package/checksec: new package

From: Paresh Chaudhary <[email protected]>

This patch adds host-checksec package support. This tool provides a script to offline check the properties of a security hardened elf file.

REF: https://github.com/slimm609/checksec.sh

---
Changes

v1 -> v3
[Thomas
- Cleaned up patch language
- Clarified in the kconfig help which parts of checksec are valid when running offline
- Added full path to script install dst

---
 package/Config.in.host                             |  1 +
 ...1-checksec-Fixed-issue-with-relative-path.patch | 43 ++++++++++++++++++++++
 package/checksec/Config.in.host                    | 17 +++++++++
 package/checksec/checksec.hash                     |  3 ++
 package/checksec/checksec.mk                       | 16 ++++++++
 5 files changed, 80 insertions(+)
 create mode 100644 package/checksec/0001-checksec-Fixed-issue-with-relative-path.patch
 create mode 100644 package/checksec/Config.in.host
 create mode 100644 package/checksec/checksec.hash
 create mode 100644 package/checksec/checksec.mk

index 7838ffc..0c21b11 100644
@@ -5,6 +5,7 @@ menu "Host utilities"
 	source "package/cargo/Config.in.host"
 	source "package/cbootimage/Config.in.host"
 	source "package/checkpolicy/Config.in.host"
+	source "package/checksec/Config.in.host"
 	source "package/cmake/Config.in.host"
 	source "package/cramfs/Config.in.host"
 	source "package/cryptsetup/Config.in.host"

new file mode 100644
index 0000000..e4e8903
@@ -0,0 +1,17 @@
+config BR2_PACKAGE_HOST_CHECKSEC
+	bool "host checksec"
+	help
+	  This tool provides a shell script to check the
+	  properties of executables
+	  (PIE,RELRO,Stack Canaries,Fortify Source).
+	  It also has a kernel test mode that can run on target
+	  for testing of PaX, ASLR, heap and config hardening.
+
+	  NOTE: when using this tool as a host tool, the tool
+	  can offline check a target folder of elf files for
+	  hardening features enabled in those elf files.  There
+	  are other features of this tool, like the kernel test
+	  feature that are not functional offline, but require the
+	  user to execute in a chroot or on target.
+
+	  https://github.com/slimm609/checksec.sh.git

new file mode 100644
index 0000000..e3d1ffd
@@ -0,0 +1,3 @@
+# Locally calculated
+sha256 510b0b0528f15d0bf13fa1ae7140d2b9fc9261323c98ff76c011bef475a69c14 checksec-cdefe53eb72e6e8f23308417d2fc6b68cba9dbac.tar.gz
+sha256 c5e2a8e188040fc34eb9362084778a2e25f8d1f888e47a2be09efa7cecd9c70d LICENSE.txt

new file mode 100644
index 0000000..bfe54c2
@@ -0,0 +1,16 @@
+################################################################################
+#
+# checksec
+#
+################################################################################
+
+CHECKSEC_VERSION = cdefe53eb72e6e8f23308417d2fc6b68cba9dbac
+CHECKSEC_SITE = $(call github,slimm609,checksec.sh,$(CHECKSEC_VERSION))
+CHECKSEC_LICENSE = BSD-3-Clause
+CHECKSEC_LICENSE_FILES = LICENSE.txt
+
+define HOST_CHECKSEC_INSTALL_CMDS
+	$(INSTALL) -D -m 0755 $(@D)/checksec $(HOST_DIR)/bin/checksec
+endef
+
+$(eval $(host-generic-package))

1.9.1

Catch the commonly used options of SSP, Relro, and fortify.

---
Changes
v3 -> v4
- Removed commented out lines I missed when I removed busybox
- Removed duplicate fortify assertion test

v2 -> v3
[Matt
- Removed the busybox target as without the link time wrapper/specfile being merged the build will fail. Link time conflict between use of 'r' and pie.

[Thomas
- Add clarificaion of what checksec can test
- Reworked using inheritance
- Relocated json load (removed duplication)

v1 -> v2
[Ricardo
- Fix flake8 warnings
- Added missing busyfox pie assertions
- Updated the yml to include new test cases

foofa

---
 .gitlab-ci.yml                               |   6 ++
 support/testing/tests/core/test_hardening.py | 109 +++++++++++++++++++++++++++
 2 files changed, 115 insertions(+)
 create mode 100644 support/testing/tests/core/test_hardening.py

index 3fc9b06..c271c05 100644
@@ -261,6 +261,12 @@ zynqmp_zcu106_defconfig: *defconfig
 tests.boot.test_atf.TestATFAllwinner: *runtime_test
 tests.boot.test_atf.TestATFMarvell: *runtime_test
 tests.boot.test_atf.TestATFVexpress: *runtime_test
+tests.core.test_hardening.TestFortifyConserv: *runtime_test
+tests.core.test_hardening.TestFortifyNone: *runtime_test
+tests.core.test_hardening.TestRelro: *runtime_test
+tests.core.test_hardening.TestRelroPartial: *runtime_test
+tests.core.test_hardening.TestSspNone: *runtime_test
+tests.core.test_hardening.TestSspStrong: *runtime_test
 tests.core.test_post_scripts.TestPostScripts: *runtime_test
 tests.core.test_rootfs_overlay.TestRootfsOverlay: *runtime_test
 tests.core.test_timezone.TestGlibcAllTimezone: *runtime_test

1.9.1

Hello,

I can't really apply this one currently, because it depends on the wrapper stuff I believe. Indeed the TestRelro test fails to build with:

/home/thomas/projets/outputs/TestRelro/host/opt/ext-toolchain/bin/../lib/gcc/powerpc64-buildroot-linux-gnu/6.4.0/../../../../powerpc64-buildroot-linux-gnu/bin/ld: -r and -pie may not be used together
collect2: error: ld returned 1 exit status
make[3]: *** [scripts/Makefile.build:264: applets/built-in.o] Error 1
make[2]: *** [Makefile:372: applets_dir] Error 2
make[1]: *** [package/pkg-generic.mk:232: /home/thomas/projets/outputs/TestRelro/build/busybox-1.29.1/.stamp_built]
Error 2

Best regards,

Thomas

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com

Thomas,

Ah true, I removed busybox from the elf files I test but didn't set the build configuration to not build busybox. It's probably not worth the time to fix this patch and instead to get the wrapper complete. I'll continue on the wrapper tonight and see where I get.

Matt

Hello,

The entry to the DEVELOPERS file was missing. I added it, with both your name and Paresh's name.

Applied to next with this change, thanks!

Thomas

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com