github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 06:06:02 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions

support Spectre mitigation patch for gcc compiler

Browse source
This commit is contained in:
netblue30 2018-03-23 19:28:05 -04:00
parent 7872491531
commit e3f64f751e
18 changed files with 83 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Makefile.in
View file

@ -75,7 +75,7 @@ distclean: clean
for dir in $(APPS) $(MYLIBS); do \
$(MAKE) -C $$dir distclean; \
done
rm -fr Makefile autom4te.cache config.log config.status config.h uids.h
rm -fr Makefile autom4te.cache config.log config.status config.h uids.h dummy.o
realinstall:
# firejail executable
@ -195,7 +195,7 @@ uninstall:
rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firemon
rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firecfg
DISTFILES = "src etc platform contrib configure configure.ac Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh mkuid.sh COPYING README RELNOTES"
DISTFILES = "src etc platform contrib configure configure.ac dummy.c Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh mkuid.sh COPYING README RELNOTES"
DISTFILES_TEST = "test/apps test/apps-x11 test/apps-x11-xorg test/root test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/arguments test/fs test/sysutils test/chroot"
dist:

4
RELNOTES
View file

@ -26,8 +26,8 @@ firejail (0.9.53) baseline; urgency=low
* added sandbox name support in firemon
* new profiles: basilisk, Tor Browser language packs, PlayOnLinux, sylpheed,
* new profiles: discord-canary, pycharm-community, pycharm-professional,
* new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine, VS Code,
* new profiles: falkon, gnome-builder, asunder
* new profiles: pdfchain, tilp, vivaldi-snapshot, bitcoin-qt, kaffeine,
* new profiles: falkon, gnome-builder, asunder, VS Code,
-- netblue30 <netblue30@yahoo.com> Thu, 1 Mar 2018 08:00:00 -0500
firejail (0.9.52) baseline; urgency=low

30
configure vendored
View file

@ -646,6 +646,7 @@ EGREP
GREP
CPP
HAVE_APPARMOR
EXTRA_CFLAGS
RANLIB
INSTALL_DATA
INSTALL_SCRIPT
@ -3105,6 +3106,33 @@ else
fi
HAVE_SPECTRE="no"
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Spectre mitigation support in gcc compiler" >&5
$as_echo_n "checking for Spectre mitigation support in gcc compiler... " >&6; }
if test "$CC" = "gcc"; then :
HAVE_SPECTRE="yes"
$CC -mindirect-branch=thunk -c dummy.c || HAVE_SPECTRE="no"
rm -f dummy.o
fi
if test "$HAVE_SPECTRE" = "yes"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
$as_echo "yes" >&6; }
EXTRA_CFLAGS+="-mindirect-branch=thunk"
fi
if test "$HAVE_SPECTRE" = "no"; then :
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: ... not available" >&5
$as_echo "... not available" >&6; }
fi
HAVE_APPARMOR=""
# Check whether --enable-apparmor was given.
if test "${enable_apparmor+set}" = set; then :
@ -5024,7 +5052,9 @@ echo " file transfer support: $HAVE_FILE_TRANSFER"
echo " overlayfs support: $HAVE_OVERLAYFS"
echo " git install support: $HAVE_GIT_INSTALL"
echo " busybox workaround: $BUSYBOX_WORKAROUND"
echo " Spectre compiler patch: $HAVE_SPECTRE"
echo " EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
echo " EXTRA_CFLAGS: $EXTRA_CFLAGS"
echo " fatal warnings: $HAVE_FATAL_WARNINGS"
echo " Gcov instrumentation: $HAVE_GCOV"
echo " Install contrib scripts: $HAVE_CONTRIB_INSTALL"

20
configure.ac
View file

@ -9,6 +9,24 @@ AC_PROG_CC
AC_PROG_INSTALL
AC_PROG_RANLIB
HAVE_SPECTRE="no"
AC_MSG_CHECKING(for Spectre mitigation support in gcc compiler)
AS_IF([test "$CC" = "gcc"], [
HAVE_SPECTRE="yes"
$CC -mindirect-branch=thunk -c dummy.c || HAVE_SPECTRE="no"
rm -f dummy.o
])
AS_IF([test "$HAVE_SPECTRE" = "yes"], [
AC_MSG_RESULT(yes)
EXTRA_CFLAGS+="-mindirect-branch=thunk"
])
AS_IF([test "$HAVE_SPECTRE" = "no"], [
AC_MSG_RESULT(... not available)
])
AC_SUBST([EXTRA_CFLAGS])
HAVE_APPARMOR=""
AC_ARG_ENABLE([apparmor],
AS_HELP_STRING([--enable-apparmor], [enable apparmor]))
@ -198,7 +216,9 @@ echo " file transfer support: $HAVE_FILE_TRANSFER"
echo " overlayfs support: $HAVE_OVERLAYFS"
echo " git install support: $HAVE_GIT_INSTALL"
echo " busybox workaround: $BUSYBOX_WORKAROUND"
echo " Spectre compiler patch: $HAVE_SPECTRE"
echo " EXTRA_LDFLAGS: $EXTRA_LDFLAGS"
echo " EXTRA_CFLAGS: $EXTRA_CFLAGS"
echo " fatal warnings: $HAVE_FATAL_WARNINGS"
echo " Gcov instrumentation: $HAVE_GCOV"
echo " Install contrib scripts: $HAVE_CONTRIB_INSTALL"

3
dummy.c Normal file
View file

@ -0,0 +1,3 @@
int main(void) {
return 0;
}

4
src/fbuilder/Makefile.in
View file

@ -22,9 +22,9 @@ HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
HAVE_APPARMOR=@HAVE_APPARMOR@
HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fbuilder: $(OBJS)
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

3
src/fcopy/Makefile.in
View file

@ -25,6 +25,7 @@ HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +35,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fcopy: $(OBJS)
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

3
src/firecfg/Makefile.in
View file

@ -19,6 +19,7 @@ HAVE_X11=@HAVE_X11@
HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
@ -29,7 +30,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/pid.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
firecfg: $(OBJS) ../lib/common.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS)

3
src/firejail/Makefile.in
View file

@ -25,6 +25,7 @@ HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
HAVE_GCOV=@HAVE_GCOV@
HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +35,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS)

3
src/firemon/Makefile.in
View file

@ -17,10 +17,11 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
%.o : %.c $(H_FILE_LIST)
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
firemon: $(OBJS) ../lib/common.o ../lib/pid.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS)

4
src/fldd/Makefile.in
View file

@ -24,7 +24,7 @@ HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h ../include/ldd_utils.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fldd: $(OBJS) ../lib/ldd_utils.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS)

4
src/fnet/Makefile.in
View file

@ -22,9 +22,9 @@ HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
HAVE_APPARMOR=@HAVE_APPARMOR@
HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fnet: $(OBJS) ../lib/libnetlink.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS)

4
src/fnetfilter/Makefile.in
View file

@ -24,7 +24,7 @@ HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fnetfilter: $(OBJS)
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

4
src/fsec-optimize/Makefile.in
View file

@ -22,9 +22,9 @@ HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
HAVE_APPARMOR=@HAVE_APPARMOR@
HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fsec-optimize: $(OBJS) ../lib/libnetlink.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

3
src/fsec-print/Makefile.in
View file

@ -25,6 +25,7 @@ HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +35,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fsec-print: $(OBJS) ../lib/libnetlink.o
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

4
src/fseccomp/Makefile.in
View file

@ -22,9 +22,9 @@ HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
HAVE_APPARMOR=@HAVE_APPARMOR@
HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -34,7 +34,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
fseccomp: $(OBJS)
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)

3
src/ftee/Makefile.in
View file

@ -7,6 +7,7 @@ NAME=@PACKAGE_NAME@
HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -16,7 +17,7 @@ CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
%.o : %.c $(H_FILE_LIST)
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
ftee: $(OBJS)
$(CC) $(LDFLAGS) -o $@ $(OBJS) $(EXTRA_LDFLAGS)

3
src/lib/Makefile.in
View file

@ -5,6 +5,7 @@ NAME=@PACKAGE_NAME@
HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
HAVE_GCOV=@HAVE_GCOV@
EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
EXTRA_CFLAGS +=@EXTRA_CFLAGS@
H_FILE_LIST = $(sort $(wildcard *.[h]))
C_FILE_LIST = $(sort $(wildcard *.c))
@ -16,7 +17,7 @@ LDFLAGS:=-pic -Wl,-z,relro -Wl,-z,now
all: $(OBJS)
%.o : %.c $(H_FILE_LIST)
$(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
clean:; rm -f $(OBJS) *.gcov *.gcda *.gcno