[go] cmd/go: reject cgo -sectcreate linker flags by default
2 views
Skip to first unread message
Gerrit Bot (Gerrit)
9:16 AM (13 hours ago) 9:16 AM
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Gerrit Bot has uploaded the change for review![]( "Open in Gerrit")
Commit message
cmd/go: reject cgo -sectcreate linker flags by default
The Darwin linker’s `-sectcreate` option reads a file and embeds its contents. Since the existing cgo linker allowlist accepts this option, a dependency can make `go build` read an arbitrary file available to the build process.
This change rejects `-Wl,-sectcreate,...` in package-provided `#cgo LDFLAGS` by default. Trusted uses can explicitly opt in with `CGO_LDFLAGS_ALLOW`, as with other rejected flags.
The script test verifies both default rejection and explicit opt-in.
Fixes #78750.
Tests:
- `go test cmd/go/... -short -count=1`
- `go test -race cmd/go/internal/work -count=1`
- `go test cmd/go -run '^TestScript/darwin_sectcreate_ldflag$' -count=20`
- `go vet cmd/go/internal/work`
Change-Id: I7654297888dc2f3c381ceed287c641fc9ea6f65d
GitHub-Last-Rev: bfc86b7fb61f953c32d0fc7ac179c91e4567ac75
GitHub-Pull-Request: golang/go#80491
Change diff
diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index be3f1a2..1938cde 100644
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -158,6 +158,8 @@
// On macOS this means the linker loads and executes the next argument.
// Have to exclude separately because -lfoo is allowed in general.
re(`-lto_library`),
+ // On macOS this means the linker reads the file named by the last argument.
+ re(`-Wl,-sectcreate,.*`),
}
var validLinkerFlags = []*lazyregexp.Regexp{
@@ -223,7 +225,6 @@
re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]*)`),
re(`-Wl,-s`),
re(`-Wl,-search_paths_first`),
- re(`-Wl,-sectcreate,([^,@\-][^,]*),([^,@\-][^,]*),([^,@\-][^,]*)`),
re(`-Wl,--start-group`),
re(`-Wl,-?-static`),
re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`),
diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
index 68f0ea3..6369300 100644
--- a/src/cmd/go/internal/work/security_test.go
+++ b/src/cmd/go/internal/work/security_test.go
@@ -202,7 +202,6 @@
{"-L", "framework"},
{"-framework", "Chocolate"},
{"-v"},
- {"-Wl,-sectcreate,__TEXT,__info_plist,${SRCDIR}/Info.plist"},
{"-Wl,-framework", "-Wl,Chocolate"},
{"-Wl,-framework,Chocolate"},
{"-Wl,-unresolved-symbols=ignore-all"},
@@ -220,7 +219,6 @@
{"-Wl,-framework,."},
{"-Wl,-rpath,."},
{"-Wl,-rpath-link,."},
- {"-Wl,-sectcreate,.,.,."},
{"-Wl,-syslibroot,."},
{"-Wl,-undefined,."},
}
@@ -289,6 +287,9 @@
{"-Wl,-e="},
{"-Wl,-e,"},
{"-Wl,-R,-flag"},
+ {"-Wl,-sectcreate,.,.,."},
+ {"-Wl,-sectcreate,__TEXT,__info_plist,${SRCDIR}/Info.plist"},
+ {"-Wl,-sectcreate,__TEXT,__info,/etc/hosts"},
{"-Wl,--push-state,"},
{"-Wl,--push-state,@foo"},
{"-fplugin=./-Wl,--push-state,-R.so"},
diff --git a/src/cmd/go/testdata/script/darwin_sectcreate_ldflag.txt b/src/cmd/go/testdata/script/darwin_sectcreate_ldflag.txt
new file mode 100644
index 0000000..cac739a
--- /dev/null
+++ b/src/cmd/go/testdata/script/darwin_sectcreate_ldflag.txt
@@ -0,0 +1,24 @@
+[!GOOS:darwin] skip
+[!cgo] skip
+
+! go build
+stderr '^ldflag: invalid flag in #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,.*info.txt'
+
+env CGO_LDFLAGS_ALLOW=-Wl,-sectcreate,.*
+go build
+
+-- go.mod --
+module ldflag
+
+go 1.26
+
+-- main.go --
+package main
+
+// #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,${SRCDIR}/info.txt
+import "C"
+
+func main() {}
+
+-- info.txt --
+trusted local input
Change information
Files:
- M src/cmd/go/internal/work/security.go
- M src/cmd/go/internal/work/security_test.go
- A src/cmd/go/testdata/script/darwin_sectcreate_ldflag.txt
Change size: S
Delta: 3 files changed, 29 insertions(+), 3 deletions(-)
