Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame^] | 1 | ====================== |
| 2 | Control Flow Integrity |
| 3 | ====================== |
| 4 | |
| 5 | .. toctree:: |
| 6 | :hidden: |
| 7 | |
| 8 | ControlFlowIntegrityDesign |
| 9 | |
| 10 | .. contents:: |
| 11 | :local: |
| 12 | |
| 13 | Introduction |
| 14 | ============ |
| 15 | |
| 16 | Clang includes an implementation of a number of control flow integrity (CFI) |
| 17 | schemes, which are designed to abort the program upon detecting certain forms |
| 18 | of undefined behavior that can potentially allow attackers to subvert the |
| 19 | program's control flow. These schemes have been optimized for performance, |
| 20 | allowing developers to enable them in release builds. |
| 21 | |
| 22 | To enable Clang's available CFI schemes, use the flag ``-fsanitize=cfi``. |
| 23 | As currently implemented, CFI relies on link-time optimization (LTO); the CFI |
| 24 | schemes imply ``-flto``, and the linker used must support LTO, for example |
| 25 | via the `gold plugin`_. To allow the checks to be implemented efficiently, |
| 26 | the program must be structured such that certain object files are compiled |
| 27 | with CFI enabled, and are statically linked into the program. This may |
| 28 | preclude the use of shared libraries in some cases. |
| 29 | |
| 30 | Clang currently implements forward-edge CFI for virtual calls. More schemes |
| 31 | are under development. |
| 32 | |
| 33 | .. _gold plugin: http://llvm.org/docs/GoldPlugin.html |
| 34 | |
| 35 | Forward-Edge CFI for Virtual Calls |
| 36 | ---------------------------------- |
| 37 | |
| 38 | This scheme checks that virtual calls take place using a vptr of the correct |
| 39 | dynamic type; that is, the dynamic type of the called object must be a |
| 40 | derived class of the static type of the object used to make the call. |
| 41 | This CFI scheme can be enabled on its own using ``-fsanitize=cfi-vptr``. |
| 42 | |
| 43 | For this scheme to work, all translation units containing the definition |
| 44 | of a virtual member function (whether inline or not) must be compiled |
| 45 | with ``-fsanitize=cfi-vptr`` enabled and be statically linked into the |
| 46 | program. Classes in the C++ standard library (under namespace ``std``) are |
| 47 | exempted from checking, and therefore programs may be linked against a |
| 48 | pre-built standard library, but this may change in the future. |
| 49 | |
| 50 | Performance |
| 51 | ~~~~~~~~~~~ |
| 52 | |
| 53 | A performance overhead of less than 1% has been measured by running the |
| 54 | Dromaeo benchmark suite against an instrumented version of the Chromium |
| 55 | web browser. Another good performance benchmark for this mechanism is the |
| 56 | virtual-call-heavy SPEC 2006 xalancbmk. |
| 57 | |
| 58 | Note that this scheme has not yet been optimized for binary size; an increase |
| 59 | of up to 15% has been observed for Chromium. |
| 60 | |
| 61 | Design |
| 62 | ------ |
| 63 | |
| 64 | Please refer to the :doc:`design document<ControlFlowIntegrityDesign>`. |
| 65 | |
| 66 | Publications |
| 67 | ------------ |
| 68 | |
| 69 | `Control-Flow Integrity: Principles, Implementations, and Applications <http://research.microsoft.com/pubs/64250/ccs05.pdf>`_. |
| 70 | Martin Abadi, Mihai Budiu, Úlfar Erlingsson, Jay Ligatti. |
| 71 | |
| 72 | `Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM <http://www.pcc.me.uk/~peter/acad/usenix14.pdf>`_. |
| 73 | Caroline Tice, Tom Roeder, Peter Collingbourne, Stephen Checkoway, |
| 74 | Úlfar Erlingsson, Luis Lozano, Geoff Pike. |