Documentation
¶
Overview ¶
Package elf provides built-in ELF security hardening rules.
Index ¶
- Constants
- type ARMBTIRule
- type ARMBranchProtectionRule
- type ARMMTERule
- type ARMPACRule
- type ASANRule
- type ASLRRule
- type CFIRule
- type FortifySourceRule
- type FullRELRORule
- type NXBitRule
- type NoDLOpenRule
- type NoDumpRule
- type NoInsecureRPATHRule
- type NoInsecureRUNPATHRule
- type PIERule
- type RELRORule
- type SafeStackRule
- type SeparateCodeRule
- type StackCanaryRule
- type StackLimitRule
- type StrippedRule
- type UBSanRule
- type X86CETIBTRule
- type X86CETShadowStackRule
- type X86RetpolineRule
Constants ¶
const ARMBTIRuleID = "arm-bti"
ARMBTIRuleID is the rule ID for ARM BTI.
const ARMBranchProtectionRuleID = "arm-branch-protection"
ARMBranchProtectionRuleID is the rule ID for ARM branch protection.
const ARMMTERuleID = "arm-mte"
ARMMTERuleID is the rule ID for ARM MTE.
const ARMPACRuleID = "arm-pac"
ARMPACRuleID is the rule ID for ARM PAC.
const ASANRuleID = "asan"
ASANRuleID is the rule ID for ASan.
const ASLRRuleID = "aslr"
ASLRRuleID is the rule ID for ASLR compatibility.
const CFIRuleID = "cfi"
CFIRuleID is the rule ID for CFI.
const FortifySourceRuleID = "fortify-source"
FortifySourceRuleID is the rule ID for FORTIFY_SOURCE.
const FullRELRORuleID = "full-relro"
FullRELRORuleID is the rule ID for full RELRO.
const NXBitRuleID = "nx-bit"
NXBitRuleID is the rule ID for NX bit.
const NoDLOpenRuleID = "no-dlopen"
NoDLOpenRuleID is the rule ID for no dlopen.
const NoDumpRuleID = "no-dump"
NoDumpRuleID is the rule ID for no dump.
const NoInsecureRPATHRuleID = "no-insecure-rpath"
NoInsecureRPATHRuleID is the rule ID for secure RPATH.
const NoInsecureRUNPATHRuleID = "no-insecure-runpath"
NoInsecureRUNPATHRuleID is the rule ID for secure RUNPATH.
const PIERuleID = "pie"
PIERuleID is the rule ID for PIE.
const RELRORuleID = "relro"
RELRORuleID is the rule ID for partial RELRO.
const SafeStackRuleID = "safe-stack"
SafeStackRuleID is the rule ID for SafeStack.
const SeparateCodeRuleID = "separate-code"
SeparateCodeRuleID is the rule ID for separate code.
const StackCanaryRuleID = "stack-canary"
StackCanaryRuleID is the rule ID for stack canary.
const StackLimitRuleID = "stack-limit"
StackLimitRuleID is the rule ID for stack limit.
const StrippedRuleID = "stripped"
StrippedRuleID is the rule ID for stripped binary.
const UBSanRuleID = "ubsan"
UBSanRuleID is the rule ID for UBSan.
const X86CETIBTRuleID = "x86-cet-ibt"
X86CETIBTRuleID is the rule ID for CET IBT.
const X86CETShadowStackRuleID = "x86-cet-shstk"
X86CETShadowStackRuleID is the rule ID for CET Shadow Stack.
const X86RetpolineRuleID = "x86-retpoline"
X86RetpolineRuleID is the rule ID for retpoline.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ARMBTIRule ¶
type ARMBTIRule struct{}
ARMBTIRule checks for ARM Branch Target Identification.
