Build official build using `buildmode=pie`, relro, stack protection
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 431
- Forks
- 44
- Avg merge
- 21h 18m
- Merged PRs (30d)
- 30
Description
Normally, Go builds without PIE (Position Independent Executable) or other C-style security measures because these attacks are dealt with at a language/runtime level: https://groups.google.com/g/golang-nuts/c/Jd9tlNc6jUE. However, Go compiles to native binaries, so our SDL tooling (binskim) treats it like any other binary and scans for these security measures.
Cgo and unsafe may make it worthwhile to apply the C-style security measures to Go, but this is debatable.
- For PIE mode, you can pass
-buildmode=pie: https://golang.org/cmd/go/#hdr-Build_modes relrois automatically enabled bypiebuild mode, since https://go-review.googlesource.com/c/go/+/22687/- Stack protection doesn't exist for Go, but can be enabled in Cgo using the standard compiler flag:
-fstack-protectorhttps://github.com/golang/go/issues/21871
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no repository files, tests, or build entry points. Start by reviewing the official Go buildmode=pie documentation and the binskim expectations, then assess how cgo flags would apply; done requires a decided build configuration that satisfies the intended security checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100