[Starlingx-discuss] Recommended C/C++ compiler flag for security

[Victor Rodriguez]

Hi StarlingX community

We can all agree that security is an important feature to be taken
into consideration in any SW project. In the aim of improving the
security of the StarlingX project, we have been taking the task to
propose the use of some compiler flags that prevent and detect some
security holes, especially by buffer overflow that could lead into ROP
attacks.

The list of flags that we are proposing are :

Stack-based Buffer Overrun Detection:    CFLAGS=”-fstack-protector-strong”

Fortify source:                          CFLAGS="-O2 -D_FORTIFY_SOURCE=2"
Format string vulnerabilities:          CFLAGS="-Wformat -Wformat-security"
Stack execution protection:              LDFLAGS="-z noexecstack"
Data relocation and protection (RELRO): LDLFAGS="-z relro -z now"


These are being analyzed in the following Gerrit reviews (thanks a lot
for all the good feedback)

https://review.openstack.org/#/c/623608/
https://review.openstack.org/#/c/623603/
https://review.openstack.org/#/c/623601/
https://review.openstack.org/#/c/623599/

As requested in the Gerrit reviews, there is a proper need to first
understand what these compiler flags do and what is the impact they
have at the functional and performance area of the project. This is a
preliminary report, we will be following up with a test plan for
functional & performance test plans for the services as a next step.
This report includes:

* Detailed description of what the compiler flag does
* Code example that shows how does it work to prevent attacks
* If there is a change in the binary, we create a microbenchmark that
shows us how the flag impact the performance

https://github.com/VictorRodriguez/hobbies/tree/master/c_programing_exercises/cflags_security

As a result of the microbenchmark, the performance impact is not
relevant ( less than 1% ) using an Ubuntu x86 system ( GCC 5 ) (more
details on the HW and SW specification upon requests)

The areas of the code we are suggesting on the patches are:

* stx-ha
* stx-metal
* stx-nfv
* stx-fault

We do take care that these flags are not breaking the following areas
after being applied.

* Build process of the image
* Sanity test cases after the image is created
(Ada can give more details on the sanity report of the image generated
with these flags)

If running the sanity tests are not enough to prove that a change in
compiler flags do not affect functionality, please gave us the right
path to follow.

As mentioned before, this is a preliminary report, and that we will be
following up with a test plan for functional & performance test plans
for the services as a next step.

Hope this email helps to clarify some questions related to the flags
and start the follow-up discussion.

Regards

Victor Rodriguez