5 ms·

I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"

I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"m not sure how extensively it is used.

1over137 8mo ago
>I want an OS distro where all C code is compiled this way. You first have to modify "all C code". It's not just a set and forget compiler flag.
- musicale 8mo ago
  Indeed. I still want it.
wyldfire 8mo ago
You need to annotate your program with indications of what variable tracks the size of the allocation. So, sure, but first work on the packages in the distro. Note that corresponding checks for C++ library containers can be enabled without modifying the source. Google measured some very small overhead (< 0.5% IIRC) so they turned it on in production. But I'd expect an OS distro to be mostly C. [1] https://libcxx.llvm.org/Hardening.html https://libcxx.llvm.org/Hardening.html
bombcar 8mo ago
Get gentoo, add this to CFLAGS and start fixing everything that breaks. Become a hero.
pezgrande 8mo ago
does any distro uses clang? I thought all linux kernels were compiled using gcc.
- zmodem 8mo ago
  Not a Linux distro, but FreeBSD uses Clang. And Android uses Clang for its Linux kernel. -fbounds-safety is not yet available in upstream Clang though: > NOTE: This is a design document and the feature is not available for users yet.
- honktime 8mo ago
  Chimera does, it also has a FreeBSD userland AFAIU. https://chimera-linux.org/ https://chimera-linux.org/
  - pezgrande 8mo ago
    hm this one is interesting. Thanks for sharing!
- yjftsjthsd-h 8mo ago
  https://www.kernel.org/doc/html/latest/kbuild/llvm.html https://www.kernel.org/doc/html/latest/kbuild/llvm.html > The Linux kernel has always traditionally been compiled with GNU toolchains such as GCC and binutils. Ongoing work has allowed for Clang and LLVM utilities to be used as viable substitutes. Distributions such as Android, ChromeOS, OpenMandriva, and Chimera Linux use Clang built kernels. Google’s and Meta’s datacenter fleets also run kernels built with Clang.
pjmlp 8mo ago
It is called Solaris, and has this enabled since 2015 on SPARC. https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/prog-interfaces/using-application-data-integrity-adi.html https://docs.oracle.com/en/operating-systems/solaris/oracle-...
- salawat 8mo ago
  Might as well not even talk about anything with the Oracular kiss of death.
  - rbanffy 8mo ago
    Isn’t Illumos and OpenIndiana doing the same? I still remember someone at Sun commented they treated warnings as errors. This is how software should be developed.
    - kbolino 8mo ago
      The feature is only on SPARC, not x86. Oracle killed in-house SPARC development in 2017, and they abandoned OpenSPARC after they acquired Sun, so it's effectively a dead architecture. The software won't work without the hardware to run it on.
      - pjmlp 8mo ago
        Fujsitsu also does SPARC, and contrary to HP-UX, people still do buy Solaris. EDIT: https://www.oracle.com/servers/sparc/ https://www.oracle.com/servers/sparc/ https://www.fujitsu.com/global/products/computing/servers/unix/sparc/ https://www.fujitsu.com/global/products/computing/servers/un... Finally, it is up to Intel and AMD to come up with hardware memory tagging, so far they have messed up all attempts, with MPX being the last short lived one.
        kbolino 8mo ago
        It's good info, and I wouldn't rush a migration off of SPARC systems if I was already using them, but slow death is still death. It was already worrying that workstations were killed off by Sun before the Oracle acquisition; it seems quite clear that no one has been serious about spreading adoption of the architecture for more than two decades now.
prussian 8mo ago
Fedora and its kernels are built with GCC's _FORTIFY_SOURCE and I've seen modules crash for out of bounds reads.
- dezgeg 8mo ago
  _FORTIFY_SOURCE is way smaller in scope (as in, closes less vulnerabilities) than -fbounds-safety.
groundzeros2015 8mo ago
What are you hoping it will achieve?
- irishcoffee 8mo ago
  The internet went down because cloudflare used a bad config... a config parsed by a rust app. One of these days the witch hunt against C will go away.
  - random_mutex 8mo ago
    A panic in Rust is easier to diagnose and fix than some error or grabage data that was caused by an out of bounds access in some random place in the call stack
  - hypeatei 8mo ago
    The internet didn't go down and you're mischaracterizing it as a parsing issue when the list would've exceeded memory allocation limits. They didn't hardcode a fallback config for that case. What memory safety promise did Rust fail there exactly?
    - groundzeros2015 8mo ago
      I think the point is memory bugs are only one (small) subset of bugs.
      - Abstract_Typist 8mo ago
        The conventional wisdom is ~70% of serious security bugs are memory safety issues. https://www.cisa.gov/sites/default/files/2023-12/CSAC_TAC_Recommendations-Memory-Safety_Final_20231205_508.pdf https://www.cisa.gov/sites/default/files/2023-12/CSAC_TAC_Re...
        groundzeros2015 8mo ago
        Security bugs - and not bad security processes, are a small subset of bugs.
kgeist 8mo ago
Maybe this: https://fil-c.org/pizlix https://fil-c.org/pizlix >Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available. The author, @pizlonator, is active on HN.
- functionmouse 8mo ago
  hot dang that's neato. shame about the name, though.
- hsaliak 8mo ago
  https://github.com/hsaliak/filc-bazel-template https://github.com/hsaliak/filc-bazel-template i created this recently to make it super easy to get started with fil-c projects. If you find it daunting to get started with the setup in the core distribution and want a 3-4 step approach to building a fil-c enabled binary, then try this.
- musicale 8mo ago
  I'm aware of Pizlix - it's a good project/idea that needs to go mainstream; as you mention, memory safety is currently limited to userland (still a huge improvement over traditional unsafe userland.) Note also that it uses fil-c rather than clang with -fbounds-safety. I believe fil-c requires fewer code changes than -fbounds-safety.

