security.go

     1  // Copyright 2018 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Checking of compiler and linker flags.
     6  // We must avoid flags like -fplugin=, which can allow
     7  // arbitrary code execution during the build.
     8  // Do not make changes here without carefully
     9  // considering the implications.
    10  // (That's why the code is isolated in a file named security.go.)
    11  //
    12  // Note that -Wl,foo means split foo on commas and pass to
    13  // the linker, so that -Wl,-foo,bar means pass -foo bar to
    14  // the linker. Similarly -Wa,foo for the assembler and so on.
    15  // If any of these are permitted, the wildcard portion must
    16  // disallow commas.
    17  //
    18  // Note also that GNU binutils accept any argument @foo
    19  // as meaning "read more flags from the file foo", so we must
    20  // guard against any command-line argument beginning with @,
    21  // even things like "-I @foo".
    22  // We use load.SafeArg (which is even more conservative)
    23  // to reject these.
    24  //
    25  // Even worse, gcc -I@foo (one arg) turns into cc1 -I @foo (two args),
    26  // so although gcc doesn't expand the @foo, cc1 will.
    27  // So out of paranoia, we reject @ at the beginning of every
    28  // flag argument that might be split into its own argument.
    29  
    30  package work
    31  
    32  import (
    33  	"fmt"
    34  	"internal/lazyregexp"
    35  	"regexp"
    36  	"strings"
    37  
    38  	"cmd/go/internal/cfg"
    39  	"cmd/go/internal/load"
    40  )
    41  
    42  var re = lazyregexp.New
    43  
    44  var validCompilerFlags = []*lazyregexp.Regexp{
    45  	re(`-D([A-Za-z_][A-Za-z0-9_]*)(=[^@\-]*)?`),
    46  	re(`-U([A-Za-z_][A-Za-z0-9_]*)`),
    47  	re(`-F([^@\-].*)`),
    48  	re(`-I([^@\-].*)`),
    49  	re(`-O`),
    50  	re(`-O([^@\-].*)`),
    51  	re(`-W`),
    52  	re(`-W([^@,]+)`), // -Wall but not -Wa,-foo.
    53  	re(`-Wa,-mbig-obj`),
    54  	re(`-Wp,-D([A-Za-z_][A-Za-z0-9_]*)(=[^@,\-]*)?`),
    55  	re(`-Wp,-U([A-Za-z_][A-Za-z0-9_]*)`),
    56  	re(`-ansi`),
    57  	re(`-f(no-)?asynchronous-unwind-tables`),
    58  	re(`-f(no-)?blocks`),
    59  	re(`-f(no-)builtin-[a-zA-Z0-9_]*`),
    60  	re(`-f(no-)?common`),
    61  	re(`-f(no-)?constant-cfstrings`),
    62  	re(`-fdebug-prefix-map=([^@]+)=([^@]+)`),
    63  	re(`-fdiagnostics-show-note-include-stack`),
    64  	re(`-ffile-prefix-map=([^@]+)=([^@]+)`),
    65  	re(`-fno-canonical-system-headers`),
    66  	re(`-f(no-)?eliminate-unused-debug-types`),
    67  	re(`-f(no-)?exceptions`),
    68  	re(`-f(no-)?fast-math`),
    69  	re(`-f(no-)?inline-functions`),
    70  	re(`-finput-charset=([^@\-].*)`),
    71  	re(`-f(no-)?fat-lto-objects`),
    72  	re(`-f(no-)?keep-inline-dllexport`),
    73  	re(`-f(no-)?lto`),
    74  	re(`-fmacro-backtrace-limit=(.+)`),
    75  	re(`-fmessage-length=(.+)`),
    76  	re(`-f(no-)?modules`),
