SafeStack: Add a SafeStack build configuration

Bug: 864705
Change-Id: Ifefb1df326d50f321bb2936979284c545156b38d
Reviewed-on: https://chromium-review.googlesource.com/1141048Reviewed-by: Nico Weber <thakis@chromium.org>
Commit-Queue: Vlad Tsyrklevich <vtsyrklevich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#583414}

build/config/compiler/BUILD.gn

@@ -381,7 +381,10 @@ config("compiler") {
       "-Wl,-z,now",
       "-Wl,-z,relro",
     ]
-    if (!using_sanitizer) {
+
+    # Compiler instrumentation can introduce dependencies in DSOs to symbols in
+    # the executable they are loaded into, so they are unresolved at link-time.
+    if (!using_sanitizer && !is_safestack) {
       ldflags += [
         "-Wl,-z,defs",
         "-Wl,--as-needed",

build/config/sanitizers/BUILD.gn

@@ -197,6 +197,9 @@ config("default_sanitizer_ldflags") {
     if (is_ubsan_vptr) {
       ldflags += [ "-fsanitize=vptr" ]
     }
+    if (is_safestack) {
+      ldflags += [ "-fsanitize=safe-stack" ]
+    }
 
     if (use_sanitizer_coverage) {
       if (use_libfuzzer) {
@@ -421,6 +424,12 @@ config("msan_flags") {
   }
 }
 
+config("safestack_flags") {
+  if (is_safestack) {
+    cflags = [ "-fsanitize=safe-stack" ]
+  }
+}
+
 config("tsan_flags") {
   if (is_tsan) {
     assert(is_linux, "tsan only supported on linux x86_64")
@@ -536,6 +545,7 @@ all_sanitizer_configs = [
   ":cfi_flags",
   ":lsan_flags",
   ":msan_flags",
+  ":safestack_flags",
   ":tsan_flags",
   ":ubsan_flags",
   ":ubsan_no_recover",

build/config/sanitizers/sanitizers.gni

@@ -33,6 +33,9 @@ declare_args() {
   # Compile for Undefined Behaviour Sanitizer's vptr checks.
   is_ubsan_vptr = false
 
+  # Compile with SafeStack shadow stack support.
+  is_safestack = false
+
   # Track where uninitialized memory originates from. From fastest to slowest:
   # 0 - no tracking, 1 - track only the initial allocation site, 2 - track the
   # chain of stores leading from allocation site to use site.
@@ -155,9 +158,9 @@ if (use_fuzzing_engine && sanitizer_coverage_flags == "") {
   sanitizer_coverage_flags = "trace-pc-guard,indirect-calls"
 }
 
-# Whether we are linking against a sanitizer runtime library. Among other
-# things, this changes the default symbol level and other settings in order to
-# prepare to create stack traces "live" using the sanitizer runtime.
+# Whether we are linking against a debugging sanitizer runtime library. Among
+# other things, this changes the default symbol level and other settings in
+# order to prepare to create stack traces "live" using the sanitizer runtime.
 using_sanitizer =
     is_asan || is_lsan || is_tsan || is_msan || is_ubsan || is_ubsan_null ||
     is_ubsan_vptr || is_ubsan_security || use_sanitizer_coverage || use_cfi_diag
@@ -168,6 +171,9 @@ assert(!using_sanitizer || is_clang,
 assert(!is_cfi || is_clang,
        "is_cfi requires setting is_clang = true in 'gn args'")
 
+assert(!is_safestack || is_clang,
+       "is_safestack requires setting is_clang = true in 'gn args'")
+
 prebuilt_instrumented_libraries_available =
     is_msan && (msan_track_origins == 0 || msan_track_origins == 2)
 

build/linux/chrome.safestack.map

+# This is a separate SafeStack version script to avoid accidentally exporting
+# a pthread_create symbol in the default build
+{
+global:
+  __bss_start;
+  __data_start;
+  data_start;
+  _edata;
+  _end;
+  _IO_stdin_used;
+
+  # Initialization and finalization functions for static global
+  # variables.
+  _fini;
+  _init;
+  __libc_csu_fini;
+  __libc_csu_init;
+
+  # Chrome's main function.  Exported for historical purposes.
+  ChromeMain;
+
+  # Program entry point.
+  _start;
+
+  # Memory allocation symbols.  We want chrome and any libraries to
+  # share the same heap, so it is correct to export these symbols.
+  calloc;
+  cfree;
+  free;
+  __free_hook;
+  __libc_calloc;
+  __libc_cfree;
+  __libc_free;
+  __libc_malloc;
+  __libc_memalign;
+  __libc_pvalloc;
+  __libc_realloc;
+  __libc_valloc;
+  mallinfo;
+  malloc;
+  __malloc_hook;
+  malloc_size;
+  malloc_stats;
+  malloc_usable_size;
+  mallopt;
+  memalign;
+  __memalign_hook;
+  __posix_memalign;
+  posix_memalign;
+  pvalloc;
+  realloc;
+  __realloc_hook;
+  valloc;
+
+  # Various flavors of operator new and operator delete.
+  _ZdaPv;
+  _ZdaPvm;
+  _ZdaPvmSt11align_val_t;
+  _ZdaPvRKSt9nothrow_t;
+  _ZdaPvSt11align_val_t;
+  _ZdaPvSt11align_val_tRKSt9nothrow_t;
+  _ZdlPv;
+  _ZdlPvm;
+  _ZdlPvmSt11align_val_t;
+  _ZdlPvRKSt9nothrow_t;
+  _ZdlPvSt11align_val_t;
+  _ZdlPvSt11align_val_tRKSt9nothrow_t;
+  _Znam;
+  _ZnamRKSt9nothrow_t;
+  _ZnamSt11align_val_t;
+  _ZnamSt11align_val_tRKSt9nothrow_t;
+  _Znwm;
+  _ZnwmRKSt9nothrow_t;
+  _ZnwmSt11align_val_t;
+  _ZnwmSt11align_val_tRKSt9nothrow_t;
+
+  # Various flavors of localtime().  These are exported by the chrome
+  # sandbox to intercept calls to localtime(), which would otherwise
+  # fail in untrusted processes that don't have permission to read
+  # /etc/localtime.  These overrides forward the request to the browser
+  # process, which uses dlsym(localtime) to make the real calls.
+  localtime;
+  localtime64;
+  localtime64_r;
+  localtime_r;
+
+  # The SafeStack runtime overrides thread creation routines to allocate shadow
+  # stacks on thread creation.
+  pthread_create;
+
+local:
+  *;
+};

chrome/BUILD.gn

@@ -279,7 +279,11 @@ if (!is_android && !is_mac) {
         }
 
         if (is_desktop_linux && !is_component_build && !using_sanitizer) {
-          version_script = "//build/linux/chrome.map"
+          if (is_safestack) {
+            version_script = "//build/linux/chrome.safestack.map"
+          } else {
+            version_script = "//build/linux/chrome.map"
+          }
           inputs = [
             version_script,
           ]