Use checksec for auditing artifacts

[noloader]

Is your feature request related to a problem? Please describe. I think Zstd might be able to benefit from Checksec. Checksec is a tool to examine output artifacts for hardening, like relro and nxstacks. Checksec was originally written by a fellow named Tobias Klein. Another fellow forked it and put it on GitHub after Klein ran out of spare cycles to maintain it. The one I use nowadays is at https://github.com/slimm609/checksec.sh.

Describe the solution you'd like After make is run, examine the output artifacts for hardening, like relro and nxstacks. If you don't see them, then there's an opportunity for improvement in the build process. That is, there are some flags that can be applied but may be missing. Missing flags can include CFLAGS += -fstack-protector-strong and LDFLAGS += -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack. And output programs like zstd should probably use -fPIC and -fpie for ASLR.

Describe alternatives you've considered None really. Leaving output artifacts unhardened is the old way of doing things. It is playing with fire nowadays.

Additional context Let me show you what it might look like.

cd zstd-1.5.1

wget -O checksec https://raw.githubusercontent.com/slimm609/checksec.sh/master/checksec
chmod +x checksec

make
...

./audit-zstd.sh 
****************************************
./lib/obj/conf_03191427055b63abb996cb13948f877b/dynamic/libzstd.so.1.5.1:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILE
Full RELRO      No canary found   NX enabled    DSO             No RPATH   RW-RUNPATH   1136) Symbols	  No	0		4		./lib/obj/conf_03191427055b63abb996cb13948f877b/dynamic/libzstd.so.1.5.1
****************************************
./lib/libzstd.so.1.5.1:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILE
Full RELRO      No canary found   NX enabled    DSO             No RPATH   RW-RUNPATH   1136) Symbols	  No	0		4		./lib/libzstd.so.1.5.1
****************************************
./programs/obj/conf_29d7c58f592486d72c632f830214ae44/zstd:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILE
Full RELRO      No canary found   NX enabled    No PIE          No RPATH   RW-RUNPATH   1439) Symbols	  No	0		8		./programs/obj/conf_29d7c58f592486d72c632f830214ae44/zstd
****************************************
./programs/zstd:

RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH	Symbols		FORTIFY	Fortified	Fortifiable	FILE
Full RELRO      No canary found   NX enabled    No PIE          No RPATH   RW-RUNPATH   1439) Symbols	  No	0		8		./programs/zstd
****************************************

As you can see, some hardening is present, like full relro (due to my LDFLAGS) and nxstacks (due to my ASFLAGS and LDFLAGS). But some other hardening appears to be missing, like fortified sources.

Here's the script I used for the audit:

cat audit-zstd.sh
#!/usr/bin/env bash

IFS= find "." -type f -name '*' -print | while read -r file
do
    if [[ ! $(file -ibh "${file}" | grep -E 'application/x-sharedlib|application/x-executable') ]]; then continue; fi

    echo "****************************************"
    echo "${file}:"
    echo ""

    ./checksec --file="${file}"

done
echo "****************************************"

And things only get worse on the BSDs. The BSD are legendary for their security, but they often lack flags applied by default by Debian and Red Hat.

Note that we have to use checksec because the Binutil folks don't provide us with an auditelf program to do this for us. I'd much rather have a program from Binutils to do this. (And I know Checksec has some gaps, but it will have to do for the moment).

If you don't mind me saying, Facebook should be auditing forward facing binaries like this. In US Financial this is often a security gate I put in place. If a program is going to opening a listening socket, then it must be hardened or it does not get released to production.