diff options
| author | Craig Lorentzen <crlorentzen@gmail.com> | 2024-04-01 17:49:44 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-05-06 10:56:17 +0200 |
| commit | 1c4f9684696bad3a602b388a414f2051f0365b3d (patch) | |
| tree | 3422accfd093e9c8134df4c6fb3ec2bb798f7775 | |
| parent | Fix undefined behaviour in the event of a zero length session id (diff) | |
| download | openssl-1c4f9684696bad3a602b388a414f2051f0365b3d.tar.xz openssl-1c4f9684696bad3a602b388a414f2051f0365b3d.zip | |
Security hardening: Expose Build flags for Position Independed Execution (PIE)
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22596)
| -rw-r--r-- | .github/workflows/run-checker-merge.yml | 1 | ||||
| -rw-r--r-- | CHANGES.md | 7 | ||||
| -rw-r--r-- | Configurations/00-base-templates.conf | 16 | ||||
| -rwxr-xr-x | Configure | 6 | ||||
| -rw-r--r-- | INSTALL.md | 4 |
5 files changed, 34 insertions, 0 deletions
diff --git a/.github/workflows/run-checker-merge.yml b/.github/workflows/run-checker-merge.yml index e5746d75bd..8a1da0c2f2 100644 --- a/.github/workflows/run-checker-merge.yml +++ b/.github/workflows/run-checker-merge.yml @@ -35,6 +35,7 @@ jobs: no-ts, enable-weak-ssl-ciphers, enable-zlib, + enable-pie, ] runs-on: ubuntu-latest steps: diff --git a/CHANGES.md b/CHANGES.md index 21fd185444..1258a44b52 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -59,6 +59,13 @@ OpenSSL 3.4 *Damian Hobson-Garcia* + * Added support to build Position Independent Executables (PIE). Configuration + option `enable-pie` configures the cflag '-fPIE' and ldflag '-pie' to + support Address Space Layout Randomization (ASLR) in the openssl executable, + removes reliance on external toolchain configurations. + + *Craig Lorentzen* + OpenSSL 3.3 ----------- diff --git a/Configurations/00-base-templates.conf b/Configurations/00-base-templates.conf index 55da5ec56c..a9ccb0ced8 100644 --- a/Configurations/00-base-templates.conf +++ b/Configurations/00-base-templates.conf @@ -76,6 +76,22 @@ my %targets=( AR => "ar", ARFLAGS => "qc", CC => "cc", + bin_cflags => + sub { + my @flags = (); + if (!defined($disabled{pie})) { + push(@flags, "-fPIE"); + } + return join(" ", @flags); + }, + bin_lflags => + sub { + my @flags = (); + if (!defined($disabled{pie})) { + push(@flags, "-pie"); + } + return join(" ", @flags); + }, lflags => sub { my @libs = (); @@ -492,6 +492,7 @@ my @disablables = ( "ocsp", "padlockeng", "pic", + "pie", "pinshared", "poly1305", "posix-io", @@ -584,6 +585,7 @@ our %disabled = ( # "what" => "comment" "external-tests" => "default", "fuzz-afl" => "default", "fuzz-libfuzzer" => "default", + "pie" => "default", "ktls" => "default", "md2" => "default", "msan" => "default", @@ -943,6 +945,10 @@ while (@argvcopy) { delete $disabled{"brotli"}; } + elsif ($1 eq "pie") + { + delete $disabled{"pie"}; + } elsif ($1 eq "zstd-dynamic") { delete $disabled{"zstd"}; diff --git a/INSTALL.md b/INSTALL.md index b486ee1556..a34de9bbf8 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -870,6 +870,10 @@ As synonym for `no-padlockeng`. Deprecated and should not be used. Don't build with support for Position Independent Code. +### enable-pie + +Build with support for Position Independent Execution. + ### no-pinshared Don't pin the shared libraries. |