
def get_PE_dll_characteristics(executable):
|
|
'''
|
|
Get PE DllCharacteristics bits.
|
|
Returns a tuple (arch,bits) where arch is 'i386:x86-64' or 'i386'
|
|
and bits is the DllCharacteristics value.
|
|
'''
|
|
p = subprocess.Popen([OBJDUMP_CMD, '-x', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
arch = ''
|
|
bits = 0
|
|
for line in stdout.splitlines():
|
|
tokens = line.split()
|
|
if len(tokens)>=2 and tokens[0] == 'architecture:':
|
|
arch = tokens[1].rstrip(',')
|
|
if len(tokens)>=2 and tokens[0] == 'DllCharacteristics':
|
|
bits = int(tokens[1],16)
|
|
return (arch,bits)
|
|
|
|
IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020
|
|
IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040
|
|
IMAGE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100
|
|
|
|
def check_PE_DYNAMIC_BASE(executable):
|
|
'''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)'''
|
|
(arch,bits) = get_PE_dll_characteristics(executable)
|
|
reqbits = IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE
|
|
return (bits & reqbits) == reqbits
|
|
|
|
# On 64 bit, must support high-entropy 64-bit address space layout randomization in addition to DYNAMIC_BASE
|
|
# to have secure ASLR.
|
|
def check_PE_HIGH_ENTROPY_VA(executable):
|
|
'''PIE: DllCharacteristics bit 0x20 signifies high-entropy ASLR'''
|
|
(arch,bits) = get_PE_dll_characteristics(executable)
|
|
if arch == 'i386:x86-64':
|
|
reqbits = IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA
|
|
else: # Unnecessary on 32-bit
|
|
assert(arch == 'i386')
|
|
reqbits = 0
|
|
return (bits & reqbits) == reqbits
|
|
|
|
def check_PE_NX(executable):
|
|
'''NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP)'''
|
|
(arch,bits) = get_PE_dll_characteristics(executable)
|
|
return (bits & IMAGE_DLL_CHARACTERISTICS_NX_COMPAT) == IMAGE_DLL_CHARACTERISTICS_NX_COMPAT
|
|
|
|
def get_MACHO_executable_flags(executable):
|
|
p = subprocess.Popen([OTOOL_CMD, '-vh', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
|
|
flags = []
|
|
for line in stdout.splitlines():
|
|
tokens = line.split()
|
|
# filter first two header lines
|
|
if 'magic' in tokens or 'Mach' in tokens:
|
|
continue
|
|
# filter ncmds and sizeofcmds values
|
|
flags += [t for t in tokens if not t.isdigit()]
|
|
return flags
|
|
|
|
def check_MACHO_PIE(executable) -> bool:
|
|
'''
|
|
Check for position independent executable (PIE), allowing for address space randomization.
|
|
'''
|
|
flags = get_MACHO_executable_flags(executable)
|
|
if 'PIE' in flags:
|
|
return True
|
|
return False
|
|
|
|
def check_MACHO_NOUNDEFS(executable) -> bool:
|
|
'''
|
|
Check for no undefined references.
|
|
'''
|
|
flags = get_MACHO_executable_flags(executable)
|
|
if 'NOUNDEFS' in flags:
|
|
return True
|
|
return False
|
|
|
|
def check_MACHO_NX(executable) -> bool:
|
|
'''
|
|
Check for no stack execution
|
|
'''
|
|
flags = get_MACHO_executable_flags(executable)
|
|
if 'ALLOW_STACK_EXECUTION' in flags:
|
|
return False
|
|
return True
|
|
|
|
def check_MACHO_LAZY_BINDINGS(executable) -> bool:
|
|
'''
|
|
Check for no lazy bindings.
|
|
We don't use or check for MH_BINDATLOAD. See #18295.
|
|
'''
|
|
p = subprocess.Popen([OTOOL_CMD, '-l', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
|
|
for line in stdout.splitlines():
|
|
tokens = line.split()
|
|
if 'lazy_bind_off' in tokens or 'lazy_bind_size' in tokens:
|
|
if tokens[1] != '0':
|
|
return False
|
|
return True
|
|
|
|
def check_MACHO_Canary(executable) -> bool:
|
|
'''
|
|
Check for use of stack canary
|
|
'''
|
|
p = subprocess.Popen([OTOOL_CMD, '-Iv', executable], stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE, universal_newlines=True)
|
|
(stdout, stderr) = p.communicate()
|
|
if p.returncode:
|
|
raise IOError('Error opening file')
|
|
ok = False
|
|
for line in stdout.splitlines():
|
|
if '___stack_chk_fail' in line:
|
|
ok = True
|
|
return ok
|
|
|
|
CHECKS = {
|
|
'ELF': [
|
|
('PIE', check_ELF_PIE),
|
|
('NX', check_ELF_NX),
|
|
('RELRO', check_ELF_RELRO),
|
|
('Canary', check_ELF_Canary)
|
|
],
|
|
'PE': [
|
|
('DYNAMIC_BASE', check_PE_DYNAMIC_BASE),
|
|
('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA),
|
|
('NX', check_PE_NX)
|
|
],
|
|
'MACHO': [
|
|
('PIE', check_MACHO_PIE),
|
|
('NOUNDEFS', check_MACHO_NOUNDEFS),
|
|
('NX', check_MACHO_NX),
|
|
('LAZY_BINDINGS', check_MACHO_LAZY_BINDINGS),
|
|
('Canary', check_MACHO_Canary)
|
|
]
|
|
}
|
|
|
|
def identify_executable(executable):
|
|
with open(filename, 'rb') as f:
|
|
magic = f.read(4)
|
|
if magic.startswith(b'MZ'):
|
|
return 'PE'
|
|
elif magic.startswith(b'\x7fELF'):
|
|
return 'ELF'
|
|
elif magic.startswith(b'\xcf\xfa'):
|
|
return 'MACHO'
|
|
return None
|
|
|
|
if __name__ == '__main__':
|
|
retval = 0
|
|
for filename in sys.argv[1:]:
|
|
try:
|
|
etype = identify_executable(filename)
|
|
if etype is None:
|
|
print('%s: unknown format' % filename)
|
|
retval = 1
|
|
continue
|
|
|
|
failed = []
|
|
warning = []
|
|
for (name, func) in CHECKS[etype]:
|
|
if not func(filename):
|
|
if name in NONFATAL:
|
|
warning.append(name)
|
|
else:
|
|
failed.append(name)
|
|
if failed:
|
|
print('%s: failed %s' % (filename, ' '.join(failed)))
|
|
retval = 1
|
|
if warning:
|
|
print('%s: warning %s' % (filename, ' '.join(warning)))
|
|
except IOError:
|
|
print('%s: cannot open' % filename)
|
|
retval = 1
|
|
sys.exit(retval)
|
|
|