Skip to content

Add performance conscious hardening flags to linux targets #1166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jjhelmus merged 12 commits into from
Jul 9, 2026
+197 −13
Merged

Add performance conscious hardening flags to linux targets #1166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
5d81e91
add hardening flags to linux targets
jjhelmus Jun 25, 2026
973bf57
enable stack-clash protection on aarch64/x86-64 linux
jjhelmus Jun 25, 2026
4b6d8f0
validate ELF hardening properties in distributions
jjhelmus Jun 25, 2026
26601eb
do not disable PIE when applying BOLT
jjhelmus Jul 7, 2026
8bf0998
Revert "do not disable PIE when applying BOLT"
jjhelmus Jul 8, 2026
864daf2
use -fstack-protector rather than ...-strong
jjhelmus Jul 8, 2026
5e84e8b
do not require PIE
jjhelmus Jul 8, 2026
5b9fb1a
add ld-linux-aarch64.so.1 to allowed libraries
jjhelmus Jul 8, 2026
babdaf8
explicitly pass -pie on ppc64le to work around gcc bug
jjhelmus Jul 8, 2026
b7306d8
use D_FORTIFY_SOURCE=2 rather than 3
jjhelmus Jul 9, 2026
fd148fe
append U_FORTIFY_SOURCE in debug builds rather than removing
jjhelmus Jul 9, 2026
3d6ee52
override rather than remove stack hardenig flags
jjhelmus Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions cpython-unix/build-cpython.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,6 +729,9 @@ autoconf
# 3.12 and earlier)
CFLAGS_JIT="${CFLAGS}"

# JIT stencils should not inherit target-wide stack hardening flags.
CFLAGS_JIT+=" -fno-stack-protector -fno-stack-clash-protection"

Comment thread
jjhelmus marked this conversation as resolved.
# In 3.14+, the JIT compiler on x86-64 Linux uses a model that conflicts with `-fPIC`, so strip it
# from the flags. See:
# - https://github.com/python/cpython/issues/135690
Expand All @@ -743,6 +746,14 @@ CFLAGS=$CFLAGS CPPFLAGS=$CFLAGS CFLAGS_JIT=$CFLAGS_JIT LDFLAGS=$LDFLAGS \
# Supplement produced Makefile with our modifications.
cat ../Makefile.extra >> Makefile

# Debian's PPC64LE GCC 6 defaults to PIE but selects the non-PIE startup object unless -pie is
# passed explicitly. Add it only to LINKFORSHARED, which CPython uses when linking executables.
# See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81170.
# TODO(jjh)Remove when the ppc64le toolchain changes
if [[ "${TARGET_TRIPLE}" = "ppc64le-unknown-linux-gnu" ]]; then
printf '\nLINKFORSHARED += -pie\n' >> Makefile
fi

make -j "${NUM_CPUS}"
make -j "${NUM_CPUS}" sharedinstall DESTDIR="${ROOT}/out/python"
make -j "${NUM_CPUS}" install DESTDIR="${ROOT}/out/python"
Expand Down
5 changes: 5 additions & 0 deletions cpython-unix/build.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,11 @@ def add_target_env(env, build_platform, target_triple, build_env, build_options)
else:
raise Exception("unhandled build platform: %s" % build_platform)

if "debug" in build_options and "-linux-" in target_triple:
# Fortification requires optimization and is ineffective with debug's -O0. Keep this last
# so it overrides any configured fortification level.
extra_target_cflags.append("-U_FORTIFY_SOURCE")

