cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565

jayconrod · 2020-11-12T22:32:30Z

What version of Go are you using (`go version`)?

$ go version
go version go1.15.5 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/jayconrod/Library/Caches/go-build"
GOENV="/Users/jayconrod/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/jayconrod/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/jayconrod/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/opt/go/installed"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/opt/go/installed/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-D_FORTIFY_SOURCE=1 -fstack-protector -Wthread-safety -Wself-assign -fno-omit-frame-pointer -O0 -DDEBUG -mmacosx-version-min=10.15 -no-canonical-prefixes -Wno-builtin-macro-redefined -D__DATE__="redacted" -D__TIMESTAMP__="redacted" -D__TIME__="redacted""
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-fobjc-link-runtime -headerpad_max_install_names -no-canonical-prefixes -mmacosx-version-min=10.15"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/rq/x0692kqj6ml8cvrhcqh5bswc008xj1/T/go-build236636493=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

CGO_LDFLAGS=-fobjc-link-runtime go build runtime/cgo

What did you expect to see?

Build succeeds, embedding the specified flags as //go:cgo_ldflag pragmas in compiled packages.

What did you see instead?

Build fails with:

go build runtime/cgo: invalid flag in go:cgo_ldflag: -fobjc-link-runtime

I believe this is an unintentional side effect of 3215982, the fix for #42558.

Previously, the security check was applied to flags in #cgo LDFLAGS directives in source files. That prevents malicious source files from executing arbitrary code.

With the commit above, we now apply the security check to all //go:cgo_ldflag pragmas in generated cgo code, in case there's a way for the original source code to cause such a comment to appear in generated code.

However, the CGO_LDFLAGS environment variable causes //go:cgo_ldflag pragmas to be written in generated cgo code. The user has complete control over flags in that environment variable, so they should not be subject to the security check.

A workaround is to set CGO_ALLOW_LDFLAGS to a regular expression that covers everything in CGO_LDFLAGS.

The text was updated successfully, but these errors were encountered:

jayconrod · 2020-11-12T22:32:52Z

cc @ianlancetaylor @bcmills @matloob

ianlancetaylor · 2020-11-12T22:49:41Z

@gopherbot Please open backport issues.

This is a usability regression introduced by the security fix for #42556. The security fix was applied to all release branches, and we should follow up with a fix for this usability regression.

For golang/go#42565 For bazelbuild#2710

gopherbot · 2020-11-12T22:49:52Z

Backport issue(s) opened: #42566 (for 1.14), #42567 (for 1.15).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

For golang/go#42565 For bazelbuild#2710

For golang/go#42565 For #2710

gopherbot · 2020-11-13T19:06:46Z

Change https://golang.org/cl/269818 mentions this issue: cmd/go: permit CGO_LDFLAGS to appear in //go:ldflag

Foxboron · 2020-11-14T11:38:31Z

This is a usability regression introduced by the security fix for #42556. The security fix was applied to all release branches, and we should follow up with a fix for this usability regression.

It's a bit more then that though. In Arch Linux we utilize CGO_LDFLAGS to ensure binary hardening, this regression is actually causing all our go packages to fail building.

dmgk · 2020-11-14T11:46:51Z

It also broke (so far) tinygo build on FreeBSD: go build runtime/cgo: invalid flag in go:cgo_ldflag: -std=c++14

Foxboron · 2020-11-14T12:03:03Z

I used the patch from the change set on our go compiler, and it works on our end.

https://github.com/archlinux/svntogit-community/blob/packages/go/trunk/fix-ldflags.patch

gopherbot · 2020-11-14T14:12:53Z

Change https://golang.org/cl/270137 mentions this issue: [release-branch.go1.15] cmd/go: permit CGO_LDFLAGS to appear in //go:ldflag

gopherbot · 2020-11-14T14:14:01Z

Change https://golang.org/cl/270080 mentions this issue: [release-branch.go1.14] cmd/go: permit CGO_LDFLAGS to appear in //go:ldflag

ianlancetaylor · 2020-11-14T14:22:07Z

I apologize for this problem. It was caused by a patch to fix a security problem. Because that patch could not be shared before the fix, it was not widely tested.

Please don't comment just to say that the problem affects you too. See https://golang.org/wiki/NoPlusOne. Thanks.

This will be fixed in the next release. Until then, the workaround, as mentioned in the original issue report, is to copy CGO_LDFLAGS into CGO_LDFLAGS_ALLOW.