func (ARMBTIRule) Applicability ¶
func (r ARMBTIRule) Applicability() rule.Applicability
func (ARMBTIRule) Description ¶
func (r ARMBTIRule) Description() string
func (ARMBTIRule) ID ¶
func (r ARMBTIRule) ID() string
func (ARMBTIRule) Name ¶
func (r ARMBTIRule) Name() string
type ARMBranchProtectionRule ¶
type ARMBranchProtectionRule struct{}
ARMBranchProtectionRule checks for ARM branch protection (PAC+BTI). ARM: https://developer.arm.com/documentation/ddi0487/latest GCC: https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html#index-mbranch-protection Clang: https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-mbranch-protection
func (ARMBranchProtectionRule) Applicability ¶
func (r ARMBranchProtectionRule) Applicability() rule.Applicability
func (ARMBranchProtectionRule) Description ¶
func (r ARMBranchProtectionRule) Description() string
func (ARMBranchProtectionRule) Execute ¶
func (r ARMBranchProtectionRule) Execute(bin *binary.ELFBinary) rule.Result
func (ARMBranchProtectionRule) ID ¶
func (r ARMBranchProtectionRule) ID() string
func (ARMBranchProtectionRule) Name ¶
func (r ARMBranchProtectionRule) Name() string
type ARMMTERule ¶
type ARMMTERule struct{}
ARMMTERule checks for ARM Memory Tagging Extension. ARM: https://developer.arm.com/documentation/ddi0487/latest LLVM: https://llvm.org/docs/MemTagSanitizer.html
func (ARMMTERule) Applicability ¶
func (r ARMMTERule) Applicability() rule.Applicability
func (ARMMTERule) Description ¶
func (r ARMMTERule) Description() string
func (ARMMTERule) ID ¶
func (r ARMMTERule) ID() string
func (ARMMTERule) Name ¶
func (r ARMMTERule) Name() string
type ARMPACRule ¶
type ARMPACRule struct{}
ARMPACRule checks for ARM Pointer Authentication Code. ARM: https://developer.arm.com/documentation/ddi0487/latest GCC: https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html#index-mbranch-protection Clang: https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-mbranch-protection
func (ARMPACRule) Applicability ¶
func (r ARMPACRule) Applicability() rule.Applicability
func (ARMPACRule) Description ¶
func (r ARMPACRule) Description() string
func (ARMPACRule) ID ¶
func (r ARMPACRule) ID() string
func (ARMPACRule) Name ¶
func (r ARMPACRule) Name() string
type ASANRule ¶
type ASANRule struct{}
ASANRule checks for AddressSanitizer instrumentation. Clang: https://clang.llvm.org/docs/AddressSanitizer.html GCC: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fsanitize=address
func (ASANRule) Applicability ¶
func (r ASANRule) Applicability() rule.Applicability
func (ASANRule) Description ¶
type ASLRRule ¶
type ASLRRule struct{}
ASLRRule checks if binary is ASLR compatible. Linux Kernel: https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/sysctl/kernel.rst
func (ASLRRule) Applicability ¶
func (r ASLRRule) Applicability() rule.Applicability
func (ASLRRule) Description ¶
type CFIRule ¶
type CFIRule struct{}
CFIRule checks for Clang Control Flow Integrity. https://clang.llvm.org/docs/ControlFlowIntegrity.html
func (CFIRule) Applicability ¶
func (r CFIRule) Applicability() rule.Applicability
func (CFIRule) Description ¶
type FortifySourceRule ¶
type FortifySourceRule struct{}
FortifySourceRule checks for FORTIFY_SOURCE protection. glibc: https://sourceware.org/glibc/wiki/FortifySourceLevel3 GCC: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-D_FORTIFY_SOURCE
func (FortifySourceRule) Applicability ¶
func (r FortifySourceRule) Applicability() rule.Applicability
func (FortifySourceRule) Description ¶
func (r FortifySourceRule) Description() string
func (FortifySourceRule) Execute ¶
func (r FortifySourceRule) Execute(bin *binary.ELFBinary) rule.Result
func (FortifySourceRule) ID ¶
func (r FortifySourceRule) ID() string
func (FortifySourceRule) Name ¶
func (r FortifySourceRule) Name() string
type FullRELRORule ¶
type FullRELRORule struct{}
FullRELRORule checks for full RELRO protection. ld: https://sourceware.org/binutils/docs/ld/Options.html
func (FullRELRORule) Applicability ¶
func (r FullRELRORule) Applicability() rule.Applicability
func (FullRELRORule) Description ¶
func (r FullRELRORule) Description() string
func (FullRELRORule) ID ¶
func (r FullRELRORule) ID() string
func (FullRELRORule) Name ¶
func (r FullRELRORule) Name() string