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gopher Robot (Gerrit)
9:16 AM (13 hours ago) 9:16 AM
to Gerrit Bot, goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Gopher Robot added 1 comment![]( "Open in Gerrit")
Patchset-level comments
File-level comment, Patchset 1 (Latest):
Gopher Robot . unresolved
I spotted some possible problems with your PR:
1. You have a long 227 character line in the commit message body. Please add line breaks to long lines that should be wrapped. Lines in the commit message body should be wrapped at ~76 characters unless needed for things like URLs or tables. (Note: GitHub might render long lines as soft-wrapped, so double-check in the Gerrit commit message shown above.)
2. It looks like you are using markdown in the commit message. If so, please remove it. Be sure to double-check the plain text shown in the Gerrit commit message above for any markdown backticks, markdown links, or other markdown formatting.
3. It looks like you have a properly formated bug reference, but the convention is to put bug references at the bottom of the commit message, even if a bug is also mentioned in the body of the message.
Please address any problems by updating the GitHub PR.
When complete, mark this comment as 'Done' and click the [blue 'Reply' button](https://go.dev/wiki/GerritBot#i-left-a-reply-to-a-comment-in-gerrit-but-no-one-but-me-can-see-it) above. These findings are based on heuristics; if a finding does not apply, briefly reply here saying so.
To update the commit title or commit message body shown here in Gerrit, you must edit the GitHub PR title and PR description (the first comment) in the GitHub web interface using the 'Edit' button or 'Edit' menu entry there. Note: pushing a new commit to the PR will not automatically update the commit message used by Gerrit.
For more details, see:
- [how to update commit messages](https://go.dev/wiki/GerritBot/#how-does-gerritbot-determine-the-final-commit-message) for PRs imported into Gerrit.
- the Go project's [conventions for commit messages](https://go.dev/doc/contribute#commit_messages) that you should follow.
(In general for Gerrit code reviews, the change author is expected to [log in to Gerrit](https://go-review.googlesource.com/login/) with a Gmail or other Google account and then close out each piece of feedback by marking it as 'Done' if implemented as suggested or otherwise reply to each review comment. See the [Review](https://go.dev/doc/contribute#review) section of the Contributing Guide for details.)
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gerrit Bot (Gerrit)
9:53 AM (13 hours ago) 9:53 AM
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Gerrit Bot uploaded new patchset![]( "Open in Gerrit")
Gerrit Bot uploaded patch set #2 to this change.
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Ian Lance Taylor (Gerrit)
3:53 PM (7 hours ago) 3:53 PM
to Gerrit Bot, goph...@pubsubhelper.golang.org, Ian Lance Taylor, Gopher Robot, golang-co...@googlegroups.com
Ian Lance Taylor added 1 comment![]( "Open in Gerrit")
Patchset-level comments
File-level comment, Patchset 2 (Latest):
Ian Lance Taylor . resolved
This seems reasonable to me but see https://github.com/golang/go/issues/23937#issuecomment-375727069 which claims that this option is needed for a security feature.
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Gerrit Bot (Gerrit)
7:36 PM (3 hours ago) 7:36 PM
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
Gerrit Bot uploaded new patchset![]( "Open in Gerrit")
Gerrit Bot uploaded patch set #3 to this change.
Related details
Attention set is empty
Submit Requirements:
Code-Review
No-Unresolved-Comments
Review-Enforcement
TryBots-Pass
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages