Opened 17 months ago

Last modified 8 weeks ago

#29694 new defect

Build Go binaries with `-buildmode=pie"?

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-rbm, gitlab-tb-tor-browser-build
Cc: dcf, yawning Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

I was looking a bit how the obfs4proxy binary gets build for Android today and it turns out that Briar etc. use -buildmode=pie. Currently our Linux binaries have no PIE and no RELRO (but Stack Canaries, NX etc. enabled). Trying with -buildmode=pie results in "PIE enabled" but somewhat surprisingly our stack canaries are gone (but we get partial RELRO).

So, generally, should we start using PIE mode (and -extldflags=-pie where needed)? Or are we good with what we have?

Child Tickets

Change History (6)

comment:1 Changed 17 months ago by gk

Cc: dcf yawning added

Adding folks who might have insight/opinions here.

comment:2 Changed 17 months ago by gk

(It goes without saying that this is only relevant for platforms where this flag is actually supported, i.e. not for Windows binaries.)

comment:3 Changed 17 months ago by dcf

I don't have an opinion on this.

comment:4 Changed 3 months ago by cypherpunks

(It goes without saying that this is only relevant for platforms where this flag is actually supported, i.e. not for Windows binaries.)

Supported on Windows and is the default since Go 1.15 (https://github.com/golang/go/commit/c76befe0f40dfbb38a54c16d1845b97e4580797c)

comment:5 Changed 3 months ago by cypherpunks

I was looking a bit how the obfs4proxy binary gets build for Android today and it turns out that Briar etc. use -buildmode=pie.

Android 5.0+ refuses to run non-PIE executables, so PIE is the default.
Since Go 1.13: Go programs are now compatible with Android 10 (and even https://github.com/golang/go/commit/e4665da9bcdd4e9136c7ed97ab4253def130b89d).

comment:6 Changed 8 weeks ago by gk

Keywords: gitlab-tb-tor-browser-build added

Add magic gitlab keyword.

Note: See TracTickets for help on using tickets.