I want an OS distro where all C code is compiled this way. OpenBSD maybe? or a fork of CheriBSD? macOS clang has supported -fbounds-safety for a while, but I"m not sure how extensively it is used.

1over137 8mo ago

>I want an OS distro where all C code is compiled this way. You first have to modify "all C code". It's not just a set and forget compiler flag.

musicale 8mo ago
Indeed. I still want it.

wyldfire 8mo ago

You need to annotate your program with indications of what variable tracks the size of the allocation. So, sure, but first work on the packages in the distro. Note that corresponding checks for C++ library containers can be enabled without modifying the source. Google measured some very small overhead (< 0.5% IIRC) so they turned it on in production. But I'd expect an OS distro to be mostly C. [1] https://libcxx.llvm.org/Hardening.html https://libcxx.llvm.org/Hardening.html

bombcar 8mo ago

Get gentoo, add this to CFLAGS and start fixing everything that breaks. Become a hero.

pezgrande 8mo ago

does any distro uses clang? I thought all linux kernels were compiled using gcc.

zmodem 8mo ago
Not a Linux distro, but FreeBSD uses Clang. And Android uses Clang for its Linux kernel. -fbounds-safety is not yet available in upstream Clang though: > NOTE: This is a design document and the feature is not available for users yet.
honktime 8mo ago
Chimera does, it also has a FreeBSD userland AFAIU. https://chimera-linux.org/ https://chimera-linux.org/
- pezgrande 8mo ago
  hm this one is interesting. Thanks for sharing!
yjftsjthsd-h 8mo ago
https://www.kernel.org/doc/html/latest/kbuild/llvm.html https://www.kernel.org/doc/html/latest/kbuild/llvm.html > The Linux kernel has always traditionally been compiled with GNU toolchains such as GCC and binutils. Ongoing work has allowed for Clang and LLVM utilities to be used as viable substitutes. Distributions such as Android, ChromeOS, OpenMandriva, and Chimera Linux use Clang built kernels. Google’s and Meta’s datacenter fleets also run kernels built with Clang.