type NXBitRule ¶
type NXBitRule struct{}
NXBitRule checks for non-executable stack. GCC: https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html#index-z
func (NXBitRule) Applicability ¶
func (r NXBitRule) Applicability() rule.Applicability
func (NXBitRule) Description ¶
type NoDLOpenRule ¶
type NoDLOpenRule struct{}
NoDLOpenRule checks if dlopen is disabled. ld: https://sourceware.org/binutils/docs/ld/Options.html#index-z-keyword
func (NoDLOpenRule) Applicability ¶
func (r NoDLOpenRule) Applicability() rule.Applicability
func (NoDLOpenRule) Description ¶
func (r NoDLOpenRule) Description() string
func (NoDLOpenRule) ID ¶
func (r NoDLOpenRule) ID() string
func (NoDLOpenRule) Name ¶
func (r NoDLOpenRule) Name() string
type NoDumpRule ¶
type NoDumpRule struct{}
NoDumpRule checks if core dumps are disabled. ld: https://sourceware.org/binutils/docs/ld/Options.html#index-z-keyword
func (NoDumpRule) Applicability ¶
func (r NoDumpRule) Applicability() rule.Applicability
func (NoDumpRule) Description ¶
func (r NoDumpRule) Description() string
func (NoDumpRule) ID ¶
func (r NoDumpRule) ID() string
func (NoDumpRule) Name ¶
func (r NoDumpRule) Name() string
type NoInsecureRPATHRule ¶
type NoInsecureRPATHRule struct{}
NoInsecureRPATHRule checks for insecure RPATH values. ld: https://sourceware.org/binutils/docs/ld/Options.html
func (NoInsecureRPATHRule) Applicability ¶
func (r NoInsecureRPATHRule) Applicability() rule.Applicability
func (NoInsecureRPATHRule) Description ¶
func (r NoInsecureRPATHRule) Description() string
func (NoInsecureRPATHRule) Execute ¶
func (r NoInsecureRPATHRule) Execute(bin *binary.ELFBinary) rule.Result
func (NoInsecureRPATHRule) ID ¶
func (r NoInsecureRPATHRule) ID() string
func (NoInsecureRPATHRule) Name ¶
func (r NoInsecureRPATHRule) Name() string
type NoInsecureRUNPATHRule ¶
type NoInsecureRUNPATHRule struct{}
NoInsecureRUNPATHRule checks for insecure RUNPATH values. ld: https://sourceware.org/binutils/docs/ld/Options.html
func (NoInsecureRUNPATHRule) Applicability ¶
func (r NoInsecureRUNPATHRule) Applicability() rule.Applicability
func (NoInsecureRUNPATHRule) Description ¶
func (r NoInsecureRUNPATHRule) Description() string
func (NoInsecureRUNPATHRule) Execute ¶
func (r NoInsecureRUNPATHRule) Execute(bin *binary.ELFBinary) rule.Result
func (NoInsecureRUNPATHRule) ID ¶
func (r NoInsecureRUNPATHRule) ID() string
func (NoInsecureRUNPATHRule) Name ¶
func (r NoInsecureRUNPATHRule) Name() string
type PIERule ¶
type PIERule struct{}
PIERule checks if binary is compiled as Position Independent Executable. GCC: https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html#index-fPIE Clang: https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-fpie
func (PIERule) Applicability ¶
func (r PIERule) Applicability() rule.Applicability
func (PIERule) Description ¶
type RELRORule ¶
type RELRORule struct{}
RELRORule checks for partial RELRO. ld: https://sourceware.org/binutils/docs/ld/Options.html
func (RELRORule) Applicability ¶
func (r RELRORule) Applicability() rule.Applicability
func (RELRORule) Description ¶
type SafeStackRule ¶
type SafeStackRule struct{}
SafeStackRule checks for SafeStack protection. Clang: https://clang.llvm.org/docs/SafeStack.html LLVM: https://llvm.org/docs/SafeStack.html
func (SafeStackRule) Applicability ¶
func (r SafeStackRule) Applicability() rule.Applicability
func (SafeStackRule) Description ¶
func (r SafeStackRule) Description() string
func (SafeStackRule) ID ¶
func (r SafeStackRule) ID() string
func (SafeStackRule) Name ¶
func (r SafeStackRule) Name() string
type SeparateCodeRule ¶
type SeparateCodeRule struct{}
SeparateCodeRule checks if code and data are in separate pages. ld: https://sourceware.org/binutils/docs/ld/Options.html#index-z-keyword
func (SeparateCodeRule) Applicability ¶
func (r SeparateCodeRule) Applicability() rule.Applicability
func (SeparateCodeRule) Description ¶
func (r SeparateCodeRule) Description() string
func (SeparateCodeRule) Execute ¶
func (r SeparateCodeRule) Execute(bin *binary.ELFBinary) rule.Result
func (SeparateCodeRule) ID ¶
func (r SeparateCodeRule) ID() string
func (SeparateCodeRule) Name ¶
func (r SeparateCodeRule) Name() string
type StackCanaryRule ¶
type StackCanaryRule struct{}
