diff options
-rw-r--r-- | cmake/QtFeature.cmake | 11 | ||||
-rw-r--r-- | cmake/QtInternalTargets.cmake | 46 | ||||
-rw-r--r-- | config_help.txt | 11 | ||||
-rw-r--r-- | configure.cmake | 163 | ||||
-rw-r--r-- | qt_cmdline.cmake | 7 |
5 files changed, 203 insertions, 35 deletions
diff --git a/cmake/QtFeature.cmake b/cmake/QtFeature.cmake index afe0417f61..96cb308b2c 100644 --- a/cmake/QtFeature.cmake +++ b/cmake/QtFeature.cmake @@ -1359,7 +1359,16 @@ function(qt_config_linker_supports_flag_test name) endif() cmake_parse_arguments(arg "" "LABEL;FLAG" "" ${ARGN}) - set(flags "-Wl,${arg_FLAG}") + if(GCC OR CLANG) + set(flags "-Wl,--fatal-warnings,${arg_FLAG}") + elseif(MSVC) + set(flags "${arg_FLAG}") + else() + # We don't know how to pass linker options in a way that + # it reliably fails, so assume the detection failed. + set(TEST_${name} "0" CACHE INTERNAL "${label}") + return() + endif() # Pass the linker that the main project uses to the compile test. qt_internal_get_active_linker_flags(linker_flags) diff --git a/cmake/QtInternalTargets.cmake b/cmake/QtInternalTargets.cmake index bdba1b5be1..885665b7ed 100644 --- a/cmake/QtInternalTargets.cmake +++ b/cmake/QtInternalTargets.cmake @@ -316,18 +316,52 @@ if (GCC AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL "9.2") target_compile_options(PlatformCommonInternal INTERFACE $<$<COMPILE_LANGUAGE:CXX>:-Wsuggest-override>) endif() +# Hardening options if(QT_FEATURE_intelcet) if(MSVC) - qt_internal_platform_link_options(PlatformCommonInternal INTERFACE - -CETCOMPAT - ) + qt_internal_platform_link_options(PlatformCommonInternal INTERFACE -CETCOMPAT) else() - target_compile_options(PlatformCommonInternal INTERFACE - -fcf-protection=full - ) + target_compile_options(PlatformCommonInternal INTERFACE -fcf-protection=full) + endif() +endif() + +if(QT_FEATURE_glibc_fortify_source) + set(is_optimized_build "$<OR:$<NOT:$<CONFIG:Debug>>,$<BOOL:${QT_FEATURE_optimize_debug}>>") + # Some compilers may define _FORTIFY_SOURCE by default when optimizing, remove it + # before defining our own + target_compile_options(PlatformCommonInternal BEFORE INTERFACE "$<${is_optimized_build}:-U_FORTIFY_SOURCE>") + if(TEST_glibc_234) + target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=3>") + else() + target_compile_options(PlatformCommonInternal INTERFACE "$<${is_optimized_build}:-D_FORTIFY_SOURCE=2>") endif() endif() +if(QT_FEATURE_trivial_auto_var_init_pattern) + target_compile_options(PlatformCommonInternal INTERFACE -ftrivial-auto-var-init=pattern) +endif() + +if(QT_FEATURE_stack_protector) + target_compile_options(PlatformCommonInternal INTERFACE -fstack-protector-strong) +endif() + +if(QT_FEATURE_stack_clash_protection) + target_compile_options(PlatformCommonInternal INTERFACE -fstack-clash-protection) +endif() + +if(QT_FEATURE_libstdcpp_assertions) + target_compile_definitions(PlatformCommonInternal INTERFACE _GLIBCXX_ASSERTIONS) +endif() + +if(QT_FEATURE_libcpp_hardening) + target_compile_definitions(PlatformCommonInternal INTERFACE -D_LIBCPP_HARDENING_MODE="$<IF:$<CONFIG:Debug>,_LIBCPP_HARDENING_MODE_EXTENSIVE,_LIBCPP_HARDENING_MODE_FAST>") +endif() + +if(QT_FEATURE_relro_now_linker) + qt_internal_platform_link_options(PlatformCommonInternal INTERFACE "-Wl,-z,relro,-z,now") +endif() + + if(QT_FEATURE_force_asserts) target_compile_definitions(PlatformCommonInternal INTERFACE QT_FORCE_ASSERTS) endif() diff --git a/config_help.txt b/config_help.txt index c6273a53f7..a5f8cd62df 100644 --- a/config_help.txt +++ b/config_help.txt @@ -138,7 +138,16 @@ Build options: -pch ................. Use precompiled headers [auto] -ltcg ................ Use Link Time Code Generation [no] - -intelcet ............ Use Intel Control-flow Enforcement Technology [no] + -intelcet ............ Use Intel Control-flow Enforcement Technology [auto] + -glibc-fortify-source Use Glibc function fortification [auto] + -trivial-auto-var-init-pattern + Use -ftrivial-auto-var-init=pattern [auto] + -stack-protector ..... Use -fstack-protector-strong [auto] + -stack-clash-protection + Use -fstack-clash-protection [auto] + -libstdcpp-assertions Use libstdc++ assertions [auto] + -libcpp-hardening .... Use libc++ hardening [auto] + -relro-now-linker .... Use -z relro -z now when linking [auto] -linker [bfd,gold,lld,mold] Force use of the GNU ld, GNU gold, LLVM/LLD or mold linker instead of default one (GCC and clang only) diff --git a/configure.cmake b/configure.cmake index 74ea2133f0..caa1366ea2 100644 --- a/configure.cmake +++ b/configure.cmake @@ -211,6 +211,28 @@ endif() # machineTuple qt_config_compile_test_machine_tuple("machine tuple") +# glibc +qt_config_compile_test(glibc + LABEL "Using Glibc" + CODE +"#include <features.h> +#ifndef __GLIBC__ +#error +#endif +int main() {}" +) + +# glibc 2.34, for _FORTIFY_SOURCE == 3 +qt_config_compile_test(glibc_234 + LABEL "Using Glibc >= 2.34" + CODE +"#include <features.h> +#if !defined(__GLIBC__) || !__GLIBC_PREREQ(2, 34) +#error +#endif +int main() {}" +) + # cxx20 qt_config_compile_test(cxx20 LABEL "C++20 support" @@ -398,29 +420,40 @@ alloca(1); ") # stack_protector -qt_config_compile_test(stack_protector - LABEL "stack protection" - COMPILE_OPTIONS -fstack-protector-strong - CODE -"#ifdef __QNXNTO__ -# include <sys/neutrino.h> -# if _NTO_VERSION < 700 -# error stack-protector not used (by default) before QNX 7.0.0. -# endif -#endif +if(NOT WASM) + # emcc doesn't support this, but the detection accidentally succeeds + # https://github.com/emscripten-core/emscripten/issues/17030 + qt_config_compiler_supports_flag_test(stack_protector + LABEL "stack protection" + FLAG "-fstack-protector-strong" + ) +endif() -int main(void) -{ - /* BEGIN TEST: */ - /* END TEST: */ - return 0; -} -") +# stack_clash_protection +if(NOT CLANG) # https://gitlab.kitware.com/cmake/cmake/-/issues/21998 + qt_config_compiler_supports_flag_test(stack_clash_protection + LABEL "-fstack-clash-protection support" + FLAG "-fstack-clash-protection" + ) +endif() + +# trivial_auto_var_init_pattern +qt_config_compiler_supports_flag_test(trivial_auto_var_init_pattern + LABEL "-ftrivial-auto-var-init=pattern support" + FLAG "-ftrivial-auto-var-init=pattern" +) # intelcet -qt_config_compile_test(intelcet - LABEL "Support for Intel Control-flow Enforcement Technology (CET)" - CODE +if(MSVC) + qt_config_linker_supports_flag_test(intelcet + LABEL "Support for Intel Control-flow Enforcement Technology (CET)" + FLAG "-CETCOMPAT" + ) +else() + qt_config_compile_test(intelcet + LABEL "Support for Intel Control-flow Enforcement Technology (CET)" + COMPILE_OPTIONS -fcf-protection=full + CODE "int main(void) { /* BEGIN TEST: */ @@ -430,8 +463,35 @@ qt_config_compile_test(intelcet /* END TEST: */ return 0; } -") +" + ) +endif() +# -z relro -z now +if(NOT WIN32) + qt_config_linker_supports_flag_test(relro_now_linker + LABEL "Support for -z relro and -z now" + FLAG "-z,relro,-z,now" + ) +endif() + +# Is libc++ the default Standard Library? +qt_config_compile_test(using_stdlib_libcpp + LABEL "Compiler defaults to libc++" + CODE +" +#include <ciso646> + +int main(void) +{ +/* BEGIN TEST: */ +#ifndef _LIBCPP_VERSION +# error +#endif +/* END TEST: */ +} +" +) #### Features @@ -889,10 +949,6 @@ qt_feature("alloca" PRIVATE LABEL "alloca()" CONDITION QT_FEATURE_alloca_h OR QT_FEATURE_alloca_malloc_h OR TEST_alloca_stdlib_h ) -qt_feature("stack-protector-strong" PRIVATE - LABEL "stack protection" - CONDITION QNX AND TEST_stack_protector -) qt_feature("system-zlib" PRIVATE LABEL "Using system zlib" CONDITION