Re: [PATCH] meson: Stop if cfi is enabled with system slirp

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Mar 05, 2021 at 11:53:07AM -0500, Daniele Buono wrote:
> On 3/4/2021 5:37 AM, Daniel P. Berrangé wrote:
> > Is there work being done, or at least an active plan, for fixing this ?
> > 
> > Distros generally won't want to static link slirp to QEMU when there is
> > a shared slirp available. It increases the security burden to maintain
> > slirp twice, especially as slirp has a history of CVEs.
> > 
> > IOW, the inability to use shared slirp may well prevent CFI from being
> > used in distros.
> 
> Daniel,
> Adoption is a very good point. We don't want to have multiple versions
> of the same library hanging around the O.S., unless strictly necessary.
> 
> The problem (if I wear my security hat) is that, as you pointed out,
> slirp is known to have a history of CVEs, and it also rely heavily on
> callbacks and function pointers. So it would be one of the best
> candidates for CFI support.
> 
> A (long-term) solution could be to compile libslirp as a shared library,
> WITH Control-Flow Integrity. Clang does have an experimental support for
> Cross-DSO CFI. However, it is not viable at the moment because:
> 1. It is still considered Experimental
> 2. It is not compatible with pointer type generalization (which we need
> because of Glib and other uses in QEMU).
> Cross-DSO CFI also have some performance implications but I think that
> would be a very small price to pay, and only in corner-case conditions.

My concern is that libslirp is just showing us one known example of
the problem. QEMU links to many more external libraries, which might
exhibit similar issues. If we need to rebuild all the dependancies
with CFI too, to be confident that the combined work will operate
correctly, then this is quite a significant implication. Overall I
think this is going to be a problem for the changes of distros adopting
the use of CFI, especially if they're not using CLang as their toolchain.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|