Skip to content

Commit 16fa094

Browse files
KornevNikitaKornevNikita
authored
Revert "[SYCL] Refresh hardening flags applied to the project " (#18472)
This reverts commit dda1c15. Validation of this commit fell to a human factor and as such haven't been properly performed. From what we see, existing flags are enough to pass various necessary binary scans, so the flags will be re-instated later after we carefully evaluate failures caused by them - for that we will need to start using them on the sycl branch first to ensure that they are regularly tested there as well.
1 parent dda1c15 commit 16fa094

File tree

1 file changed

+55
-189
lines changed

1 file changed

+55
-189
lines changed

‎llvm/cmake/modules/AddSecurityFlags.cmake

Lines changed: 55 additions & 189 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
macro(add_compile_option_ext flag name)
2-
cmake_parse_arguments(ARG "" "" "" ${ARGN})
2+
cmake_parse_arguments(ARG "" "" "" ${ARGN})
33
set(CHECK_STRING "${flag}")
4-
if(MSVC)
4+
if (MSVC)
55
set(CHECK_STRING "/WX ${CHECK_STRING}")
66
else()
77
set(CHECK_STRING "-Werror ${CHECK_STRING}")
88
endif()
99

1010
check_c_compiler_flag("${CHECK_STRING}" "C_SUPPORTS_${name}")
1111
check_cxx_compiler_flag("${CHECK_STRING}" "CXX_SUPPORTS_${name}")
12-
if(C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
12+
if (C_SUPPORTS_${name} AND CXX_SUPPORTS_${name})
1313
message(STATUS "Building with ${flag}")
1414
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${flag}")
1515
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${flag}")
@@ -31,207 +31,73 @@ macro(add_link_option_ext flag name)
3131
endif()
3232
endmacro()
3333

