commit 23485f23ff8536592b5178a5d244f84da770bc87 · pyrox.dev/nixpkgs

+2 -26

nixos/tests/hardened.nix

···

       33
        
       

     

       34
        
         testScript =

     

       35
        
           let

     

       36
       -
             hardened-malloc-tests = pkgs.stdenv.mkDerivation {

     

       37
       -
               name = "hardened-malloc-tests-${pkgs.graphene-hardened-malloc.version}";

     

       38
       -
               src = pkgs.graphene-hardened-malloc.src;

     

       39
       -
               buildPhase = ''

     

       40
       -
                 cd test/simple-memory-corruption

     

       41
       -
                 make -j4

     

       42
       -
               '';

     

       43
       -
       

     

       44
       -
               installPhase = ''

     

       45
       -
                 find . -type f -executable -exec install -Dt $out/bin '{}' +

     

       46
       -
               '';

     

       47
       -
             };

     

       48
        
           in

     

       49
        
           ''

     

       50
        
             machine.wait_for_unit("multi-user.target")

     
···

       107
        
                 machine.fail("systemctl kexec")

     

       108
        
       

     

       109
        
       

     

       110
       -
             # Test hardened memory allocator

     

       111
       -
             def runMallocTestProg(prog_name, error_text):

     

       112
       -
                 text = "fatal allocator error: " + error_text

     

       113
       -
                 if not text in machine.fail(

     

       114
       -
                     "${hardened-malloc-tests}/bin/"

     

       115
       -
                     + prog_name

     

       116
       -
                     + " 2>&1"

     

       117
       -
                 ):

     

       118
       -
                     raise Exception("Hardened malloc does not work for {}".format(error_text))

     

       119
       -
       

     

       120
       -
       

     

       121
        
             with subtest("The hardened memory allocator works"):

     

       122
       -
                 runMallocTestProg("double_free_large", "invalid free")

     

       123
       -
                 runMallocTestProg("unaligned_free_small", "invalid unaligned free")

     

       124
       -
                 runMallocTestProg("write_after_free_small", "detected write after free")

     

       125
        
           '';

     

       126
        
       })

···

       33
        
       

     

       34
        
         testScript =

     

       35
        
           let

     

       36
       +
             hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
           in

     

       38
        
           ''

     

       39
        
             machine.wait_for_unit("multi-user.target")

     
···

       96
        
                 machine.fail("systemctl kexec")

     

       97
        
       

     

       98
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       99
        
             with subtest("The hardened memory allocator works"):

     

       100
       +
                 machine.succeed("${hardened-malloc-tests}/bin/run-tests")

     

       0
        
       
     

       0
        
       
     

       101
        
           '';

     

       102
        
       })

+54 -23

pkgs/development/libraries/graphene-hardened-malloc/default.nix

···

       1
       -
       { lib, stdenv, fetchurl }:

     

       2
        
       

     

       3
       -
       stdenv.mkDerivation rec {

     

       4
        
         pname = "graphene-hardened-malloc";

     

       5
       -
         version = "2";

     

       6
        
       

     

       7
        
         src = fetchurl {

     

       8
        
           url = "https://github.com/GrapheneOS/hardened_malloc/archive/${version}.tar.gz";

     

       9
       -
           sha256 = "0zsl4vl65ic6lw5rzcjzvcxg8makg683abnwvy60zfap8hvijvjb";

     

       10
        
         };

     

       11
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
         installPhase = ''

     

       0
        
       
     

       13
        
           install -Dm444 -t $out/lib libhardened_malloc.so

     

       14
        
       

     

       15
        
           mkdir -p $out/bin

     
···

       19
        
       

     

       20
        
         separateDebugInfo = true;

     

       21
        
       

     

       22
       -
         doInstallCheck = true;

     

       23
       -
         installCheckPhase = ''

     

       24
       -
           pushd test

     

       25
       -
           make

     

       26
       -
           $out/bin/preload-hardened-malloc ./offset

     

       27
        
       

     

       28
       -
           pushd simple-memory-corruption

     

       29
       -
           make

     

       30
        
       

     

       31
       -
           # these tests don't actually appear to generate overflows currently

     

       32
       -
           rm read_after_free_small string_overflow eight_byte_overflow_large

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       33
        
       

     

       34
       -
           for t in `find . -regex ".*/[a-z_]+"` ; do

     

       35
       -
             echo "Running $t..."

     

       36
       -
             # the program being aborted (as it should be) would result in an exit code > 128

     

       37
       -
             (($out/bin/preload-hardened-malloc $t) && false) \

     

       38
       -
               || (test $? -gt 128 || (echo "$t was not aborted" && false))

     

       39
       -
           done

     

       40
       -
           popd

     

       41
        
       

     

       42
       -
           popd

     

       43
       -
         '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       44
        
       

     

       45
        
         meta = with lib; {

     

       46
        
           homepage = "https://github.com/GrapheneOS/hardened_malloc";

     
···

       54
        
           maintainers = with maintainers; [ ris ];

     

       55
        
           platforms = [ "x86_64-linux" "aarch64-linux" ];

     

       56
        
         };

     

       57
       -
       }

···

       1
       +
       { lib, stdenv, fetchurl, python3, runCommand, makeWrapper, stress-ng }:

     

       2
        
       

     

       3
       +
       lib.fix (self: stdenv.mkDerivation rec {

     

       4
        
         pname = "graphene-hardened-malloc";

     

       5
       +
         version = "8";

     

       6
        
       

     

       7
        
         src = fetchurl {

     

       8
        
           url = "https://github.com/GrapheneOS/hardened_malloc/archive/${version}.tar.gz";

     

       9
       +
           sha256 = "0lipyd2pb1bmghkyv9zmg25jwcglj7m281f01zlh3ghz3xlfh0ym";

     

       10
        
         };

     

       11
        
       

     

       12
       +
         doCheck = true;

     

       13
       +
         checkInputs = [ python3 ];

     

       14
       +
         # these tests cover use as a build-time-linked library

     

       15
       +
         checkPhase = ''

     

       16
       +
           make test

     

       17
       +
         '';

     

       18
       +
       

     

       19
        
         installPhase = ''

     

       20
       +
           install -Dm444 -t $out/include include/*

     

       21
        
           install -Dm444 -t $out/lib libhardened_malloc.so

     

       22
        
       

     

       23
        
           mkdir -p $out/bin

     
···

       27
        
       

     

       28
        
         separateDebugInfo = true;

     

       29
        
       

     

       30
       +
         passthru = {

     

       31
       +
           ld-preload-tests = stdenv.mkDerivation {

     

       32
       +
             name = "${self.name}-ld-preload-tests";

     

       33
       +
             src = self.src;

     

       0
        
       
     

       34
        
       

     

       35
       +
             nativeBuildInputs = [ makeWrapper ];

     

       0
        
       
     

       36
        
       

     

       37
       +
             # reuse the projects tests to cover use with LD_PRELOAD. we have

     

       38
       +
             # to convince the test programs to build as though they're naive

     

       39
       +
             # standalone executables. this includes disabling tests for

     

       40
       +
             # malloc_object_size, which doesn't make sense to use via LD_PRELOAD.

     

       41
       +
             buildPhase = ''

     

       42
       +
               pushd test/simple-memory-corruption

     

       43
       +
               make LDLIBS= LDFLAGS=-Wl,--unresolved-symbols=ignore-all CXXFLAGS=-lstdc++

     

       44
       +
               substituteInPlace test_smc.py \

     

       45
       +
                 --replace 'test_malloc_object_size' 'dont_test_malloc_object_size' \

     

       46
       +
                 --replace 'test_invalid_malloc_object_size' 'dont_test_invalid_malloc_object_size'

     

       47
       +
               popd # test/simple-memory-corruption

     

       48
       +
             '';

     

       49
        
       

     

       50
       +
             installPhase = ''

     

       51
       +
               mkdir -p $out/test

     

       52
       +
               cp -r test/simple-memory-corruption $out/test/simple-memory-corruption

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       53
        
       

     

       54
       +
               mkdir -p $out/bin

     

       55
       +
               makeWrapper ${python3.interpreter} $out/bin/run-tests \

     

       56
       +
                 --add-flags "-I -m unittest discover --start-directory $out/test/simple-memory-corruption"

     

       57
       +
             '';

     

       58
       +
           };

     

       59
       +
           tests = {

     

       60
       +
             ld-preload = runCommand "ld-preload-test-run" {} ''

     

       61
       +
               ${self}/bin/preload-hardened-malloc ${self.ld-preload-tests}/bin/run-tests

     

       62
       +
               touch $out

     

       63
       +
             '';

     

       64
       +
             # to compensate for the lack of tests of correct normal malloc operation

     

       65
       +
             stress = runCommand "stress-test-run" {} ''

     

       66
       +
               ${self}/bin/preload-hardened-malloc ${stress-ng}/bin/stress-ng \

     

       67
       +
                 --no-rand-seed \

     

       68
       +
                 --malloc 8 \

     

       69
       +
                 --malloc-ops 1000000 \

     

       70
       +
                 --verify

     

       71
       +
               touch $out

     

       72
       +
             '';

     

       73
       +
           };

     

       74
       +
         };

     

       75
        
       

     

       76
        
         meta = with lib; {

     

       77
        
           homepage = "https://github.com/GrapheneOS/hardened_malloc";

     
···

       85
        
           maintainers = with maintainers; [ ris ];

     

       86
        
           platforms = [ "x86_64-linux" "aarch64-linux" ];

     

       87
        
         };

     

       88
       +
       })