From 7d34c19853e7a5528d69c5f30580e7e9712e61f0 Mon Sep 17 00:00:00 2001 From: David Gumberg Date: Fri, 14 Mar 2025 10:31:04 -0700 Subject: [PATCH 1/2] ci: Drop ENABLE_HARDENING=OFF from clang-tidy It's not clear why this was added in the first place, but it is not necessary currently. https://github.com/bitcoin/bitcoin/pull/32038#issuecomment-2723888193 https://github.com/bitcoin/bitcoin/pull/24753. --- ci/test/00_setup_env_native_tidy.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/ci/test/00_setup_env_native_tidy.sh b/ci/test/00_setup_env_native_tidy.sh index 5dcb76d84f3..b5277d13949 100755 --- a/ci/test/00_setup_env_native_tidy.sh +++ b/ci/test/00_setup_env_native_tidy.sh @@ -20,7 +20,6 @@ export RUN_TIDY=true export GOAL="install" export BITCOIN_CONFIG="\ -DWITH_ZMQ=ON -DBUILD_GUI=ON -DBUILD_BENCH=ON -DWITH_USDT=ON -DWITH_BDB=ON -DWARN_INCOMPATIBLE_BDB=OFF \ - -DENABLE_HARDENING=OFF \ -DCMAKE_C_COMPILER=clang-${TIDY_LLVM_V} \ -DCMAKE_CXX_COMPILER=clang++-${TIDY_LLVM_V} \ -DCMAKE_C_FLAGS_RELWITHDEBINFO='-O0 -g0' \ From ecf2046d4b5c43ddf64f62f09cd3ed70dd5caafb Mon Sep 17 00:00:00 2001 From: David Gumberg Date: Fri, 14 Mar 2025 10:35:17 -0700 Subject: [PATCH 2/2] build: Drop option for disabling hardening Building unhardened executables is not a supported use case that should be maintained and those that want unhardened executables can still override them by appending disable flags. For example: cmake -B build -DAPPEND_CPPFLAGS='-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0 -fno-stack-protector -fcf-protection=none -fno-stack-clash-protection' -DAPPEND_LDFLAGS='-Wl,-z,lazy -Wl,-z,norelro -Wl,-z,noseparate-code' --- CMakeLists.txt | 98 +++++++++++++++++++++++------------------------ CMakePresets.json | 1 - 2 files changed, 47 insertions(+), 52 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index de11a4d3e0c..1821d58b89c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -128,7 +128,6 @@ if(WITH_BDB) endif() cmake_dependent_option(BUILD_WALLET_TOOL "Build bitcoin-wallet tool." ${BUILD_TESTS} "ENABLE_WALLET" OFF) -option(ENABLE_HARDENING "Attempt to harden the resulting executables." ON) option(REDUCE_EXPORTS "Attempt to reduce exported symbols in the resulting executables." OFF) option(WERROR "Treat compiler warnings as errors." OFF) option(WITH_CCACHE "Attempt to use ccache for compiling." ON) @@ -481,63 +480,61 @@ try_append_cxx_flags("-fmacro-prefix-map=A=B" TARGET core_interface SKIP_LINK # -fstack-reuse=none for all gcc builds. (Only gcc understands this flag). try_append_cxx_flags("-fstack-reuse=none" TARGET core_interface) -if(ENABLE_HARDENING) - add_library(hardening_interface INTERFACE) - target_link_libraries(core_interface INTERFACE hardening_interface) - if(MSVC) - try_append_linker_flag("/DYNAMICBASE" TARGET hardening_interface) - try_append_linker_flag("/HIGHENTROPYVA" TARGET hardening_interface) - try_append_linker_flag("/NXCOMPAT" TARGET hardening_interface) - else() +add_library(hardening_interface INTERFACE) +target_link_libraries(core_interface INTERFACE hardening_interface) +if(MSVC) + try_append_linker_flag("/DYNAMICBASE" TARGET hardening_interface) + try_append_linker_flag("/HIGHENTROPYVA" TARGET hardening_interface) + try_append_linker_flag("/NXCOMPAT" TARGET hardening_interface) +else() - # _FORTIFY_SOURCE requires that there is some level of optimization, - # otherwise it does nothing and just creates a compiler warning. - try_append_cxx_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3" - RESULT_VAR cxx_supports_fortify_source - SOURCE "int main() { - # if !defined __OPTIMIZE__ || __OPTIMIZE__ <= 0 - #error - #endif - }" + # _FORTIFY_SOURCE requires that there is some level of optimization, + # otherwise it does nothing and just creates a compiler warning. + try_append_cxx_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3" + RESULT_VAR cxx_supports_fortify_source + SOURCE "int main() { + # if !defined __OPTIMIZE__ || __OPTIMIZE__ <= 0 + #error + #endif + }" + ) + if(cxx_supports_fortify_source) + target_compile_options(hardening_interface INTERFACE + -U_FORTIFY_SOURCE + -D_FORTIFY_SOURCE=3 ) - if(cxx_supports_fortify_source) - target_compile_options(hardening_interface INTERFACE - -U_FORTIFY_SOURCE - -D_FORTIFY_SOURCE=3 - ) - endif() - unset(cxx_supports_fortify_source) + endif() + unset(cxx_supports_fortify_source) - try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface SKIP_LINK) - try_append_cxx_flags("-fstack-protector-all" TARGET hardening_interface) - try_append_cxx_flags("-fcf-protection=full" TARGET hardening_interface) + try_append_cxx_flags("-Wstack-protector" TARGET hardening_interface SKIP_LINK) + try_append_cxx_flags("-fstack-protector-all" TARGET hardening_interface) + try_append_cxx_flags("-fcf-protection=full" TARGET hardening_interface) - if(MINGW) - # stack-clash-protection is a no-op for Windows. - # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details. - else() - try_append_cxx_flags("-fstack-clash-protection" TARGET hardening_interface) - endif() + if(MINGW) + # stack-clash-protection is a no-op for Windows. + # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details. + else() + try_append_cxx_flags("-fstack-clash-protection" TARGET hardening_interface) + endif() - if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64") - if(CMAKE_SYSTEM_NAME STREQUAL "Darwin") - try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK) - else() - try_append_cxx_flags("-mbranch-protection=standard" TARGET hardening_interface SKIP_LINK) - endif() - endif() - - try_append_linker_flag("-Wl,--enable-reloc-section" TARGET hardening_interface) - try_append_linker_flag("-Wl,--dynamicbase" TARGET hardening_interface) - try_append_linker_flag("-Wl,--nxcompat" TARGET hardening_interface) - try_append_linker_flag("-Wl,--high-entropy-va" TARGET hardening_interface) - try_append_linker_flag("-Wl,-z,relro" TARGET hardening_interface) - try_append_linker_flag("-Wl,-z,now" TARGET hardening_interface) - try_append_linker_flag("-Wl,-z,separate-code" TARGET hardening_interface) + if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64") if(CMAKE_SYSTEM_NAME STREQUAL "Darwin") - try_append_linker_flag("-Wl,-fixup_chains" TARGET hardening_interface) + try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK) + else() + try_append_cxx_flags("-mbranch-protection=standard" TARGET hardening_interface SKIP_LINK) endif() endif() + + try_append_linker_flag("-Wl,--enable-reloc-section" TARGET hardening_interface) + try_append_linker_flag("-Wl,--dynamicbase" TARGET hardening_interface) + try_append_linker_flag("-Wl,--nxcompat" TARGET hardening_interface) + try_append_linker_flag("-Wl,--high-entropy-va" TARGET hardening_interface) + try_append_linker_flag("-Wl,-z,relro" TARGET hardening_interface) + try_append_linker_flag("-Wl,-z,now" TARGET hardening_interface) + try_append_linker_flag("-Wl,-z,separate-code" TARGET hardening_interface) + if(CMAKE_SYSTEM_NAME STREQUAL "Darwin") + try_append_linker_flag("-Wl,-fixup_chains" TARGET hardening_interface) + endif() endif() if(REDUCE_EXPORTS) @@ -672,7 +669,6 @@ message("Cross compiling ....................... ${cross_status}") message("C++ compiler .......................... ${CMAKE_CXX_COMPILER_ID} ${CMAKE_CXX_COMPILER_VERSION}, ${CMAKE_CXX_COMPILER}") include(FlagsSummary) flags_summary() -message("Attempt to harden executables ......... ${ENABLE_HARDENING}") message("Treat compiler warnings as errors ..... ${WERROR}") message("Use ccache for compiling .............. ${WITH_CCACHE}") message("\n") diff --git a/CMakePresets.json b/CMakePresets.json index 31cba7e32f4..ae21434b8a6 100644 --- a/CMakePresets.json +++ b/CMakePresets.json @@ -77,7 +77,6 @@ "BUILD_UTIL_CHAINSTATE": "ON", "BUILD_WALLET_TOOL": "ON", "ENABLE_EXTERNAL_SIGNER": "ON", - "ENABLE_HARDENING": "ON", "ENABLE_WALLET": "ON", "WARN_INCOMPATIBLE_BDB": "OFF", "WITH_BDB": "ON",