configure.ac: use executable hardening where available

Where available, enable stack smashing protection, fortify source,
no-strict-overflow, and read only relocations.

Many Linux distributions automatically enable most of these options.
They are no brainers. The difference introduced here is in asking for a
few more aggressive options. An option to disable the more aggressive
options is provided (--disable-hardening). When set, configure will fall
back to the default CFLAGS on the system - in many cases that will still
be hardened. There is no point in going further than that.

Options enabled are:

-fstack-protector-strong is a relatively new GCC-4.9 feature that is
supposed to give a better balance between performance and protection.
-all is considered too aggressive, but was used in Chromium and other
security critical systems until -strong became available. Follow their
lead and use -strong when possible. clang 6.0 supports -all but not
-strong.

_FORTIFY_SOURCE replaces certain unsafe C str* and mem* functions with
more robust equivalents when the compiler can determine the length of
the buffers involved.

-fno-strict-overflow instructs GCC to not make optimizations based on
the assumption that signed arithmetic will wrap around on overflow (e.g.
(short)0x7FFF + 1 == 0). This prevents the optimizer from doing some
unexpected things. Further improvements should trap signed overflows and
reduce the use of signed to refer to naturally unsigned quantities.

I did not set -fPIE (position independent executables). The critical
function of Open/LibreSSL is as a library, not an executable.

Tested on Ubuntu Linux 14.04.1 LTS, OS X 10.10.1 with "make check".

Signed-off-by: Jim Barlow <jim@purplerock.ca>

1 files changed, 62 insertions, 0 deletions

diff --git a/configure.ac b/configure.ac
index 9174a64..3d93d12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -74,6 +74,68 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[
 )
 AC_MSG_RESULT([CLANG])
 
+# We want to check for compiler flag support, but there is no way to make
+# clang's "argument unused" warning fatal.  So we invoke the compiler through a
+# wrapper script that greps for this message.
+saved_CC="$CC"
+saved_LD="$LD"
+flag_wrap="$srcdir/scripts/wrap-compiler-for-flag-check"
+CC="$flag_wrap $CC"
+LD="$flag_wrap $LD"
+
+AC_DEFUN([check_cflag],
+        [AX_CHECK_COMPILE_FLAG([$1], [$2], [$3], [-Werror $4])])
+AC_DEFUN([check_ldflag],
+        [AX_CHECK_LINK_FLAG([$1], [$2], [$3], [-Werror $4])])
+
+
+AC_ARG_ENABLE([hardening],
+        [AS_HELP_STRING([--disable-hardening], [Disable options to frustrate memory corruption exploits])],
+        [],
+        [enable_hardening=yes])
+
+HARDEN_CFLAGS=""
+HARDEN_LDFLAGS=""
+AS_IF([test "x$enable_hardening" == "xyes"], [
+        # Tell GCC to NOT optimize based on signed arithmetic overflow
+        check_cflag([-fno-strict-overflow], [HARDEN_CFLAGS="$HARDEN_CFLAGS -fno-strict-overflow"])
+
+        # _FORTIFY_SOURCE replaces builtin functions with safer versions.
+        check_cflag([-D_FORTIFY_SOURCE=2], 
+                [HARDEN_CFLAGS="$HARDEN_CFLAGS -D_FORTIFY_SOURCE=2"])
+
+        # Use stack-protector-strong if available; if not, fallback to stack-protector-all which
+        # is considered to be overkill
+        check_cflag([-fstack-protector-strong], 
+                [STACK_PROTECT="-fstack-protector-strong"],
+                check_cflag([-fstack-protector-all],
+                        [STACK_PROTECT="-fstack-protector-all"],
+                        [AC_MSG_ERROR([compiler does not support stack protection - use --disable-hardening to override if you understand the risks])]
+                )
+        )
+
+        check_ldflag([$STACK_PROTECT],
+                [HARDEN_CFLAGS="$HARDEN_CFLAGS $STACK_PROTECT"
+                 check_cflag([-Wstack-protector], [HARDEN_CFLAGS="$HARDEN_CFLAGS -Wstack-protector"],
+                        [], [$STACK_PROTECT])
+                ],
+                [AC_MSG_ERROR([compiler supports stack protection but linker does not])]
+        )
+
+        # Enable read only relocations
+        check_ldflag([-Wl,-z,relro],
+                [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,relro"
+        check_ldflag([-Wl,-z,now], [HARDEN_LDFLAGS="$HARDEN_LDFLAGS -Wl,-z,now"])])
+])
+
+# Restore CC, LD
+CC="$saved_CC"
+LD="$saved_LD"
+
+CFLAGS="$CFLAGS $HARDEN_CFLAGS"
+LDFLAGS="$LDFLAGS $HARDEN_LDFLAGS"
+
+# Removing the dependency on -Wno-pointer-sign should be a goal
 save_cflags="$CFLAGS"
 CFLAGS=-Wno-pointer-sign
 AC_MSG_CHECKING([whether CC supports -Wno-pointer-sign])