    77  	re(`-f(no-)?objc-arc`),
    78  	re(`-f(no-)?objc-nonfragile-abi`),
    79  	re(`-f(no-)?objc-legacy-dispatch`),
    80  	re(`-f(no-)?omit-frame-pointer`),
    81  	re(`-f(no-)?openmp(-simd)?`),
    82  	re(`-f(no-)?permissive`),
    83  	re(`-f(no-)?(pic|PIC|pie|PIE)`),
    84  	re(`-f(no-)?plt`),
    85  	re(`-f(no-)?rtti`),
    86  	re(`-f(no-)?split-stack`),
    87  	re(`-f(no-)?stack-(.+)`),
    88  	re(`-f(no-)?strict-aliasing`),
    89  	re(`-f(un)signed-char`),
    90  	re(`-f(no-)?use-linker-plugin`), // safe if -B is not used; we don't permit -B
    91  	re(`-f(no-)?visibility-inlines-hidden`),
    92  	re(`-fsanitize=(.+)`),
    93  	re(`-fsanitize-undefined-strip-path-components=(-)?[0-9]+`),
    94  	re(`-ftemplate-depth-(.+)`),
    95  	re(`-ftls-model=(global-dynamic|local-dynamic|initial-exec|local-exec)`),
    96  	re(`-fvisibility=(.+)`),
    97  	re(`-g([^@\-].*)?`),
    98  	re(`-m32`),
    99  	re(`-m64`),
   100  	re(`-m(abi|arch|cpu|fpu|simd|tls-dialect|tune)=([^@\-].*)`),
   101  	re(`-m(no-)?v?aes`),
   102  	re(`-marm`),
   103  	re(`-m(no-)?avx[0-9a-z]*`),
   104  	re(`-mcmodel=[0-9a-z-]+`),
   105  	re(`-mfloat-abi=([^@\-].*)`),
   106  	re(`-m(soft|single|double)-float`),
   107  	re(`-mfpmath=[0-9a-z,+]*`),
   108  	re(`-m(no-)?avx[0-9a-z.]*`),
   109  	re(`-m(no-)?ms-bitfields`),
   110  	re(`-m(no-)?stack-(.+)`),
   111  	re(`-mmacosx-(.+)`),
   112  	re(`-m(no-)?relax`),
   113  	re(`-m(no-)?strict-align`),
   114  	re(`-m(no-)?(lsx|lasx|frecipe|div32|lam-bh|lamcas|ld-seq-sa)`),
   115  	re(`-mios-simulator-version-min=(.+)`),
   116  	re(`-miphoneos-version-min=(.+)`),
   117  	re(`-mlarge-data-threshold=[0-9]+`),
   118  	re(`-mtvos-simulator-version-min=(.+)`),
   119  	re(`-mtvos-version-min=(.+)`),
   120  	re(`-mwatchos-simulator-version-min=(.+)`),
   121  	re(`-mwatchos-version-min=(.+)`),
   122  	re(`-mnop-fun-dllimport`),
   123  	re(`-m(no-)?sse[0-9.]*`),
   124  	re(`-m(no-)?ssse3`),
   125  	re(`-mthumb(-interwork)?`),
   126  	re(`-mthreads`),
   127  	re(`-mwindows`),
   128  	re(`-no-canonical-prefixes`),
   129  	re(`--param=ssp-buffer-size=[0-9]*`),
   130  	re(`-pedantic(-errors)?`),
   131  	re(`-pipe`),
   132  	re(`-pthread`),
   133  	re(`--static`),
   134  	re(`-?-std=([^@\-].*)`),
   135  	re(`-?-stdlib=([^@\-].*)`),
   136  	re(`--sysroot=([^@\-].*)`),
   137  	re(`-w`),
   138  	re(`-x([^@\-].*)`),
   139  	re(`-v`),
   140  }
   141  
   142  var validCompilerFlagsWithNextArg = []string{
   143  	"-arch",
   144  	"-D",
   145  	"-U",
   146  	"-I",
   147  	"-F",
   148  	"-framework",
   149  	"-include",
   150  	"-isysroot",
   151  	"-isystem",
   152  	"--sysroot",
   153  	"-target",
   154  	"-x",
   155  }
   156  
   157  var invalidLinkerFlags = []*lazyregexp.Regexp{
   158  	// On macOS this means the linker loads and executes the next argument.
   159  	// Have to exclude separately because -lfoo is allowed in general.
