Lessons Learned Applying Compiletime Hardening Options for Security-Critical Program Binary in Linux
summary
Rebuilds 159 high-priority Debian binaries (setuid/setgid and network services) with safe stack and CFI enabled, hitting ~86–93% success for services and ~90%+ for setuid/setgid; main failures come from C++/Clang incompatibilities, legacy assembly (RDSEED/RDRAND register clobbers), and widespread C callback type mismatches that trigger CFI faults. Solutions include linker flags, Clang as CC, and using a sanitizer blacklist to suppress 52 CFI and 74 safe-stack test failures so hardened .deb packages are produced.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:33Why Compile-time Hardening is important?
- 2:39Control Flow Hijacking
- 4:41Mitigation Techniques
- 11:21The Concept of LLVM SafeStack
- 12:37LLVM CFI
- 16:47Security-Critical Program Binary
- 18:58Rebuilding with Safestack and CFI
- 20:20Rebuilding for Systemd Package
- 29:53Checking security status of Systemd
- 30:38Rebuilding for Target Packages
- 31:43Rebuilding for Service
- 32:50Rebuilding for setuid/setgid
- 33:28Lessons Leamed
- 36:35Conclusion
related talks
52mKernel Hardening: Ten Years Deep
50mSecure development with C++ - Lessons and techniques
35mUpstream Kernel Hardening: Recent Progress and Challenges
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
34mMaking C Less Dangerous
59mHardening Your Code
48mSecure C++ Programming
42mDefending the Branch: PAC, BTI & GCS on Linux