From 128eb5af3c0373972b67868bdc544dbc0ad0039a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 Subject: [PATCH] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The expr comparison is performing a string comparison and is thus broken for any GCC version >= 10, preventing use of -fstack-protector-strong Since GCC 4.9 was released almost 10 years ago (Aug 2016), it is reasonable to drop the conditional check and assume -fstack-protector-strong is always available for GCC. A number of equivalent changes tht assume -fstack-protector-strong were also already made in commit 8814a5e2b1f1cadf6d6764e70b5bbd84a8c56dc8 Author: aplatasz Date: Wed Jan 21 09:58:00 2026 +0100 Security related flags added Signed-off-by: Daniel P. Berrangé --- QuoteVerification/dcap_tvl/Makefile.standalone | 7 +------ SampleCode/QuoteAppraisalSample/QAEAppraisal/Makefile | 8 +------- SampleCode/QuoteGenerationSample/Makefile | 7 +------ SampleCode/QuoteVerificationSample/Makefile | 8 +------- ae/qae/Makefile | 7 +------ 5 files changed, 5 insertions(+), 32 deletions(-) diff --git a/QuoteVerification/dcap_tvl/Makefile.standalone b/QuoteVerification/dcap_tvl/Makefile.standalone index 8e98c329..b8818b90 100644 --- a/QuoteVerification/dcap_tvl/Makefile.standalone +++ b/QuoteVerification/dcap_tvl/Makefile.standalone @@ -45,12 +45,7 @@ COMMON_LDFLAGS := -Wl,-z,relro,-z,now,-z,noexecstack ifneq ($(DEBUG), 1) COMMON_FLAGS += -ffunction-sections -fdata-sections endif -CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9") -ifeq ($(CC_BELOW_4_9), 1) - COMMON_FLAGS += -fstack-protector -else - COMMON_FLAGS += -fstack-protector-strong -endif +COMMON_FLAGS += -fstack-protector-strong ENCLAVE_CFLAGS = -ffreestanding -nostdinc -fvisibility=hidden -fpie -fno-strict-overflow -fno-delete-null-pointer-checks ENCLAVE_CXXFLAGS = $(ENCLAVE_CFLAGS) -nostdinc++ diff --git a/SampleCode/QuoteAppraisalSample/QAEAppraisal/Makefile b/SampleCode/QuoteAppraisalSample/QAEAppraisal/Makefile index 662ac3e5..868d72df 100644 --- a/SampleCode/QuoteAppraisalSample/QAEAppraisal/Makefile +++ b/SampleCode/QuoteAppraisalSample/QAEAppraisal/Makefile @@ -87,13 +87,7 @@ Crypto_Library_Name := sgx_tcrypto Enclave_Cpp_Files := Enclave/Enclave.cpp Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS) -CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9") -ifeq ($(CC_BELOW_4_9), 1) - Enclave_C_Flags += -fstack-protector -else - Enclave_C_Flags += -fstack-protector-strong -endif +Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS) -fstack-protector-strong Enclave_Cpp_Flags := $(Enclave_C_Flags) -std=c++11 -nostdinc++ diff --git a/SampleCode/QuoteGenerationSample/Makefile b/SampleCode/QuoteGenerationSample/Makefile index 06a36813..0cb0baf8 100644 --- a/SampleCode/QuoteGenerationSample/Makefile +++ b/SampleCode/QuoteGenerationSample/Makefile @@ -108,12 +108,7 @@ Crypto_Library_Name := sgx_tcrypto Enclave_Cpp_Files := Enclave/Enclave.cpp Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9") -ifeq ($(CC_BELOW_4_9), 1) - Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector -else - Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong -endif +Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections Enclave_C_Flags += $(Enclave_Include_Paths) Enclave_Cpp_Flags := $(Enclave_C_Flags) -std=c++11 -nostdinc++ diff --git a/SampleCode/QuoteVerificationSample/Makefile b/SampleCode/QuoteVerificationSample/Makefile index ed099c7c..59a10981 100644 --- a/SampleCode/QuoteVerificationSample/Makefile +++ b/SampleCode/QuoteVerificationSample/Makefile @@ -105,13 +105,7 @@ DCAP_DIR ?= ../../ Enclave_Cpp_Files := Enclave/Enclave.cpp Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9") -ifeq ($(CC_BELOW_4_9), 1) - Enclave_C_Flags += -fstack-protector -else - Enclave_C_Flags += -fstack-protector-strong -endif +Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++ diff --git a/ae/qae/Makefile b/ae/qae/Makefile index 715f365a..6a2b23b7 100644 --- a/ae/qae/Makefile +++ b/ae/qae/Makefile @@ -54,12 +54,7 @@ Enclave_Include_Paths := -I./ -I$(WARM_Top_Path)/core/iwasm/include \ -I$(DCAP_QV_DIR)/appraisal/common \ -I$(DCAP_QG_DIR)/common/inc/internal -CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9") -ifeq ($(CC_BELOW_4_9), 1) - Enclave_Common_Flags := -fstack-protector -else - Enclave_Common_Flags := -fstack-protector-strong -endif +Enclave_Common_Flags := -fstack-protector-strong Enclave_Common_Flags += -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) Enclave_Common_Flags += -DPICOJSON_USE_LOCALE=0 -DBUILD_QAE -DSGX_JWT