StackCanaryRule checks for stack canary protection. GCC: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector Clang: https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-fstack-protector-strong
func (StackCanaryRule) Applicability ¶
func (r StackCanaryRule) Applicability() rule.Applicability
func (StackCanaryRule) Description ¶
func (r StackCanaryRule) Description() string
func (StackCanaryRule) Execute ¶
func (r StackCanaryRule) Execute(bin *binary.ELFBinary) rule.Result
func (StackCanaryRule) ID ¶
func (r StackCanaryRule) ID() string
func (StackCanaryRule) Name ¶
func (r StackCanaryRule) Name() string
type StackLimitRule ¶
type StackLimitRule struct{}
StackLimitRule checks for explicit stack size limit. ld: https://sourceware.org/binutils/docs/ld/Options.html#index-z-keyword
func (StackLimitRule) Applicability ¶
func (r StackLimitRule) Applicability() rule.Applicability
func (StackLimitRule) Description ¶
func (r StackLimitRule) Description() string
func (StackLimitRule) ID ¶
func (r StackLimitRule) ID() string
func (StackLimitRule) Name ¶
func (r StackLimitRule) Name() string
type StrippedRule ¶
type StrippedRule struct{}
StrippedRule checks if binary is fully stripped. ld: https://sourceware.org/binutils/docs/ld/Options.html#index-_002d_002dstrip_002dall
func (StrippedRule) Applicability ¶
func (r StrippedRule) Applicability() rule.Applicability
func (StrippedRule) Description ¶
func (r StrippedRule) Description() string
func (StrippedRule) ID ¶
func (r StrippedRule) ID() string
func (StrippedRule) Name ¶
func (r StrippedRule) Name() string
type UBSanRule ¶
type UBSanRule struct{}
UBSanRule checks for Undefined Behavior Sanitizer. Clang: https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html GCC: https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fsanitize=undefined
func (UBSanRule) Applicability ¶
func (r UBSanRule) Applicability() rule.Applicability
func (UBSanRule) Description ¶
type X86CETIBTRule ¶
type X86CETIBTRule struct{}
X86CETIBTRule checks for CET Indirect Branch Tracking (Intel/AMD). GCC: https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-fcf-protection
func (X86CETIBTRule) Applicability ¶
func (r X86CETIBTRule) Applicability() rule.Applicability
func (X86CETIBTRule) Description ¶
func (r X86CETIBTRule) Description() string
func (X86CETIBTRule) ID ¶
func (r X86CETIBTRule) ID() string
func (X86CETIBTRule) Name ¶
func (r X86CETIBTRule) Name() string
type X86CETShadowStackRule ¶
type X86CETShadowStackRule struct{}
X86CETShadowStackRule checks for CET Shadow Stack (Intel/AMD). GCC: https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-fcf-protection
func (X86CETShadowStackRule) Applicability ¶
func (r X86CETShadowStackRule) Applicability() rule.Applicability
func (X86CETShadowStackRule) Description ¶
func (r X86CETShadowStackRule) Description() string
func (X86CETShadowStackRule) Execute ¶
func (r X86CETShadowStackRule) Execute(bin *binary.ELFBinary) rule.Result
func (X86CETShadowStackRule) ID ¶
func (r X86CETShadowStackRule) ID() string
func (X86CETShadowStackRule) Name ¶
func (r X86CETShadowStackRule) Name() string
type X86RetpolineRule ¶
type X86RetpolineRule struct{}
X86RetpolineRule checks for Spectre v2 mitigation (retpoline). GCC: https://gcc.gnu.org/onlinedocs/gcc/x86-Options.html#index-mindirect-branch Clang: https://clang.llvm.org/docs/ClangCommandLineReference.html#cmdoption-clang-mretpoline
func (X86RetpolineRule) Applicability ¶
func (r X86RetpolineRule) Applicability() rule.Applicability
func (X86RetpolineRule) Description ¶
func (r X86RetpolineRule) Description() string
func (X86RetpolineRule) Execute ¶
func (r X86RetpolineRule) Execute(bin *binary.ELFBinary) rule.Result
func (X86RetpolineRule) ID ¶
func (r X86RetpolineRule) ID() string
func (X86RetpolineRule) Name ¶
func (r X86RetpolineRule) Name() string
Source Files
¶
- arm_branch_protection.go
- arm_bti.go
- arm_mte.go
- arm_pac.go
- asan.go
- aslr.go
- cfi.go
- doc.go
- fortify_source.go
- full_relro.go
- no_dlopen.go
- no_dump.go
- no_insecure_rpath.go
- no_insecure_runpath.go
- nx_bit.go
- pie.go
- relro.go
- safe_stack.go
- separate_code.go
- stack_canary.go
- stack_limit.go
- stripped.go
- ubsan.go
- x86_cet_ibt.go
- x86_cet_shstk.go
- x86_retpoline.go