   160  	re(`-lto_library`),
   161  }
   162  
   163  var validLinkerFlags = []*lazyregexp.Regexp{
   164  	re(`-F([^@\-].*)`),
   165  	re(`-l([^@\-].*)`),
   166  	re(`-L([^@\-].*)`),
   167  	re(`-O`),
   168  	re(`-O([^@\-].*)`),
   169  	re(`-f(no-)?(pic|PIC|pie|PIE)`),
   170  	re(`-f(no-)?openmp(-simd)?`),
   171  	re(`-fsanitize=([^@\-].*)`),
   172  	re(`-flat_namespace`),
   173  	re(`-g([^@\-].*)?`),
   174  	re(`-headerpad_max_install_names`),
   175  	re(`-m(abi|arch|cpu|fpu|simd|tls-dialect|tune)=([^@\-].*)`),
   176  	re(`-mcmodel=[0-9a-z-]+`),
   177  	re(`-mfloat-abi=([^@\-].*)`),
   178  	re(`-m(soft|single|double)-float`),
   179  	re(`-m(no-)?relax`),
   180  	re(`-m(no-)?strict-align`),
   181  	re(`-m(no-)?(lsx|lasx|frecipe|div32|lam-bh|lamcas|ld-seq-sa)`),
   182  	re(`-mmacosx-(.+)`),
   183  	re(`-mios-simulator-version-min=(.+)`),
   184  	re(`-miphoneos-version-min=(.+)`),
   185  	re(`-mthreads`),
   186  	re(`-mwindows`),
   187  	re(`-(pic|PIC|pie|PIE)`),
   188  	re(`-pthread`),
   189  	re(`-rdynamic`),
   190  	re(`-shared`),
   191  	re(`-?-static([-a-z0-9+]*)`),
   192  	re(`-?-stdlib=([^@\-].*)`),
   193  	re(`-v`),
   194  
   195  	// Note that any wildcards in -Wl need to exclude comma,
   196  	// since -Wl splits its argument at commas and passes
   197  	// them all to the linker uninterpreted. Allowing comma
   198  	// in a wildcard would allow tunneling arbitrary additional
   199  	// linker arguments through one of these.
   200  	re(`-Wl,--(no-)?allow-multiple-definition`),
   201  	re(`-Wl,--(no-)?allow-shlib-undefined`),
   202  	re(`-Wl,--(no-)?as-needed`),
   203  	re(`-Wl,-Bdynamic`),
   204  	re(`-Wl,-berok`),
   205  	re(`-Wl,-Bstatic`),
   206  	re(`-Wl,-Bsymbolic-functions`),
   207  	re(`-Wl,-O[0-9]+`),
   208  	re(`-Wl,-d[ny]`),
   209  	re(`-Wl,--disable-new-dtags`),
   210  	re(`-Wl,-e[=,][a-zA-Z0-9]+`),
   211  	re(`-Wl,--enable-new-dtags`),
   212  	re(`-Wl,--end-group`),
   213  	re(`-Wl,--(no-)?export-dynamic`),
   214  	re(`-Wl,-E`),
   215  	re(`-Wl,-framework,[^,@\-][^,]*`),
   216  	re(`-Wl,--hash-style=(sysv|gnu|both)`),
   217  	re(`-Wl,-headerpad_max_install_names`),
   218  	re(`-Wl,--no-undefined`),
   219  	re(`-Wl,--pop-state`),
   220  	re(`-Wl,--push-state`),
   221  	re(`-Wl,-R,?([^@\-,][^,@]*$)`),
   222  	re(`-Wl,--just-symbols[=,]([^,@\-][^,@]*)`),
   223  	re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]*)`),
   224  	re(`-Wl,-s`),
   225  	re(`-Wl,-search_paths_first`),
   226  	re(`-Wl,-sectcreate,([^,@\-][^,]*),([^,@\-][^,]*),([^,@\-][^,]*)`),
   227  	re(`-Wl,--start-group`),
   228  	re(`-Wl,-?-static`),
   229  	re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`),
   230  	re(`-Wl,-syslibroot[=,]([^,@\-][^,]*)`),
   231  	re(`-Wl,-undefined[=,]([^,@\-][^,]*)`),
   232  	re(`-Wl,-?-unresolved-symbols=[^,]+`),
   233  	re(`-Wl,--(no-)?warn-([^,]+)`),
   234  	re(`-Wl,-?-wrap[=,][^,@\-][^,]*`),
   235  	re(`-Wl(,-z,(relro|now|(no)?execstack))+`),
   236  
   237  	re(`[a-zA-Z0-9_/].*\.(a|o|obj|dll|dylib|so|tbd)`), // direct linker inputs: x.o or libfoo.so (but not -foo.o or @foo.o)