Again, sorry for the problem.

…ldflag For #42565 Fixes #42567 Change-Id: If7cf39905d124dbd54dfac6a53ee38270498efed Reviewed-on: https://go-review.googlesource.com/c/go/+/269818 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com> (cherry picked from commit 782cf56) Reviewed-on: https://go-review.googlesource.com/c/go/+/270137

…ldflag For #42565 Fixes #42566 Change-Id: If7cf39905d124dbd54dfac6a53ee38270498efed Reviewed-on: https://go-review.googlesource.com/c/go/+/269818 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com> (cherry picked from commit 782cf56) Reviewed-on: https://go-review.googlesource.com/c/go/+/270080

jayconrod added NeedsFix The path to resolution is known, but the work has not been done. GoCommand cmd/go release-blocker labels Nov 12, 2020

jayconrod added this to the Go1.16 milestone Nov 12, 2020

jayconrod mentioned this issue Nov 12, 2020

Support Go 1.15.5, 1.14.12 bazelbuild/rules_go#2713

Merged

jayconrod pushed a commit to jayconrod/rules_go that referenced this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW

8b21d93

For golang/go#42565 For bazelbuild#2710

This was referenced Nov 12, 2020

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist [1.14 backport] #42566

Closed

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist [1.15 backport] #42567

Closed

jayconrod mentioned this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW bazelbuild/rules_go#2714

Merged

jayconrod pushed a commit to jayconrod/rules_go that referenced this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW

6c56169

For golang/go#42565 For bazelbuild#2710

jayconrod pushed a commit to bazelbuild/rules_go that referenced this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW (#2714)

6ac2c02

For golang/go#42565 For #2710

jayconrod pushed a commit to bazelbuild/rules_go that referenced this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW (#2714)

ed620b7

For golang/go#42565 For #2710

jayconrod pushed a commit to bazelbuild/rules_go that referenced this issue Nov 12, 2020

GoStdLib: add CGO_LDFLAGS to CGO_LDFLAGS_ALLOW (#2714)

7133d80

For golang/go#42565 For #2710

gopherbot closed this as completed in 782cf56 Nov 14, 2020

aykevl mentioned this issue Nov 14, 2020

Makefile: fix issue with Go 1.15.5 tinygo-org/tinygo#1497

Merged

danp mentioned this issue Nov 16, 2020

data: add go1.15.[56] and go1.14.1[23] heroku/heroku-buildpack-go#435

Merged

ianlancetaylor mentioned this issue Nov 17, 2020

gomobile: go build runtime/cgo: invalid flag in go:cgo_ldflag: -fembed-bitcode #42647

Closed

foxcpp mentioned this issue Nov 30, 2020

'invalid flag' when building with Go 1.15.5 foxcpp/maddy#299

Closed

AlexRouSg mentioned this issue Dec 8, 2020

x/mobile: gomobile bind iOS library with bitcode error #43060

Closed

toothrot mentioned this issue Dec 11, 2020

x/mobile: cmd/gomobile bind reports an error and cannot be executed #43136

Closed

steeve mentioned this issue Dec 12, 2020

cmd/go: allow invalid flag in #cgo LDFLAGS: CoreFoundation #43152

Closed

golang locked and limited conversation to collaborators Dec 26, 2021

gopherbot added the FrozenDueToAge label Dec 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565

jayconrod commented Nov 12, 2020

jayconrod commented Nov 12, 2020

ianlancetaylor commented Nov 12, 2020

gopherbot commented Nov 12, 2020

gopherbot commented Nov 13, 2020

Foxboron commented Nov 14, 2020

dmgk commented Nov 14, 2020

Foxboron commented Nov 14, 2020

gopherbot commented Nov 14, 2020

gopherbot commented Nov 14, 2020

ianlancetaylor commented Nov 14, 2020

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565

cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565

Comments

jayconrod commented Nov 12, 2020

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

jayconrod commented Nov 12, 2020

ianlancetaylor commented Nov 12, 2020

gopherbot commented Nov 12, 2020

gopherbot commented Nov 13, 2020

Foxboron commented Nov 14, 2020

dmgk commented Nov 14, 2020

Foxboron commented Nov 14, 2020

gopherbot commented Nov 14, 2020

gopherbot commented Nov 14, 2020

ianlancetaylor commented Nov 14, 2020

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?