WrapSystemZLIB_FOUND @@ -1056,10 +1112,56 @@ qt_feature("relocatable" PRIVATE AUTODETECT QT_FEATURE_shared CONDITION QT_FEATURE_dlopen OR WIN32 OR NOT QT_FEATURE_shared ) +# hardening features qt_feature("intelcet" PRIVATE - LABEL "Using Intel CET" - CONDITION ( INPUT_intelcet STREQUAL yes ) OR TEST_intelcet + LABEL "Using Intel Control-flow Enforcement Technology (CET)" + AUTODETECT ON + CONDITION TEST_intelcet ) +qt_feature_config("intelcet" QMAKE_PUBLIC_CONFIG) +qt_feature("glibc_fortify_source" PRIVATE + LABEL "Using Glibc function fortification" + AUTODETECT ON + CONDITION TEST_glibc +) +qt_feature_config("glibc_fortify_source" QMAKE_PUBLIC_CONFIG) +qt_feature("trivial_auto_var_init_pattern" PRIVATE + LABEL "Using -ftrivial-auto-var-init=pattern" + AUTODETECT ON + CONDITION TEST_trivial_auto_var_init_pattern +) +qt_feature_config("trivial_auto_var_init_pattern" QMAKE_PUBLIC_CONFIG) +qt_feature("stack_protector" PRIVATE + LABEL "Using -fstack-protector-strong" + AUTODETECT ON + CONDITION TEST_stack_protector +) +qt_feature_config("stack_protector" QMAKE_PUBLIC_CONFIG) +qt_feature("stack_clash_protection" PRIVATE + LABEL "Using -fstack-clash-protection" + AUTODETECT ON + CONDITION TEST_stack_clash_protection +) +qt_feature_config("stack_clash_protection" QMAKE_PUBLIC_CONFIG) +qt_feature("libstdcpp_assertions" PRIVATE + LABEL "Using libstdc++ assertions" + AUTODETECT ON + CONDITION (GCC OR (CLANG AND NOT MSVC AND NOT QT_FEATURE_stdlib_libcpp AND NOT TEST_using_stdlib_libcpp)) +) +qt_feature_config("libstdcpp_assertions" QMAKE_PUBLIC_CONFIG) +qt_feature("libcpp_hardening" PRIVATE + LABEL "Using libc++ hardening" + AUTODETECT ON + CONDITION (QT_FEATURE_stdlib_libcpp OR TEST_using_stdlib_libcpp) +) +qt_feature_config("libcpp_hardening" QMAKE_PUBLIC_CONFIG) +qt_feature("relro_now_linker" PRIVATE + LABEL "Using -z relro -z now when linking" + AUTODETECT ON + CONDITION TEST_relro_now_linker +) +qt_feature_config("relro_now_linker" QMAKE_PUBLIC_CONFIG) + if("${INPUT_coverage}" STREQUAL "gcov") qt_config_compile_test(gcov @@ -1137,6 +1239,13 @@ qt_configure_add_summary_entry(ARGS "relocatable") qt_configure_add_summary_entry(ARGS "precompile_header") qt_configure_add_summary_entry(ARGS "ltcg") qt_configure_add_summary_entry(ARGS "intelcet") +qt_configure_add_summary_entry(ARGS "glibc_fortify_source") +qt_configure_add_summary_entry(ARGS "trivial_auto_var_init_pattern") +qt_configure_add_summary_entry(ARGS "stack_protector") +qt_configure_add_summary_entry(ARGS "stack_clash_protection") +qt_configure_add_summary_entry(ARGS "libstdcpp_assertions") +qt_configure_add_summary_entry(ARGS "libcpp_hardening") +qt_configure_add_summary_entry(ARGS "relro_now_linker") qt_configure_add_summary_entry( ARGS "wasm-simd128" CONDITION ( TEST_architecture_arch STREQUAL wasm ) diff --git a/qt_cmdline.cmake b/qt_cmdline.cmake index fdf22561e7..a01ad054c4 100644 --- a/qt_cmdline.cmake +++ b/qt_cmdline.cmake @@ -76,6 +76,13 @@ qt_commandline_option(openssl-runtime TYPE void NAME openssl VALUE runtime) qt_commandline_option(linker TYPE optionalString VALUES bfd gold lld mold) qt_commandline_option(ltcg TYPE boolean) qt_commandline_option(intelcet TYPE boolean) +qt_commandline_option(glibc_fortify_source TYPE boolean) +qt_commandline_option(trivial_auto_var_init_pattern TYPE boolean) +qt_commandline_option(stack_protector TYPE boolean) +qt_commandline_option(stack_clash_protection TYPE boolean) +qt_commandline_option(libstdcpp_assertions TYPE boolean) +qt_commandline_option(libcpp_hardening TYPE boolean) +qt_commandline_option(relro_now_linker TYPE boolean) qt_commandline_option(make TYPE addString VALUES examples libs tests tools benchmarks manual-tests minimal-static-tests) qt_commandline_option(install-examples-sources TYPE boolean) |