pjmlp 8mo ago

It is called Solaris, and has this enabled since 2015 on SPARC. https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/prog-interfaces/using-application-data-integrity-adi.html https://docs.oracle.com/en/operating-systems/solaris/oracle-...

salawat 8mo ago
Might as well not even talk about anything with the Oracular kiss of death.
- rbanffy 8mo ago
  Isn’t Illumos and OpenIndiana doing the same? I still remember someone at Sun commented they treated warnings as errors. This is how software should be developed.
  - kbolino 8mo ago
    The feature is only on SPARC, not x86. Oracle killed in-house SPARC development in 2017, and they abandoned OpenSPARC after they acquired Sun, so it's effectively a dead architecture. The software won't work without the hardware to run it on.
    - pjmlp 8mo ago
      Fujsitsu also does SPARC, and contrary to HP-UX, people still do buy Solaris. EDIT: https://www.oracle.com/servers/sparc/ https://www.oracle.com/servers/sparc/ https://www.fujitsu.com/global/products/computing/servers/unix/sparc/ https://www.fujitsu.com/global/products/computing/servers/un... Finally, it is up to Intel and AMD to come up with hardware memory tagging, so far they have messed up all attempts, with MPX being the last short lived one.
      - kbolino 8mo ago
        It's good info, and I wouldn't rush a migration off of SPARC systems if I was already using them, but slow death is still death. It was already worrying that workstations were killed off by Sun before the Oracle acquisition; it seems quite clear that no one has been serious about spreading adoption of the architecture for more than two decades now.

prussian 8mo ago

Fedora and its kernels are built with GCC's _FORTIFY_SOURCE and I've seen modules crash for out of bounds reads.

dezgeg 8mo ago
_FORTIFY_SOURCE is way smaller in scope (as in, closes less vulnerabilities) than -fbounds-safety.

groundzeros2015 8mo ago

What are you hoping it will achieve?

irishcoffee 8mo ago
The internet went down because cloudflare used a bad config... a config parsed by a rust app. One of these days the witch hunt against C will go away.
- random_mutex 8mo ago
  A panic in Rust is easier to diagnose and fix than some error or grabage data that was caused by an out of bounds access in some random place in the call stack
- hypeatei 8mo ago
  The internet didn't go down and you're mischaracterizing it as a parsing issue when the list would've exceeded memory allocation limits. They didn't hardcode a fallback config for that case. What memory safety promise did Rust fail there exactly?
  - groundzeros2015 8mo ago
    I think the point is memory bugs are only one (small) subset of bugs.
    - Abstract_Typist 8mo ago
      The conventional wisdom is ~70% of serious security bugs are memory safety issues. https://www.cisa.gov/sites/default/files/2023-12/CSAC_TAC_Recommendations-Memory-Safety_Final_20231205_508.pdf https://www.cisa.gov/sites/default/files/2023-12/CSAC_TAC_Re...
      - groundzeros2015 8mo ago
        Security bugs - and not bad security processes, are a small subset of bugs.

kgeist 8mo ago

Maybe this: https://fil-c.org/pizlix https://fil-c.org/pizlix >Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available. The author, @pizlonator, is active on HN.

functionmouse 8mo ago
hot dang that's neato. shame about the name, though.
hsaliak 8mo ago
https://github.com/hsaliak/filc-bazel-template https://github.com/hsaliak/filc-bazel-template i created this recently to make it super easy to get started with fil-c projects. If you find it daunting to get started with the setup in the core distribution and want a 3-4 step approach to building a fil-c enabled binary, then try this.
musicale 8mo ago
I'm aware of Pizlix - it's a good project/idea that needs to go mainstream; as you mention, memory safety is currently limited to userland (still a huge improvement over traditional unsafe userland.) Note also that it uses fil-c rather than clang with -fbounds-safety. I believe fil-c requires fewer code changes than -fbounds-safety.