Skip to content

Commit

Permalink
Rollup merge of #111722 - mrcnski:stack-protector-doc, r=rcvalle
Browse files Browse the repository at this point in the history
Document stack-protector option

Only updated `exploit-mitigations.md` to reflect that the option exists. Removed the alternatives mentioned as they are not actually implemented yet.

As this is an unstable feature, should it be added to `unstable-book` also? [Example](https://doc.rust-lang.org/beta/unstable-book/compiler-flags/sanitizer.html). I didn't do that because I couldn't find the tracking issue for stack-protector. (There should be one to track stabilization of the feature, I think?)

cc `@rcvalle`
  • Loading branch information
matthiaskrgr committed May 23, 2023
2 parents 221039b + a4d6d9a commit ee08dd8
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 8 deletions.
17 changes: 9 additions & 8 deletions src/doc/rustc/src/exploit-mitigations.md
Original file line number Diff line number Diff line change
Expand Up @@ -115,9 +115,9 @@ equivalent.
<tr>
<td>Stack smashing protection
</td>
<td>No
<td>Yes
</td>
<td>
<td>Nightly
</td>
</tr>
<tr>
Expand Down Expand Up @@ -432,18 +432,16 @@ saved return instruction pointer, and checking if this value has changed
when returning from a function. This is also known as “Stack Protector” or
“Stack Smashing Protector (SSP)”.

The Rust compiler does not support stack smashing protection. However, more
comprehensive alternatives to stack smashing protection exist, such as
shadow and safe stack (see backward-edge control flow protection).
The Rust compiler supports stack smashing protection on nightly builds[42].

![Screenshot of IDA Pro listing cross references to __stack_chk_fail in hello-rust.](images/image3.png "Cross references to __stack_chk_fail in hello-rust.")
Fig. 14. IDA Pro listing cross references to `__stack_chk_fail` in
hello-rust.

To check if stack smashing protection is enabled for a given binary, search
for cross references to `__stack_chk_fail`. The only cross references to
`__stack_chk_fail` in hello-rust are from the statically-linked libbacktrace
library (see Fig. 14).
for cross references to `__stack_chk_fail`. The presence of these
cross-references in Rust-compiled code (e.g., `hello_rust::main`) indicates
that the stack smashing protection is enabled (see Fig. 14).


### Forward-edge control flow protection
Expand Down Expand Up @@ -697,3 +695,6 @@ defaults (unrelated to `READ_IMPLIES_EXEC`).

41. “ControlFlowIntegrity.” The Rust Unstable Book.
[https://doc.rust-lang.org/unstable-book/compiler-flags/sanitizer.html#controlflowintegrity](../unstable-book/compiler-flags/sanitizer.html#controlflowintegrity).

42. bbjornse. “add codegen option for using LLVM stack smash protection #84197.”
GitHub. <https://github.com/rust-lang/rust/pull/84197>
Binary file modified src/doc/rustc/src/images/image3.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit ee08dd8

Please sign in to comment.