env["EXTRA_HOST_CFLAGS"] = " ".join(extra_host_cflags)
env["EXTRA_HOST_LDFLAGS"] = " ".join(extra_host_ldflags)
env["EXTRA_TARGET_CFLAGS"] = " ".join(extra_target_cflags)
Expand Down
115 changes: 115 additions & 0 deletions cpython-unix/targets.yml
View file
Open in desktop
Comment thread
jjhelmus marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,11 @@ aarch64-unknown-linux-gnu:
target_cc: clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
- '-fvisibility=hidden'
# Enable frame pointers
- '-fno-omit-frame-pointer'
Expand All @@ -139,6 +144,8 @@ aarch64-unknown-linux-gnu:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -185,9 +192,16 @@ armv7-unknown-linux-gnueabi:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/arm-linux-gnueabi-gcc
target_cxx: /usr/bin/arm-linux-gnueabi-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -229,9 +243,16 @@ armv7-unknown-linux-gnueabihf:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/arm-linux-gnueabihf-gcc
target_cxx: /usr/bin/arm-linux-gnueabihf-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -273,9 +294,16 @@ loongarch64-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/loongarch64-linux-gnu-gcc
target_cxx: /usr/bin/loongarch64-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
- '-Wl,-z,max-page-size=0x10000'
needs:
- autoconf
Expand Down Expand Up @@ -318,9 +346,16 @@ mips-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/mips-linux-gnu-gcc
target_cxx: /usr/bin/mips-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -362,9 +397,16 @@ mipsel-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/mipsel-linux-gnu-gcc
target_cxx: /usr/bin/mipsel-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -406,9 +448,16 @@ ppc64le-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/powerpc64le-linux-gnu-gcc
target_cxx: /usr/bin/powerpc64le-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -450,9 +499,16 @@ riscv64-unknown-linux-gnu:
host_cxx: /usr/bin/x86_64-linux-gnu-g++
target_cc: /usr/bin/riscv64-linux-gnu-gcc
target_cxx: /usr/bin/riscv64-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -495,11 +551,17 @@ s390x-unknown-linux-gnu:
target_cc: /usr/bin/s390x-linux-gnu-gcc
target_cxx: /usr/bin/s390x-linux-gnu-g++
target_cflags:
# Hardening
- '-fstack-protector'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
# set the minimum compatibility level to z10 (released 2008)
- '-march=z10'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -598,6 +660,11 @@ x86_64-unknown-linux-gnu:
target_cc: clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
- '-fvisibility=hidden'
# Enable frame pointers
- '-fno-omit-frame-pointer'
Expand All @@ -607,6 +674,8 @@ x86_64-unknown-linux-gnu:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -650,6 +719,11 @@ x86_64_v2-unknown-linux-gnu:
target_cc: clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
- '-march=x86-64-v2'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -660,6 +734,8 @@ x86_64_v2-unknown-linux-gnu:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -703,6 +779,11 @@ x86_64_v3-unknown-linux-gnu:
target_cc: clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
- '-march=x86-64-v3'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -713,6 +794,8 @@ x86_64_v3-unknown-linux-gnu:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -756,6 +839,11 @@ x86_64_v4-unknown-linux-gnu:
target_cc: clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-U_FORTIFY_SOURCE'
- '-D_FORTIFY_SOURCE=2'
- '-march=x86-64-v4'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -766,6 +854,8 @@ x86_64_v4-unknown-linux-gnu:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -809,13 +899,18 @@ x86_64-unknown-linux-musl:
target_cc: musl-clang
target_cxx: clang++ # TODO: Explore a musl-clang++ shim?
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-fvisibility=hidden'
# Enable frame pointers
- '-fno-omit-frame-pointer'
- '-mno-omit-leaf-frame-pointer'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -859,6 +954,9 @@ x86_64_v2-unknown-linux-musl:
target_cc: musl-clang
target_cxx: clang++ # TODO: Explore a musl-clang++ shim?
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-march=x86-64-v2'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -867,6 +965,8 @@ x86_64_v2-unknown-linux-musl:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -910,6 +1010,9 @@ x86_64_v3-unknown-linux-musl:
target_cc: musl-clang
target_cxx: clang++ # TODO: Explore a musl-clang++ shim?
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-march=x86-64-v3'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -918,6 +1021,8 @@ x86_64_v3-unknown-linux-musl:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -961,6 +1066,9 @@ x86_64_v4-unknown-linux-musl:
target_cc: musl-clang
target_cxx: clang++ # TODO: Explore a musl-clang++ shim?
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-march=x86-64-v4'
- '-fvisibility=hidden'
# Enable frame pointers
Expand All @@ -969,6 +1077,8 @@ x86_64_v4-unknown-linux-musl:
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down Expand Up @@ -1016,13 +1126,18 @@ aarch64-unknown-linux-musl:
target_cc: musl-clang
target_cxx: clang++
target_cflags:
# Hardening
- '-fstack-protector'
- '-fstack-clash-protection'
- '-fvisibility=hidden'
# Enable frame pointers
- '-fno-omit-frame-pointer'
- '-mno-omit-leaf-frame-pointer'
target_ldflags:
# Hardening
- '-Wl,-z,noexecstack'
- '-Wl,-z,relro'
- '-Wl,-z,now'
needs:
- autoconf
- bdb
Expand Down
Loading
Loading