From: "vo.x (Vit Ondruch) via ruby-core" <ruby-core@...>
Date: 2024-07-01T16:52:54+00:00
Subject: [ruby-core:118407] [Ruby master Bug#18061]  Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found

Issue #18061 has been updated by vo.x (Vit Ondruch).


As can be seen, I am testing this with Ruby 3.3.2. The upstream situation is, however, already a bit different since [#10987](https://github.com/ruby/ruby/pull/10987) (I actually took the inspiration from that PR). Given that [GCC documentation](https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fcf-protection) mentions that specifying the `-fcf-protection` compiler option defines the __CET__ macro, I think that we should build from here and condition the [#10987](https://github.com/ruby/ruby/pull/10987) based on the `__CET__` macro instead of specializing it to `__OpenBSD__`. And build system should somehow propagate the flag to the `ASFLAGS`.

BTW given what the annocheck referenced [documentation](https://sourceware.org/annobin/annobin.html/Test-cf-protection.html) says, I think that the patch above should be enough and the [#5895](https://github.com/ruby/ruby/pull/5895) likely address SHSTK, but certainly not the IBT what is the main point of this ticket.

----------------------------------------
Bug #18061:  Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found
https://bugs.ruby-lang.org/issues/18061#change-108924

* Author: jaruga (Jun Aruga)
* Status: Open
* Assignee: kjtsanaktsidis (KJ Tsanaktsidis)
* Backport: 2.6: UNKNOWN, 2.7: REQUIRED, 3.0: REQUIRED
----------------------------------------
I found an issue in our company's internal test called "execshield" by a security tool annobin - annocheck command [1][2].

```
Hardened: libruby.so.2.7.4: FAIL: property-note test because no .note.gnu.property section found
```

Here is the reproducer on the upstream latest master, commit is 5f2987d6c2ae9ace3178ac3e1bbb4ac7079101eb,

```
$ autoconf
$ ./configure --enable-shared
$ make

$ ls libruby.so.3.1.0
libruby.so.3.1.0*
```

If you are using Red Hat based Linux distro, it's easy to install by the RPM package like this.

```
$ sudo dnf -y install annobin-annocheck
```

```
$ sudo yum -y install annobin-annocheck
```

Then

```
$ annocheck libruby.so.3.1.0
```

If you are using other Linux distros such as Ubuntu, you can use it by a container I prepared.

Prepare the following `Dockerfile`.

```
$ cat Dockerfile 
FROM docker.io/fedora:34

RUN cat /etc/fedora-release
RUN dnf -y install annobin-annocheck
WORKDIR /work
```

Then build the container image with the `Dockerfile` and run the annocheck command for the `libruby.so.3.1.0` on your host environment. The `-v` is an option for bind mount between host and container environment.

```
$ docker build --rm -t fedora-annocheck .

$ docker run --rm -t -v $(pwd):/work fedora-annocheck annocheck /work/libruby.so.3.1.0
annocheck: Version 9.79.
Hardened: libruby.so.3.1.0: FAIL: bind-now test because not linked with -Wl,-z,now 
Hardened: libruby.so.3.1.0: FAIL: notes test because gaps were detected in the annobin coverage 
Hardened: libruby.so.3.1.0: FAIL: cf-protection test because no .note.gnu.property section = no control flow information 
Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found 
Hardened: Rerun annocheck with --verbose to see more information on the tests.
```

The message `Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found` is what I found in our internal test. For other FAIL messages, maybe it can be fixed by changing how to build.

Asking a colleague, I was told that the `coroutine/*/Context.S` files such as [coroutine/x86/Context.S](https://github.com/ruby/ruby/blob/master/coroutine/x86/Context.S) cause the failure. Do you have any idea how to fix this? Thanks.

* [1] https://sourceware.org/annobin/
* [2] You can see `man annocheck` or https://www.mankier.com/1/annocheck .

---Files--------------------------------
0001-Add-.note.gnu.property-sections.patch (2.64 KB)
0001-Add-.note.gnu.property-sections.patch (3.69 KB)
config-pie.log (11.4 KB)


-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/