|
 |
00e791 |
From 10d6e3d90f1ea504a1dedaea50478c444e92951c Mon Sep 17 00:00:00 2001
|
|
|
24a050 |
From: Peter Jones <pjones@redhat.com>
|
|
|
24a050 |
Date: Fri, 15 Mar 2019 09:52:02 -0400
|
|
|
00e791 |
Subject: [PATCH 29/62] Once again, try even harder to get binaries without
|
|
|
24a050 |
timestamps in them.
|
|
|
24a050 |
MIME-Version: 1.0
|
|
|
24a050 |
Content-Type: text/plain; charset=UTF-8
|
|
|
24a050 |
Content-Transfer-Encoding: 8bit
|
|
|
24a050 |
|
|
|
24a050 |
$ objdump -x /builddir/build/BUILDROOT/shim-*/usr/share/shim/*/shimx64.efi | grep 'Time/Date'
|
|
|
24a050 |
Time/Date Thu Jan 1 00:00:08 1970
|
|
|
24a050 |
$ _
|
|
|
24a050 |
|
|
|
24a050 |
"What is despair? I have known it—hear my song. Despair is when you’re
|
|
|
24a050 |
debugging a kernel driver and you look at a memory dump and you see that
|
|
|
24a050 |
a pointer has a value of 7."
|
|
|
24a050 |
- http://scholar.harvard.edu/files/mickens/files/thenightwatch.pdf
|
|
|
24a050 |
|
|
|
24a050 |
objcopy only knows about -D for some targets.
|
|
|
24a050 |
ld only believes in --no-insert-timestamp in some versions.
|
|
|
24a050 |
dd takes off and nukes the site from orbit.
|
|
|
24a050 |
|
|
|
24a050 |
It's the only way to be sure.
|
|
|
24a050 |
|
|
|
24a050 |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
00e791 |
Upstream-commit-id: a4a1fbe728c
|
|
|
24a050 |
---
|
|
|
24a050 |
Make.defaults | 4 ++++
|
|
|
24a050 |
Makefile | 6 ++++--
|
|
|
24a050 |
2 files changed, 8 insertions(+), 2 deletions(-)
|
|
|
24a050 |
|
|
|
24a050 |
diff --git a/Make.defaults b/Make.defaults
|
|
|
00e791 |
index 09807bd8108..f0bfa9fd573 100644
|
|
|
24a050 |
--- a/Make.defaults
|
|
|
24a050 |
+++ b/Make.defaults
|
|
|
00e791 |
@@ -50,6 +50,7 @@ ifeq ($(ARCH),x86_64)
|
|
|
24a050 |
ARCH_SUFFIX ?= x64
|
|
|
24a050 |
ARCH_SUFFIX_UPPER ?= X64
|
|
|
24a050 |
ARCH_LDFLAGS ?=
|
|
|
24a050 |
+ TIMESTAMP_LOCATION := 136
|
|
|
24a050 |
endif
|
|
|
24a050 |
ifeq ($(ARCH),ia32)
|
|
|
00e791 |
ARCH_CFLAGS ?= -mno-mmx -mno-sse -mno-red-zone -nostdinc \
|
|
|
00e791 |
@@ -60,6 +61,7 @@ ifeq ($(ARCH),ia32)
|
|
|
24a050 |
ARCH_SUFFIX_UPPER ?= IA32
|
|
|
24a050 |
ARCH_LDFLAGS ?=
|
|
|
00e791 |
ARCH_CFLAGS ?= -m32
|
|
|
24a050 |
+ TIMESTAMP_LOCATION := 136
|
|
|
24a050 |
endif
|
|
|
24a050 |
ifeq ($(ARCH),aarch64)
|
|
|
00e791 |
ARCH_CFLAGS ?= -DMDE_CPU_AARCH64 -DPAGE_SIZE=4096 -mstrict-align
|
|
|
00e791 |
@@ -70,6 +72,7 @@ ifeq ($(ARCH),aarch64)
|
|
|
24a050 |
SUBSYSTEM := 0xa
|
|
|
24a050 |
ARCH_LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
|
|
|
00e791 |
ARCH_CFLAGS ?=
|
|
|
24a050 |
+ TIMESTAMP_LOCATION := 72
|
|
|
24a050 |
endif
|
|
|
24a050 |
ifeq ($(ARCH),arm)
|
|
|
00e791 |
ARCH_CFLAGS ?= -DMDE_CPU_ARM -DPAGE_SIZE=4096 -mno-unaligned-access
|
|
|
00e791 |
@@ -79,6 +82,7 @@ ifeq ($(ARCH),arm)
|
|
|
24a050 |
FORMAT := -O binary
|
|
|
24a050 |
SUBSYSTEM := 0xa
|
|
|
24a050 |
ARCH_LDFLAGS += --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
|
|
|
24a050 |
+ TIMESTAMP_LOCATION := 72
|
|
|
24a050 |
endif
|
|
|
24a050 |
|
|
|
00e791 |
CFLAGS = -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
|
|
|
24a050 |
diff --git a/Makefile b/Makefile
|
|
|
00e791 |
index fd7e83dc764..49e14a26521 100644
|
|
|
24a050 |
--- a/Makefile
|
|
|
24a050 |
+++ b/Makefile
|
|
|
24a050 |
@@ -189,11 +189,13 @@ endif
|
|
|
24a050 |
ifneq ($(OBJCOPY_GTE224),1)
|
|
|
24a050 |
$(error objcopy >= 2.24 is required)
|
|
|
24a050 |
endif
|
|
|
24a050 |
- $(OBJCOPY) -j .text -j .sdata -j .data -j .data.ident \
|
|
|
24a050 |
+ $(OBJCOPY) -D -j .text -j .sdata -j .data -j .data.ident \
|
|
|
24a050 |
-j .dynamic -j .dynsym -j .rel* \
|
|
|
24a050 |
-j .rela* -j .reloc -j .eh_frame \
|
|
|
24a050 |
-j .vendor_cert \
|
|
|
24a050 |
$(FORMAT) $^ $@
|
|
|
24a050 |
+ # I am tired of wasting my time fighting binutils timestamp code.
|
|
|
24a050 |
+ dd conv=notrunc bs=1 count=4 seek=$(TIMESTAMP_LOCATION) if=/dev/zero of=$@
|
|
|
24a050 |
|
|
|
24a050 |
ifneq ($(origin ENABLE_SHIM_HASH),undefined)
|
|
|
24a050 |
%.hash : %.efi
|
|
|
24a050 |
@@ -204,7 +206,7 @@ endif
|
|
|
24a050 |
ifneq ($(OBJCOPY_GTE224),1)
|
|
|
24a050 |
$(error objcopy >= 2.24 is required)
|
|
|
24a050 |
endif
|
|
|
24a050 |
- $(OBJCOPY) -j .text -j .sdata -j .data \
|
|
|
24a050 |
+ $(OBJCOPY) -D -j .text -j .sdata -j .data \
|
|
|
24a050 |
-j .dynamic -j .dynsym -j .rel* \
|
|
|
24a050 |
-j .rela* -j .reloc -j .eh_frame \
|
|
|
24a050 |
-j .debug_info -j .debug_abbrev -j .debug_aranges \
|
|
|
24a050 |
--
|
|
|
00e791 |
2.26.2
|
|
|
24a050 |
|