Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(79)

Issue 1393283005: Enable Control Flow Integrity for the official Linux Chrome. (Closed)

Created:
5 years, 2 months ago by krasin
Modified:
5 years ago
Reviewers:
Nico
CC:
chromium-reviews, pcc, kcc2
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Enable Control Flow Integrity for the official Linux Chrome. This CL turns on CFI, a security check: https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity http://clang.llvm.org/docs/ControlFlowIntegrity.html This feature enables LTO (Link-Time Optimization) builds, which slow down the linker by 3x-4x. CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is less than 1%, and should not be an issue. BUG=chromium:464797 Intent to Implement thread: https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2oklCAAJ Committed: https://crrev.com/9aedd443e02995d017138da7913e97650f889641 Cr-Commit-Position: refs/heads/master@{#362856}

Patch Set 1 #

Patch Set 2 : fix condition #

Total comments: 2

Patch Set 3 : exclude chrome os #

Patch Set 4 : . #

Patch Set 5 : restrict to x64 #

Patch Set 6 : fmt #

Patch Set 7 : gn #

Patch Set 8 : exclude ChromeOS on GN #

Patch Set 9 : Import //build/config/chrome_build.gni for is_chrome_branded #

Patch Set 10 : sync #

Unified diffs Side-by-side diffs Delta from patch set Stats (+14 lines, -4 lines) Patch
M build/common.gypi View 1 2 3 4 5 6 7 8 9 1 chunk +7 lines, -0 lines 0 comments Download
M build/config/sanitizers/sanitizers.gni View 1 2 3 4 5 6 7 8 3 chunks +7 lines, -4 lines 0 comments Download

Messages

Total messages: 43 (18 generated)
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/1
5 years, 2 months ago (2015-10-12 17:45:45 UTC) #2
commit-bot: I haz the power
Dry run: No L-G-T-M from a valid reviewer yet. Only full committers are accepted. Even ...
5 years, 2 months ago (2015-10-12 17:45:46 UTC) #4
krasin
Nico, how do I test this change? Is there a trybot for the official builds?
5 years, 2 months ago (2015-10-12 17:51:52 UTC) #6
Nico
Since update.sh checks for both buildtype=Official branding=Chrome, do you want to check for both here ...
5 years, 2 months ago (2015-10-12 18:00:56 UTC) #7
krasin
On 2015/10/12 18:00:56, Nico wrote: > Since update.sh checks for both buildtype=Official branding=Chrome, do you ...
5 years, 2 months ago (2015-10-12 18:10:59 UTC) #8
Nico
lgtm once the cros bit is resolved, and you gyp'd with this enabled and checked ...
5 years, 2 months ago (2015-10-12 18:17:29 UTC) #9
krasin
On 2015/10/12 18:17:29, Nico wrote: > lgtm once the cros bit is resolved, and you ...
5 years, 2 months ago (2015-10-12 18:41:07 UTC) #10
Nico
One more thing I keep forgetting to ask: Is there a tracking bug for getting ...
5 years, 2 months ago (2015-10-13 21:17:29 UTC) #11
krasin
On 2015/10/13 21:17:29, Nico wrote: > One more thing I keep forgetting to ask: Is ...
5 years, 2 months ago (2015-10-13 21:28:31 UTC) #12
krasin
Nico, GN support is done. The buildbot CL is https://codereview.chromium.org/1478863004/ Please, take a final look. ...
5 years ago (2015-11-30 19:45:45 UTC) #13
Nico
lgtm (again assuming you checked that a gn build actually ends up passing the right ...
5 years ago (2015-11-30 20:04:53 UTC) #14
krasin
On 2015/11/30 20:04:53, Nico wrote: > lgtm (again assuming you checked that a gn build ...
5 years ago (2015-11-30 21:27:22 UTC) #15
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/140001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/140001
5 years ago (2015-12-02 01:30:06 UTC) #17
commit-bot: I haz the power
Dry run: Try jobs failed on following builders: mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_ng/builds/148469)
5 years ago (2015-12-02 02:14:08 UTC) #19
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/140001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/140001
5 years ago (2015-12-02 02:17:48 UTC) #21
commit-bot: I haz the power
Dry run: Try jobs failed on following builders: linux_chromium_compile_dbg_ng on tryserver.chromium.linux (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_compile_dbg_ng/builds/20972) linux_chromium_rel_ng on ...
5 years ago (2015-12-02 02:30:34 UTC) #23
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/160001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/160001
5 years ago (2015-12-02 02:30:55 UTC) #25
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/180001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/180001
5 years ago (2015-12-02 02:37:29 UTC) #27
commit-bot: I haz the power
Dry run: This issue passed the CQ dry run.
5 years ago (2015-12-02 03:56:26 UTC) #29
commit-bot: I haz the power
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/180001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/180001
5 years ago (2015-12-03 00:50:34 UTC) #34
commit-bot: I haz the power
Dry run: This issue passed the CQ dry run.
5 years ago (2015-12-03 01:15:33 UTC) #36
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1393283005/180001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1393283005/180001
5 years ago (2015-12-03 01:18:40 UTC) #38
commit-bot: I haz the power
Committed patchset #10 (id:180001)
5 years ago (2015-12-03 01:53:16 UTC) #40
commit-bot: I haz the power
Patchset 10 (id:??) landed as https://crrev.com/9aedd443e02995d017138da7913e97650f889641 Cr-Commit-Position: refs/heads/master@{#362856}
5 years ago (2015-12-03 01:54:48 UTC) #42
krasin
5 years ago (2015-12-03 04:13:47 UTC) #43
Message was sent while issue was closed.
A revert of this CL (patchset #10 id:180001) has been created in
https://codereview.chromium.org/1498723002/ by krasin@google.com.

The reason for reverting is: One of the buildbots timed out while linking
Chrome:
https://build.chromium.org/p/chromium.chrome/builders/Google%20Chrome%20Linux....

Powered by Google App Engine
This is Rietveld 408576698