commit 7df10ce04da9ed36a55e91c193fca29e88ac7a5f Author: Georg Koppen gk@torproject.org Date: Fri Aug 29 20:28:39 2014 +0000

Bug 12103: Adding RELRO back to browser binaries.

We removed the build-id from browser binaries in bug 11042 as it turned out that despite the contents being exactly the same the build-id was not occasionally. But doing that with bjcopy destroyed RELRO protections as well. Having the build-id non-deterministic seems to be an ld issue as switching to gold solves this. --- gitian/descriptors/linux/gitian-firefox.yml | 6 ++++-- gitian/descriptors/linux/gitian-utils.yml | 20 ++++++++++++++++++++ gitian/mkbundle-linux.sh | 8 +++++++- 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 7e6c598..cbd2b17 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,6 +29,8 @@ remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" files: +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" - "python-linux32-utils.zip" - "python-linux64-utils.zip" - "re-dzip.sh" @@ -62,6 +64,8 @@ script: | ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python export PATH=$INSTDIR/python/bin:$PATH # + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components # @@ -89,8 +93,6 @@ script: | cd $INSTDIR for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater do - # Build-ID is sometimes non-deterministic, and we use debuglink anyway - objcopy --remove-section=.note.gnu.build-id $LIB objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB objcopy --add-gnu-debuglink=./Debug/$LIB $LIB diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34b1672..ea122db 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -15,6 +15,8 @@ packages: - "faketime" - "libtool" - "hardening-wrapper" +# Needed for compiling gold. +- "bison" # These packages are needed for Python due to HTTPS-Everywhere >= 3.5. - "libsqlite3-dev" - "zlib1g-dev" @@ -25,6 +27,7 @@ remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" files: +- "binutils.tar.bz2" - "openssl.tar.gz" - "python.tar.bz2" - "lxml.tar.gz" @@ -47,6 +50,22 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1

+ # Building Binutils + tar xjf binutils.tar.bz2 + cd binutils* + # We want to use gold as the linker in our toolchain mainly as it is way + # faster when linking Tor Browser code (especially libxul). But apart from + # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well + # (see bug #12743). + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + make $MAKEOPTS + make install + # Make sure gold is used and not ld. + cd $INSTDIR/binutils/bin + rm ld + ln -sf ld.gold ld + cd ~/build + # Building Libevent cd libevent ./autogen.sh @@ -104,6 +123,7 @@ script: |

# Grabbing the remaining results cd $INSTDIR + ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0d07364..ea6d171 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -98,7 +98,9 @@ fi

cd $GITIAN_DIR

-if [ ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ +if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ + ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ @@ -122,6 +124,8 @@ then

cd inputs cp -a ../build/out/*-utils.zip . + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip @@ -141,6 +145,8 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip