Enable GCC stack protection (aka Propolice) for userland:

- It is opt-out for now so as to give it maximum testing, but it may be
  turned opt-in for stable branches depending on the consensus.  You
  can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
  It is harmless to steal the knob as SSP symbols have been provided
  by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
  (sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
  libc will be automatically downgraded to -fstack-protector because it
  breaks rtld otherwise.
- This option is unavailable on ia64.

Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.

Submitted by:	Jeremie Le Hen <jeremie@le-hen.org>

22 files changed, 84 insertions, 4 deletions

diff --git a/sys/boot/Makefile.inc b/sys/boot/Makefile.inc
new file mode 100644
index 000000000000..09bde81a8c20
--- /dev/null
+++ b/sys/boot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+WITHOUT_SSP=
diff --git a/sys/boot/arm/Makefile.inc b/sys/boot/arm/Makefile.inc
new file mode 100644
index 000000000000..265f86d1ed55
--- /dev/null
+++ b/sys/boot/arm/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/arm/at91/Makefile.inc b/sys/boot/arm/at91/Makefile.inc
index 403fad0eb708..2f528e365911 100644
--- a/sys/boot/arm/at91/Makefile.inc
+++ b/sys/boot/arm/at91/Makefile.inc
@@ -53,3 +53,5 @@ MK_FPGA:=no
 .endif
 
 .endif
+
+.include "../Makefile.inc"
diff --git a/sys/boot/efi/Makefile.inc b/sys/boot/efi/Makefile.inc
index 2668708befb5..fdfd59cf0d68 100644
--- a/sys/boot/efi/Makefile.inc
+++ b/sys/boot/efi/Makefile.inc
@@ -5,3 +5,5 @@ BINDIR?=	/boot
 # Options used when building app-specific efi components
 CFLAGS+=	-ffreestanding -fshort-wchar -Wformat
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/i386/Makefile.inc b/sys/boot/i386/Makefile.inc
index 9b53cc95ff60..72c6395acf0f 100644
--- a/sys/boot/i386/Makefile.inc
+++ b/sys/boot/i386/Makefile.inc
@@ -24,3 +24,5 @@ BTXDIR=		${.CURDIR}/../btx
 BTXLDR=		${BTXDIR}/btxldr/btxldr
 BTXKERN=	${BTXDIR}/btx/btx
 BTXCRT=		${BTXDIR}/lib/crt0.o
+
+.include "../Makefile.inc"
diff --git a/sys/boot/i386/loader/Makefile b/sys/boot/i386/loader/Makefile
index fb8cc835a315..df2ccc0f15ad 100644
--- a/sys/boot/i386/loader/Makefile
+++ b/sys/boot/i386/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader.sym
diff --git a/sys/boot/ia64/Makefile.inc b/sys/boot/ia64/Makefile.inc
index 2e9a113df387..e63fb5464734 100644
--- a/sys/boot/ia64/Makefile.inc
+++ b/sys/boot/ia64/Makefile.inc
@@ -5,3 +5,5 @@ BINDIR?=	/boot
 # Options used when building standalone components
 CFLAGS+=	-ffreestanding -fshort-wchar -Wformat
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/ia64/common/Makefile b/sys/boot/ia64/common/Makefile
index b410bd824284..d36c5506f77e 100644
--- a/sys/boot/ia64/common/Makefile
+++ b/sys/boot/ia64/common/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 LIB=		ia64
diff --git a/sys/boot/ia64/efi/Makefile b/sys/boot/ia64/efi/Makefile
index 0c0761018fce..5c7fda502a65 100644
--- a/sys/boot/ia64/efi/Makefile
+++ b/sys/boot/ia64/efi/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 NO_MAN=
+WITHOUT_SSP=
 
 .include <bsd.own.mk>
 
diff --git a/sys/boot/ia64/ski/Makefile b/sys/boot/ia64/ski/Makefile
index 42d24d19a7ac..76498d3e7116 100644
--- a/sys/boot/ia64/ski/Makefile
+++ b/sys/boot/ia64/ski/Makefile
@@ -1,6 +1,7 @@
 # $FreeBSD$
 
 NO_MAN=
+WITHOUT_SSP=
 
 .include <bsd.own.mk>
 
diff --git a/sys/boot/ofw/Makefile.inc b/sys/boot/ofw/Makefile.inc
new file mode 100644
index 000000000000..265f86d1ed55
--- /dev/null
+++ b/sys/boot/ofw/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/pc98/Makefile.inc b/sys/boot/pc98/Makefile.inc
index 5bdddeeaa5c1..418394a09636 100644
--- a/sys/boot/pc98/Makefile.inc
+++ b/sys/boot/pc98/Makefile.inc
@@ -19,3 +19,5 @@ BTXDIR=		${.CURDIR}/../btx
 BTXLDR=		${BTXDIR}/btxldr/btxldr
 BTXKERN=	${BTXDIR}/btx/btx
 BTXCRT=		${BTXDIR}/lib/crt0.o
+
+.include "../Makefile.inc"
diff --git a/sys/boot/pc98/loader/Makefile b/sys/boot/pc98/loader/Makefile
index 0ad93c1a8bb0..a8b35ff4b65d 100644
--- a/sys/boot/pc98/loader/Makefile
+++ b/sys/boot/pc98/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader.sym
diff --git a/sys/boot/powerpc/Makefile.inc b/sys/boot/powerpc/Makefile.inc
new file mode 100644
index 000000000000..265f86d1ed55
--- /dev/null
+++ b/sys/boot/powerpc/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/boot/powerpc/ofw/Makefile b/sys/boot/powerpc/ofw/Makefile
index 9b2cf8d2f7ed..2bdde765bfcc 100644
--- a/sys/boot/powerpc/ofw/Makefile
+++ b/sys/boot/powerpc/ofw/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader
diff --git a/sys/boot/sparc64/Makefile.inc b/sys/boot/sparc64/Makefile.inc
index f2170c83a8a7..ef5a7cee7413 100644
--- a/sys/boot/sparc64/Makefile.inc
+++ b/sys/boot/sparc64/Makefile.inc
@@ -3,3 +3,5 @@
 BINDIR?=	/boot
 CFLAGS+=	-ffreestanding
 LDFLAGS+=	-nostdlib
+
+.include "../Makefile.inc"
diff --git a/sys/boot/sparc64/loader/Makefile b/sys/boot/sparc64/loader/Makefile
index 784ab929c9fb..9ee93d4e2e99 100644
--- a/sys/boot/sparc64/loader/Makefile
+++ b/sys/boot/sparc64/loader/Makefile
@@ -1,5 +1,7 @@
 # $FreeBSD$
 
+WITHOUT_SSP=
+
 .include <bsd.own.mk>
 
 PROG=		loader
diff --git a/sys/boot/uboot/Makefile.inc b/sys/boot/uboot/Makefile.inc
new file mode 100644
index 000000000000..265f86d1ed55
--- /dev/null
+++ b/sys/boot/uboot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+.include "../Makefile.inc"
diff --git a/sys/conf/files b/sys/conf/files
index d558abd455bf..9261e2ed4980 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1608,6 +1608,8 @@ kern/posix4_mib.c		standard
 kern/sched_4bsd.c		optional sched_4bsd
 kern/sched_ule.c		optional sched_ule
 kern/serdev_if.m		standard
+kern/stack_protector.c		standard \
+	compile-with "${NORMAL_C:N-fstack-protector*}"
 kern/subr_acl_posix1e.c		standard
 kern/subr_autoconf.c		standard
 kern/subr_blist.c		standard
diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk
index 9583f69d24ff..374190627bdb 100644
--- a/sys/conf/kern.mk
+++ b/sys/conf/kern.mk
@@ -106,3 +106,10 @@ CFLAGS+=	-ffreestanding
 .if ${CC} == "icc"
 CFLAGS+=	-restrict
 .endif
+
+#
+# GCC SSP support.
+#
+.if ${MK_SSP} != "no" && ${CC} != "icc" && ${MACHINE_ARCH} != "ia64"
+CFLAGS+=	-fstack-protector
+.endif
diff --git a/sys/conf/kern.pre.mk b/sys/conf/kern.pre.mk
index edfcb088e191..770f3ca5ee36 100644
--- a/sys/conf/kern.pre.mk
+++ b/sys/conf/kern.pre.mk
@@ -3,10 +3,7 @@
 # Part of a unified Makefile for building kernels.  This part contains all
 # of the definitions that need to be before %BEFORE_DEPEND.
 
-SRCCONF?=	/etc/src.conf
-.if exists(${SRCCONF})
-.include "${SRCCONF}"
-.endif
+.include <bsd.own.mk>
 
 # Can be overridden by makeoptions or /etc/make.conf
 KERNEL_KO?=	kernel
diff --git a/sys/kern/stack_protector.c b/sys/kern/stack_protector.c
new file mode 100644
index 000000000000..9135c29979fe
--- /dev/null
+++ b/sys/kern/stack_protector.c
@@ -0,0 +1,35 @@
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/systm.h>
+#include <sys/libkern.h>
+
+#if defined(__SSP__) || defined(__SSP_ALL__)
+long __stack_chk_guard[8] = {};
+void __stack_chk_fail(void);
+
+void
+__stack_chk_fail(void)
+{
+
+	panic("stack overflow detected; backtrace may be corrupted");
+}
+
+#define __arraycount(__x)	(sizeof(__x) / sizeof(__x[0]))
+static void
+__stack_chk_init(void *dummy __unused)
+{
+	size_t i;
+	long guard[__arraycount(__stack_chk_guard)];
+
+	arc4rand(guard, sizeof(guard), 0);
+	for (i = 0; i < __arraycount(guard); i++)
+		__stack_chk_guard[i] = guard[i];
+}
+/* SI_SUB_EVENTHANDLER is right after SI_SUB_LOCK used by arc4rand() init. */
+SYSINIT(stack_chk, SI_SUB_EVENTHANDLER, SI_ORDER_ANY, __stack_chk_init, NULL);
+
+#endif