Enable DEP and HEASLR for mingw-w64 build
AbandonedPublic

Authored by alvinhochun on Oct 30 2016, 4:02 PM.

Details

Summary

Enable DEP (NX) and high-entropy ASLR by default for the mingw-w64 build.
These flags increases the security of the executables.

This doesn't affect the 3rdparty dependencies therefore they won't have
HEASLR enabled automatically.

References: T3917

Diff Detail

Repository
R37 Krita
Lint
Lint Skipped
Unit
Unit Tests Skipped
alvinhochun updated this revision to Diff 7759.Oct 30 2016, 4:02 PM
alvinhochun retitled this revision from to Enable DEP and HEASLR for mingw-w64 build.
alvinhochun updated this object.
alvinhochun edited the test plan for this revision. (Show Details)
alvinhochun added a reviewer: rempt.
alvinhochun set the repository for this revision to R37 Krita.
gladhorn edited edge metadata.Oct 30 2016, 8:38 PM

Seems like a really good addition! Maybe check that 32 bit builds work if they're considered relevant.

CMakeLists.txt
152

Does this only work with 64 bit? From the random bits of documentation I find, it looks like 32 bit works also (mingw-w64). If not it probably needs another if for the arcitecture being 64 bit.
Looks like mingw-w64 is the 32 bit thing too, that always confuses me. So looks good to me, assuming the --image-base,0x140000000 works on 32 bit.

alvinhochun edited edge metadata.

Yeah I didn't actually think about the x86 build when I submitted this. I also made a mistake by using list(APPEND) instead of just setting the plain variable.

This should be better.

High-entropy ASLR isn't actually a thing on x86 since there's only a 4GB virtual address space (or is it only 2GB that actually get used?)

I think list(APPEND ...) was good. Looks fine, neither of the inline comments is crucial.

CMakeLists.txt
12

From looking around

if (CMAKE_SIZEOF_VOID_P EQUAL 8)

would also work. I have no real preference since I never know if there should be ${} or not. Seems like in if statements there're mostly not needed.

16

My understanding is that list(APPEND ... ) is preferred since it's faster. Both do the same.

alvinhochun marked an inline comment as done.Oct 31 2016, 10:32 AM

I think list(APPEND ...) was good. Looks fine, neither of the inline comments is crucial.

if (CMAKE_SIZEOF_VOID_P EQUAL 8) should work, I can change that.

list(APPEND ... ) uses semicolon as delimiter though, caught that when I tried to add more flags with a second one :P

alvinhochun abandoned this revision.Oct 31 2016, 11:11 AM