Some stack canaries are still missing on Tor Browser binaries

added component::applications/tor browser in Legacy / Trac owner::tbb-team in Legacy / Trac priority::medium in Legacy / Trac severity::normal in Legacy / Trac status::new in Legacy / Trac tbb-security in Legacy / Trac type::defect in Legacy / Trac labels

hardened-c++ adds '-fstack-protector','--param=ssp-buffer-size=4' to arguments for compiler only if no -nostdlib or -ffreestanding was passed to compiler.

-nostdlib or -ffreestanding was passed to compiler.

Unlikely any of those. And wrapper passing needed arguments for another firefox's libs, so no problem with wrapper for firefox case.

TorBrowser/Tor/libgmpxx.so TorBrowser/Tor/libgmpxx.so.4 TorBrowser/Tor/libgmpxx.so.4.3.3 This case is about '-nostdlib' that passed to g++ while libgmpxx compiled. Then hardened-c++ skips ssp arguments.

TorBrowser/Tor/PluggableTransports/meek-client-torbrowser

Meek compiled by Go compiler, and hardening-wrapper wraps around GCC.

Trac:
Username: JamesTow

Si vous recherchez à vous protéger efficacement contre les cambrioleurs, il convient d'investir dans un coffre-fort agréé. Une armoire forte pour armes longues servira éventuellement pour le stockage des fusils de chasse pour ranger vos archives et dossiers importants. Une alarme n'est pas suffisante, les cambrioleurs savent où trouver vos valeurs et liquidités et fond des raids éclairs pour repartir avec vos valeurs, avant que le voisinage ait eu le temps d'alerter la police ou la gendarmerie. Un coffre-fort agréé et homologué qui sera correctement fixé au sol permettra de mettre les cambrioleurs en échec, ils n'auront d'autre choix que de s'enfuir pour ne pas se faire prendre.

Trac:
Username: JamesTow

libgmpxx is no issue anymore since legacy/trac#13588 (moved) got fixed.

The libstdc++ we ship has no stack canaries either.

See also https://trac.torproject.org/projects/tor/ticket/15138#comment:7

libmozalloc.so
libnssckbi.so
libplc4.so
libplds4.so

Was any of those reported as protected for any previous versions? hardening-wrapper (1.25) packaged for lucid using -fstack-protector which can't cover any functions from those libs (it needs proof, but brief reading code show that functions are small enough to be protected). If no protected functions then no detection code compiled and no canaries support reported.

hardening-wrapper (1.25) Btw, it doesn't passes reduced ssp-buffer-size value, which is 8 by default, to protect more functions, with compare to --param ssp-buffer-size=4 used for windows builds.

Comparing Windows and Linux builds, mozalloc lib: For Windows build, protected one function (exported as _ZN7mozilla14VolatileBuffer4InitEjj) For Linux build, no functions protected.

_ZN7mozilla14VolatileBuffer4InitEjj For Linux build, no functions protected. Bad choice to compare, those code too different for Linux and Windows.

nssckbi.dll
plc4.dll
plds4.dll

No any SSP generated too.

Tested some dlls for vanilla Firefox ESR (msvc build) to compare with TorBrowser, if any function protected (firefox codebase only):

freebl3.dll  yes
mozalloc.dll yes (the same one, like for TB)
nss3.dll     yes
nssckbi.dll  no
nssdbm3.dll  yes

The libstdc++ we ship has no stack canaries either.

System libstdc++ from Debian (wheezy, jessie, sid) wasn't built with SSP too. Does it excuse TB?

The following 2 files are also missing stack canary on linux32 (but not on linux64):

    TorBrowser/Tor/PluggableTransports/meek-client
    TorBrowser/Tor/PluggableTransports/obfs4proxy

Trac:
Keywords: N/A deleted, tbb-hardening added

Trac:
Keywords: tbb-hardening deleted, tbb-hardened added

Trac:
Severity: N/A to Normal
Reviewer: N/A to N/A
Cc: N/A to arthuredelstein
Sponsor: N/A to N/A

In ESR52 builds, libmozsandbox.so is also missing stack canaries.

Remove tbb-hardened keyword.

Trac:
Keywords: tbb-hardened deleted, N/A added

Shouldn't you pass SSP flags to DLLFLAGS to get it working with NSS, like in https://gitweb.torproject.org/builders/tor-browser-build.git/tree/projects/firefox/build#n77?

Trac:
Status: new to needs_information
Summary: Some stack canaries are still missing on Tor Browser binaries on Linux to Some stack canaries are still missing on Tor Browser binaries

Replying to cypherpunks:

Shouldn't you pass SSP flags to DLLFLAGS to get it working with NSS, like in https://gitweb.torproject.org/builders/tor-browser-build.git/tree/projects/firefox/build#n77?

This issue happens on Linux, so it seems that DLLFLAGS won't help us here. Or are you referring to comment:12?

The current list of binaries that we skip in our readelf_stack_canary test is:

            abicheck
            gtk2/libmozgtk.so
            libmozalloc.so
            libmozgtk.so
            libnssckbi.so
            libplc4.so
            libplds4.so
            TorBrowser/Tor/libstdc++/libstdc++.so.6
            TorBrowser/Tor/PluggableTransports/Crypto/Cipher/_ARC4.so
            TorBrowser/Tor/PluggableTransports/Crypto/Cipher/_XOR.so
            TorBrowser/Tor/PluggableTransports/Crypto/Util/_counter.so
            TorBrowser/Tor/PluggableTransports/fte/cDFA.so
            TorBrowser/Tor/PluggableTransports/meek-client-torbrowser
            TorBrowser/Tor/PluggableTransports/twisted/python/_initgroups.so
            TorBrowser/Tor/PluggableTransports/twisted/runner/portmap.so
            TorBrowser/Tor/PluggableTransports/twisted/test/raiser.so
            TorBrowser/Tor/PluggableTransports/zope/interface/_zope_interface_coptimizations.so
            TorBrowser/Tor/PluggableTransports/meek-client
            TorBrowser/Tor/PluggableTransports/obfs4proxy

From https://wiki.debian.org/HardeningWalkthrough:

Stack Protected: When an executable was built without any character arrays being allocated on the stack, this check will lead to false alarms (since there is no use of stack_chk_fail, even though it was compiled with the correct options.

Another one since esr68 is liblgpllibs.so. I guess part of this ticket is to figure first out which of the errors are actually false positives and which need to get addressed. We can then file new tickets for the latter and adapt our test tools accordingly.