From 1e3a985f5c75ce130ab5e979543c53c24cd8e2c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0smail=20D=C3=B6nmez?= Date: Sat, 16 Jan 2016 18:59:31 +0200 Subject: [PATCH 1/2] Don't let ld strip relocations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the first step for enabling ASLR (Address Space Layout Randomization) support. We want to enable ASLR for better protection against exploiting security holes in Git. The problem fixed by this commit is that `ld.exe` seems to be stripping relocations which in turn will break ASLR support. We just make sure it's not stripping the main executable entry. Signed-off-by: İsmail Dönmez Signed-off-by: Johannes Schindelin --- config.mak.uname | 2 ++ 1 file changed, 2 insertions(+) diff --git a/config.mak.uname b/config.mak.uname index 40d6b29eeef9a9..0adeba717ab165 100644 --- a/config.mak.uname +++ b/config.mak.uname @@ -549,9 +549,11 @@ else prefix = /usr/ ifeq (MINGW32,$(MSYSTEM)) prefix = /mingw32 + BASIC_LDFLAGS += -Wl,--pic-executable,-e,_mainCRTStartup endif ifeq (MINGW64,$(MSYSTEM)) prefix = /mingw64 + BASIC_LDFLAGS += -Wl,--pic-executable,-e,mainCRTStartup else COMPAT_CFLAGS += -D_USE_32BIT_TIME_T BASIC_LDFLAGS += -Wl,--large-address-aware From 1ee7c0944125c3ffdab50ea1ef40d8cc893dc059 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0smail=20D=C3=B6nmez?= Date: Sat, 16 Jan 2016 19:09:34 +0200 Subject: [PATCH 2/2] Enable DEP and ASLR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enable DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) support. This applies to both 32bit and 64bit builds and makes it substantially harder to exploit security holes in Git by offering a much more unpredictable attack surface. Signed-off-by: İsmail Dönmez Signed-off-by: Johannes Schindelin --- config.mak.uname | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config.mak.uname b/config.mak.uname index 0adeba717ab165..7a530118a49c50 100644 --- a/config.mak.uname +++ b/config.mak.uname @@ -547,6 +547,10 @@ else ifeq ($(shell expr "$(uname_R)" : '2\.'),2) # MSys2 prefix = /usr/ + # Enable DEP + BASIC_LDFLAGS += -Wl,--nxcompat + # Enable ASLR + BASIC_LDFLAGS += -Wl,--dynamicbase ifeq (MINGW32,$(MSYSTEM)) prefix = /mingw32 BASIC_LDFLAGS += -Wl,--pic-executable,-e,_mainCRTStartup