Bug 1716024 p2: Flag all binaries apart from firefox, xpcshell and plugin-container as CET compatible. r=glandium
authorBob Owen <bobowencode@gmail.com>
Mon, 19 Jul 2021 07:36:19 +0000
changeset 585905 181a2776e2655857ca03904170fd9cd59cfe80d7
parent 585904 4c5225386044d1a351bcb55949b9ae44ecd71933
child 585906 7aab3ebb7aa78a3ce17cbdbc2c03caac43f91a58
push id38623
push userabutkovits@mozilla.com
push dateMon, 19 Jul 2021 15:46:04 +0000
treeherdermozilla-central@86d0c64032ca [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersglandium
bugs1716024
milestone92.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1716024 p2: Flag all binaries apart from firefox, xpcshell and plugin-container as CET compatible. r=glandium We will only run the processes in CET compatible modules only mode when not using the JIT code. So marking xul.dll as compatible should be OK. Differential Revision: https://phabricator.services.mozilla.com/D117551
browser/app/moz.build
build/moz.configure/toolchain.configure
ipc/app/moz.build
js/xpconnect/shell/moz.build
python/mozbuild/mozbuild/frontend/context.py
--- a/browser/app/moz.build
+++ b/browser/app/moz.build
@@ -89,16 +89,20 @@ if CONFIG["OS_ARCH"] == "WINNT":
         libpath_flag = "-LIBPATH:"
     else:
         libpath_flag = "-L"
 
     WIN32_EXE_LDFLAGS += [
         libpath_flag + OBJDIR + "/winlauncher/freestanding",
     ]
 
+    # Don't build firefox.exe with CETCOMPAT, because we need to be able to
+    # only enable it for processes that are not using JIT in xul.dll.
+    LINK_FLAGS["CETCOMPAT"] = []
+
 if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "Darwin":
     USE_LIBS += [
         "mozsandbox",
     ]
 
 if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_ARCH"] == "WINNT":
     # For sandbox includes and the include dependencies those have
     LOCAL_INCLUDES += [
--- a/build/moz.configure/toolchain.configure
+++ b/build/moz.configure/toolchain.configure
@@ -1942,16 +1942,34 @@ def security_hardening_cflags(
 
 
 set_config("MOZ_HARDENING_CFLAGS", security_hardening_cflags.flags)
 set_config("MOZ_HARDENING_LDFLAGS", security_hardening_cflags.ldflags)
 set_config("MOZ_HARDENING_CFLAGS_JS", security_hardening_cflags.js_flags)
 set_config("MOZ_HARDENING_LDFLAGS_JS", security_hardening_cflags.js_ldflags)
 
 
+# Intel Control-flow Enforcement Technology
+# ==============================================================
+# We keep this separate from the hardening flags above, because we want to be
+# able to easily remove the flags in the build files for certain executables.
+@depends(c_compiler, target)
+def cet_ldflags(c_compiler, target):
+    ldflags = []
+    if (
+        c_compiler.type == "clang-cl"
+        and c_compiler.version >= "11"
+        and target.cpu == "x86_64"
+    ):
+        ldflags.append("-CETCOMPAT")
+    return ldflags
+
+
+set_config("MOZ_CETCOMPAT_LDFLAGS", cet_ldflags)
+
 # Frame pointers
 # ==============================================================
 @depends(c_compiler)
 def frame_pointer_flags(compiler):
     if compiler.type == "clang-cl":
         return namespace(
             enable=["-Oy-"],
             disable=["-Oy"],
--- a/ipc/app/moz.build
+++ b/ipc/app/moz.build
@@ -52,16 +52,20 @@ if CONFIG["OS_ARCH"] == "WINNT":
     OS_LIBS += [
         "ntdll",
     ]
 
     DELAYLOAD_DLLS += [
         "xul.dll",
     ]
 
+    # Don't build plugin-container.exe with CETCOMPAT for the moment, so that
+    # we can enable it using a pref during testing.
+    LINK_FLAGS["CETCOMPAT"] = []
+
 if CONFIG["MOZ_SANDBOX"] and CONFIG["OS_TARGET"] == "Darwin":
     # For sandbox includes and the include dependencies those have
     LOCAL_INCLUDES += [
         "/security/sandbox/chromium",
         "/security/sandbox/chromium-shim",
     ]
     USE_LIBS += [
         "mozsandbox",
--- a/js/xpconnect/shell/moz.build
+++ b/js/xpconnect/shell/moz.build
@@ -54,11 +54,15 @@ if CONFIG["OS_ARCH"] == "WINNT":
     OS_LIBS += [
         "ntdll",
     ]
 
     DELAYLOAD_DLLS += [
         "xul.dll",
     ]
 
+    # Don't build xpcshell.exe with CETCOMPAT, because we need to be able to
+    # only enable it for processes that are not using JIT in xul.dll.
+    LINK_FLAGS["CETCOMPAT"] = []
+
 CFLAGS += CONFIG["TK_CFLAGS"]
 CXXFLAGS += CONFIG["TK_CFLAGS"]
 OS_LIBS += CONFIG["TK_LIBS"]
--- a/python/mozbuild/mozbuild/frontend/context.py
+++ b/python/mozbuild/mozbuild/frontend/context.py
@@ -460,16 +460,25 @@ class LinkFlags(BaseCompileFlags):
                 "OPTIMIZE",
                 (
                     context.config.substs.get("MOZ_OPTIMIZE_LDFLAGS", [])
                     if context.config.substs.get("MOZ_OPTIMIZE")
                     else []
                 ),
                 ("LDFLAGS",),
             ),
+            (
+                "CETCOMPAT",
+                (
+                    context.config.substs.get("MOZ_CETCOMPAT_LDFLAGS")
+                    if context.config.substs.get("NIGHTLY_BUILD")
+                    else []
+                ),
+                ("LDFLAGS",),
+            ),
         )
         BaseCompileFlags.__init__(self, context)
 
     def _os_ldflags(self):
         flags = self._context.config.substs.get("OS_LDFLAGS", [])[:]
 
         if self._context.config.substs.get(
             "MOZ_DEBUG"