Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot use SAN CMake option in app builds #3711

Closed
letmaik opened this issue Mar 28, 2022 · 3 comments
Closed

Cannot use SAN CMake option in app builds #3711

letmaik opened this issue Mar 28, 2022 · 3 comments
Labels

Comments

@letmaik
Copy link
Member

letmaik commented Mar 28, 2022

The CCF CMake helpers installed in /opt/ccf/cmake interpret -DSAN=ON and enable SAN-related compile flags. This fails with:

clang: error: no such file or directory: '/opt/ccf/src/ubsan.suppressions'

If the SAN option is something that is part of the public CCF CMake API, then probably the missing file should be installed (or some variant of it). If not, then a less "global" variable name should be used.

@letmaik letmaik added the bug label Mar 28, 2022
@letmaik
Copy link
Member Author

letmaik commented Mar 28, 2022

I note also that implementing an app-specific CMake SAN option is currently tricky because of the following lines in add_ccf_app:

CCF/cmake/ccf_app.cmake

Lines 188 to 190 in c856048

if(NOT SAN)
target_link_options(${virt_name} PRIVATE LINKER:--no-undefined)
endif()

@letmaik
Copy link
Member Author

letmaik commented Mar 29, 2022

As a temporary hack, I copied ubsan.suppressions to the right place, but because CCF itself (cchost) was built without SAN enabled, it fails at runtime:

terminating with uncaught exception of type std::logic_error: Could not load virtual enclave: ./libfoo.virtual.so: undefined symbol: __ubsan_vptr_type_cache

It seems like the only option is to build CCF from source in order to use SAN for apps.

@letmaik
Copy link
Member Author

letmaik commented Mar 29, 2022

Summary of steps to use SAN in apps as of now:

  1. Build CCF from source with -DSAN=ON
  2. Introduce new option in app's CMake, e.g. -DENABLE_SAN=ON
  3. Write CMake code similar to CCF's code to add the right compile and link options to targets if ENABLE_SAN is on.

For 3, this can be used as starting point:

CCF/cmake/tools.cmake

Lines 4 to 19 in 5140e0f

function(add_san name)
if(SAN)
target_compile_options(
${name}
PRIVATE -fsanitize=undefined,address -fno-omit-frame-pointer
-fno-sanitize-recover=all -fno-sanitize=function
-fsanitize-blacklist=${CCF_DIR}/src/ubsan.suppressions
)
target_link_libraries(
${name}
PRIVATE -fsanitize=undefined,address -fno-omit-frame-pointer
-fno-sanitize-recover=all -fno-sanitize=function
-fsanitize-blacklist=${CCF_DIR}/src/ubsan.suppressions
)
endif()
endfunction()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant