edgexfoundry / edgexfoundry/edgex-go

Support go compiler flags for address sanitization and spectre mitigations

Open
#4,591 0 comments 0 reactions 0 assignees View on GitHub
1-low enhancement security_audit
Dominant language
Go
Stars
1.5k
Forks
520
Avg merge
18h 17m
Merged PRs (30d)
3

Description

# 🚀 Feature Request

### Relevant Package [**REQUIRED**]
All golang components.

### Description [**REQUIRED**]
A number of new security flags have been added to golang that should be integrated into our makefiles.

For binaries that interact with legacy C libraries, we should enable address sanitization, `-msan -asan` :
https://github.com/golang/go/issues/44853

There are also flags to mitigate against speculative execution attacks, `-spectre=index,ret`
https://zchee.github.io/golang-wiki/Spectre/

Potentially, can do this:
GOFLAGS=-trimpath -mod=readonly -asmflags=all="-spectre=all" -gcflags=all="-spectre=all" -ldflags="-s -w"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.