   238  	re(`\./.*\.(a|o|obj|dll|dylib|so|tbd)`),
   239  }
   240  
   241  var validLinkerFlagsWithNextArg = []string{
   242  	"-arch",
   243  	"-F",
   244  	"-l",
   245  	"-L",
   246  	"-framework",
   247  	"-isysroot",
   248  	"--sysroot",
   249  	"-target",
   250  	"-Wl,-framework",
   251  	"-Wl,-rpath",
   252  	"-Wl,-R",
   253  	"-Wl,--just-symbols",
   254  	"-Wl,-undefined",
   255  }
   256  
   257  var validPkgConfigFlags = []*lazyregexp.Regexp{
   258  	re(`--atleast-pkgconfig-version=\d+\.\d+\.\d+`),
   259  	re(`--atleast-version=\d+\.\d+\.\d+`),
   260  	re(`--cflags-only-I`),
   261  	re(`--cflags`),
   262  	re(`--define-prefix`),
   263  	re(`--define-variable=[A-Za-z_][A-Za-z0-9_]*=[^@\-]*`),
   264  	re(`--digraph`),
   265  	re(`--dont-define-prefix`),
   266  	re(`--dont-relocate-paths`),
   267  	re(`--dump-personality`),
   268  	re(`--env-only`),
   269  	re(`--errors-to-stdout`),
   270  	re(`--exact-version=\d+\.\d+\.\d+`),
   271  	re(`--exists`),
   272  	re(`--fragment-filter=[A-Za-z_][a-zA-Z0-9_]*`),
   273  	re(`--ignore-conflicts`),
   274  	re(`--internal-cflags`),
   275  	re(`--keep-system-cflags`),
   276  	re(`--keep-system-libs`),
   277  	re(`--libs-only-l`),
   278  	re(`--libs-only-L`),
   279  	re(`--libs`),
   280  	re(`--list-all`),
   281  	re(`--list-package-names`),
   282  	re(`--max-version=\d+\.\d+\.\d+`),
   283  	re(`--maximum-traverse-depth=[0-9]+`),
   284  	re(`--modversion`),
   285  	re(`--msvc-syntax`),
   286  	re(`--no-cache`),
   287  	re(`--no-provides`),
   288  	re(`--no-uninstalled`),
   289  	re(`--path`),
   290  	re(`--personality=(triplet|filename)`),
   291  	re(`--prefix-variable=[A-Za-z_][a-zA-Z0-9_]*`),
   292  	re(`--print-errors`),
   293  	re(`--print-provides`),
   294  	re(`--print-requires-private`),
   295  	re(`--print-requires`),
   296  	re(`--print-variables`),
   297  	re(`--pure`),
   298  	re(`--shared`),
   299  	re(`--short-errors`),
   300  	re(`--silence-errors`),
   301  	re(`--simulate`),
   302  	re(`--static`),
   303  	re(`--uninstalled`),
   304  	re(`--validate`),
   305  	re(`--variable=[A-Za-z_][a-zA-Z0-9_]*`),
   306  	re(`--with-path=[^@\-].*`),
   307  }
   308  
   309  func checkCompilerFlags(name, source string, list []string) error {
   310  	checkOverrides := true
   311  	return checkFlags(name, source, list, nil, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides)
   312  }
   313  
   314  func checkLinkerFlags(name, source string, list []string) error {
   315  	checkOverrides := true
   316  	return checkFlags(name, source, list, invalidLinkerFlags, validLinkerFlags, validLinkerFlagsWithNextArg, checkOverrides)
   317  }
   318  
   319  func checkPkgConfigFlags(name, source string, list []string) error {
   320  	checkOverrides := false
   321  	return checkFlags(name, source, list, nil, validPkgConfigFlags, nil, checkOverrides)
   322  }
   323  
   324  // checkCompilerFlagsForInternalLink returns an error if 'list'
   325  // contains a flag or flags that may not be fully supported by
   326  // internal linking (meaning that we should punt the link to the
   327  // external linker).