34-
set(is_gcc FALSE)
35-
set(is_clang FALSE)
36-
set(is_msvc FALSE)
37-
set(is_icpx FALSE)
38-
39-
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
40-
set(is_clang TRUE)
41-
endif()
42-
if(CMAKE_CXX_COMPILER_ID MATCHES "GNU")
43-
set(is_gcc TRUE)
44-
endif()
45-
if(CMAKE_CXX_COMPILER_ID MATCHES "IntelLLVM")
46-
set(is_icpx TRUE)
47-
endif()
48-
if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
49-
set(is_msvc TRUE)
50-
endif()
51-
5234
macro(append_common_extra_security_flags)
53-
# Compiler Warnings and Error Detection
54-
# Note: in intel/llvm we build both linux and win with --ci-defaults.
55-
# This flag also enables -Werror or /WX.
56-
if(is_gcc
57-
OR is_clang
58-
OR (is_icpx AND MSVC))
59-
add_compile_option_ext("-Wall" WALL)
60-
add_compile_option_ext("-Wextra" WEXTRA)
61-
elseif(is_icpx)
62-
add_compile_option_ext("/Wall" WALL)
63-
elseif(is_msvc)
64-
add_compile_option_ext("/W4" WALL)
65-
endif()
66-
67-
if(CMAKE_BUILD_TYPE MATCHES "Release")
68-
if(is_gcc
69-
OR is_clang
70-
OR (is_icpx AND MSVC))
71-
add_compile_option_ext("-Wconversion" WCONVERSION)
72-
add_compile_option_ext("-Wimplicit-fallthrough" WIMPLICITFALLTHROUGH)
73-
endif()
74-
endif()
75-
76-
# Control Flow Integrity
77-
if(is_gcc
78-
OR is_clang
79-
OR (is_icpx AND MSVC))
80-
add_compile_option_ext("-fcf-protection=full" FCFPROTECTION)
81-
elseif(is_icpx)
82-
add_compile_option_ext("/Qcf-protection:full" FCFPROTECTION)
83-
elseif(is_msvc)
84-
add_link_option_ext("/LTCG" LTCG CMAKE_EXE_LINKER_FLAGS
85-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
86-
add_compile_option_ext("/sdl" SDL)
87-
add_compile_option_ext("/guard:cf" GUARDCF)
88-
add_link_option_ext("/CETCOMPAT" CETCOMPAT CMAKE_EXE_LINKER_FLAGS
89-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
90-
endif()
91-
92-
# Format String Defense
93-
if(is_gcc
94-
OR is_clang
95-
OR (is_icpx AND MSVC))
96-
add_compile_option_ext("-Wformat" WFORMAT)
97-
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
98-
elseif(is_icpx)
99-
add_compile_option_ext("/Wformat" WFORMAT)
100-
add_compile_option_ext("/Wformat-security" WFORMATSECURITY)
101-
elseif(is_msvc)
102-
add_compile_option_ext("/analyze" ANALYZE)
103-
endif()
104-
105-
if(CMAKE_BUILD_TYPE MATCHES "Release")
106-
if(is_gcc
107-
OR is_clang
108-
OR (is_icpx AND MSVC))
109-
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
110-
endif()
111-
endif()
112-
113-
# Inexecutable Stack
114-
if(CMAKE_BUILD_TYPE MATCHES "Release")
115-
if(is_gcc
116-
OR is_clang
117-
OR (is_icpx AND MSVC))
118-
add_link_option_ext(
119-
"-Wl,-z,noexecstack" NOEXECSTACK CMAKE_EXE_LINKER_FLAGS
120-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
121-
endif()
122-
endif()
123-
124-
# Position Independent Code
125-
if(is_gcc
126-
OR is_clang
127-
OR (is_icpx AND MSVC))
128-
add_compile_option_ext("-fPIC" FPIC)
129-
elseif(is_msvc)
130-
add_compile_option_ext("/Gy" GY)
131-
endif()
132-
133-
# Position Independent Execution
134-
if(is_gcc
135-
OR is_clang
136-
OR (is_icpx AND MSVC))
137-
# The project should be configured with -DCMAKE_POSITION_INDEPENDENT_CODE=ON
138-
add_compile_option_ext("-fPIE" FPIE)
139-
add_link_option_ext("-pie" PIE CMAKE_EXE_LINKER_FLAGS
140-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
141-
elseif(is_msvc)
142-
add_link_option_ext("/DYNAMICBASE" DYNAMICBASE CMAKE_EXE_LINKER_FLAGS
143-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
144-
endif()
145-
146-
if(CMAKE_BUILD_TYPE MATCHES "Release")
147-
if(is_msvc)
148-
add_link_option_ext("/NXCOMPAT" NXCOMPAT CMAKE_EXE_LINKER_FLAGS
149-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
150-
endif()
151-
endif()
152-
153-
# Stack Protection
154-
if(is_msvc)
155-
add_compile_option_ext("/GS" GS)
156-
elseif(
157-
is_gcc
158-
OR is_clang
159-
OR (is_icpx AND MSVC))
160-
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
161-
add_compile_option_ext("-fstack-protector" FSTACKPROTECTOR)
162-
elseif(CMAKE_BUILD_TYPE MATCHES "Release")
163-
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
164-
add_compile_option_ext("-fstack-clash-protection" FSTACKCLASHPROTECTION)
165-
endif()
166-
endif()
167-
168-
if(LLVM_ON_UNIX)
35+
if( LLVM_ON_UNIX )
16936
# Fortify Source (strongly recommended):
170-
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
171-
message(WARNING "-D_FORTIFY_SOURCE=3 can only be used with optimization.")
172-
message(WARNING "-D_FORTIFY_SOURCE=3 is not supported.")
37+
if (CMAKE_BUILD_TYPE STREQUAL "Debug")
38+
message(WARNING
39+
"-D_FORTIFY_SOURCE=2 can only be used with optimization.")
40+
message(WARNING "-D_FORTIFY_SOURCE=2 is not supported.")
17341
else()
174-
# Sanitizers do not work with checked memory functions, such as
175-
# __memset_chk. We do not build release packages with sanitizers, so just
176-
# avoid -D_FORTIFY_SOURCE=3 under LLVM_USE_SANITIZER.
177-
if(NOT LLVM_USE_SANITIZER)
178-
message(STATUS "Building with -D_FORTIFY_SOURCE=3")
179-
add_definitions(-D_FORTIFY_SOURCE=3)
42+
# Sanitizers do not work with checked memory functions,
43+
# such as __memset_chk. We do not build release packages
44+
# with sanitizers, so just avoid -D_FORTIFY_SOURCE=2
45+
# under LLVM_USE_SANITIZER.
46+
if (NOT LLVM_USE_SANITIZER)
47+
message(STATUS "Building with -D_FORTIFY_SOURCE=2")
48+
add_definitions(-D_FORTIFY_SOURCE=2)
18049
else()
181-
message(
182-
WARNING "-D_FORTIFY_SOURCE=3 dropped due to LLVM_USE_SANITIZER.")
50+
message(WARNING
51+
"-D_FORTIFY_SOURCE=2 dropped due to LLVM_USE_SANITIZER.")
18352
endif()
18453
endif()
18554