   328  func checkCompilerFlagsForInternalLink(name, source string, list []string) error {
   329  	checkOverrides := false
   330  	if err := checkFlags(name, source, list, nil, validCompilerFlags, validCompilerFlagsWithNextArg, checkOverrides); err != nil {
   331  		return err
   332  	}
   333  	// Currently the only flag on the allow list that causes problems
   334  	// for the linker is "-flto"; check for it manually here.
   335  	for _, fl := range list {
   336  		if strings.HasPrefix(fl, "-flto") {
   337  			return fmt.Errorf("flag %q triggers external linking", fl)
   338  		}
   339  	}
   340  	return nil
   341  }
   342  
   343  func checkFlags(name, source string, list []string, invalid, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {
   344  	// Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc.
   345  	var (
   346  		allow    *regexp.Regexp
   347  		disallow *regexp.Regexp
   348  	)
   349  	if checkOverrides {
   350  		if env := cfg.Getenv("CGO_" + name + "_ALLOW"); env != "" {
   351  			r, err := regexp.Compile(env)
   352  			if err != nil {
   353  				return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err)
   354  			}
   355  			allow = r
   356  		}
   357  		if env := cfg.Getenv("CGO_" + name + "_DISALLOW"); env != "" {
   358  			r, err := regexp.Compile(env)
   359  			if err != nil {
   360  				return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err)
   361  			}
   362  			disallow = r
   363  		}
   364  	}
   365  
   366  Args:
   367  	for i := 0; i < len(list); i++ {
   368  		arg := list[i]
   369  		if disallow != nil && disallow.FindString(arg) == arg {
   370  			goto Bad
   371  		}
   372  		if allow != nil && allow.FindString(arg) == arg {
   373  			continue Args
   374  		}
   375  		for _, re := range invalid {
   376  			if re.FindString(arg) == arg { // must be complete match
   377  				goto Bad
   378  			}
   379  		}
   380  		for _, re := range valid {
   381  			if match := re.FindString(arg); match == arg { // must be complete match
   382  				continue Args
   383  			} else if strings.HasPrefix(arg, "-Wl,--push-state,") {
   384  				// Examples for --push-state are written
   385  				//     -Wl,--push-state,--as-needed
   386  				// Support other commands in the same -Wl arg.
   387  				args := strings.Split(arg, ",")
   388  				for _, a := range args[1:] {
   389  					a = "-Wl," + a
   390  					var found bool
   391  					for _, re := range valid {
   392  						if re.FindString(a) == a {
   393  							found = true
   394  							break
   395  						}
   396  					}
   397  					if !found {
   398  						goto Bad
   399  					}
   400  					for _, re := range invalid {
   401  						if re.FindString(a) == a {
   402  							goto Bad
   403  						}
   404  					}
   405  				}
   406  				continue Args
   407  			}
   408  		}
   409  		for _, x := range validNext {
   410  			if arg == x {
   411  				if i+1 < len(list) && load.SafeArg(list[i+1]) {
   412  					i++
   413  					continue Args
   414  				}
   415  
   416  				// Permit -Wl,-framework -Wl,name.
   417  				if i+1 < len(list) &&
   418  					strings.HasPrefix(arg, "-Wl,") &&
   419  					strings.HasPrefix(list[i+1], "-Wl,") &&
   420  					load.SafeArg(list[i+1][4:]) &&
   421  					!strings.Contains(list[i+1][4:], ",") {
   422  					i++
   423  					continue Args
   424  				}
   425  
   426  				// Permit -I= /path, -I $SYSROOT.
   427  				if i+1 < len(list) && arg == "-I" {
   428  					if (strings.HasPrefix(list[i+1], "=") || strings.HasPrefix(list[i+1], "$SYSROOT")) &&
   429  						load.SafeArg(list[i+1][1:]) {
   430  						i++
   431  						continue Args
   432  					}
   433  				}
   434  
   435  				if i+1 < len(list) {
   436  					return fmt.Errorf("invalid flag in %s: %s %s (see https://golang.org/s/invalidflag)", source, arg, list[i+1])
   437  				}
   438  				return fmt.Errorf("invalid flag in %s: %s without argument (see https://golang.org/s/invalidflag)", source, arg)
   439  			}
   440  		}
   441  	Bad:
   442  		return fmt.Errorf("invalid flag in %s: %s", source, arg)
   443  	}
   444  	return nil
   445  }
   446
View as plain text