186-
if(LLVM_ENABLE_ASSERTIONS)
187-
add_definitions(-D_GLIBCXX_ASSERTIONS)
188-
endif()
55+
# Format String Defense
56+
add_compile_option_ext("-Wformat" WFORMAT)
57+
add_compile_option_ext("-Wformat-security" WFORMATSECURITY)
58+
add_compile_option_ext("-Werror=format-security" WERRORFORMATSECURITY)
59+
60+
# Stack Protection
61+
add_compile_option_ext("-fstack-protector-strong" FSTACKPROTECTORSTRONG)
18962

19063
# Full Relocation Read Only
191-
if(CMAKE_BUILD_TYPE MATCHES "Release")
192-
add_link_option_ext("-Wl,-z,relro" ZRELRO CMAKE_EXE_LINKER_FLAGS
193-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
194-
endif()
64+
add_link_option_ext("-Wl,-z,relro" ZRELRO
65+
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
66+
CMAKE_SHARED_LINKER_FLAGS)
19567

19668
# Immediate Binding (Bindnow)
197-
if(CMAKE_BUILD_TYPE MATCHES "Release")
198-
add_link_option_ext("-Wl,-z,now" ZNOW CMAKE_EXE_LINKER_FLAGS
199-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
200-
add_link_option_ext("-Wl,-z,nodlopen" ZDLOPEN CMAKE_EXE_LINKER_FLAGS
201-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
202-
endif()
69+
add_link_option_ext("-Wl,-z,now" ZNOW
70+
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
71+
CMAKE_SHARED_LINKER_FLAGS)
20372
endif()
20473
endmacro()
20574

206-
if(EXTRA_SECURITY_FLAGS)
207-
if(EXTRA_SECURITY_FLAGS STREQUAL "none")
75+
if ( EXTRA_SECURITY_FLAGS )
76+
if (EXTRA_SECURITY_FLAGS STREQUAL "none")
20877
# No actions.
209-
elseif(EXTRA_SECURITY_FLAGS STREQUAL "default")
210-
append_common_extra_security_flags()
211-
elseif(EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
212-
append_common_extra_security_flags()
213-
if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
214-
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
215-
add_link_option_ext(
216-
"-fsanitize=cfi" FSANITIZE_CFI_LINK CMAKE_EXE_LINKER_FLAGS
217-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
218-
# Recommended option although linking a DSO with SafeStack is not
219-
# currently supported by compiler.
220-
# add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
221-
# add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
222-
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
223-
# CMAKE_SHARED_LINKER_FLAGS)
78+
elseif (EXTRA_SECURITY_FLAGS STREQUAL "default")
79+
append_common_extra_security_flags()
80+
elseif (EXTRA_SECURITY_FLAGS STREQUAL "sanitize")
81+
append_common_extra_security_flags()
82+
if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
83+
add_compile_option_ext("-fsanitize=cfi" FSANITIZE_CFI)
84+
add_link_option_ext("-fsanitize=cfi" FSANITIZE_CFI_LINK
85+
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
86+
CMAKE_SHARED_LINKER_FLAGS)
87+
# Recommended option although linking a DSO with SafeStack is not currently supported by compiler.
88+
#add_compile_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK)
89+
#add_link_option_ext("-fsanitize=safe-stack" FSANITIZE_SAFESTACK_LINK
90+
# CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
91+
# CMAKE_SHARED_LINKER_FLAGS)
92+
else()
93+
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
94+
# need to align compile and link option set, link now is set unconditionally
95+
add_link_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION_LINK
96+
CMAKE_EXE_LINKER_FLAGS CMAKE_MODULE_LINKER_FLAGS
97+
CMAKE_SHARED_LINKER_FLAGS)
98+
endif()
22499
else()
225-
add_compile_option_ext("-fcf-protection=full -mcet" FCF_PROTECTION)
226-
# need to align compile and link option set, link now is set
227-
# unconditionally
228-
add_link_option_ext(
229-
"-fcf-protection=full -mcet" FCF_PROTECTION_LINK CMAKE_EXE_LINKER_FLAGS
230-
CMAKE_MODULE_LINKER_FLAGS CMAKE_SHARED_LINKER_FLAGS)
100+
message(FATAL_ERROR "Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
231101
endif()
232-
else()
233-
message(
234-
FATAL_ERROR
235-
"Unsupported value of EXTRA_SECURITY_FLAGS: ${EXTRA_SECURITY_FLAGS}")
236-
endif()
237102
endif()
103+

0 commit comments

Comments
 (0)