Load dependencies by name #1594

aleksei-fedotov · 2025-01-07T16:57:12Z

Description

This PR allows loading dependencies by module name only as it is proposed in this RFC. In particular, it:

Verifies signatures of all loaded modules.
Changes loading of Thread Composability Manager using its module name instead of full path.

The signature verification is enabled by default. To disable it explicitly, user needs specifying -DTBB_VERIFY_DEPENDENCY_SIGNATURE=OFF in the invocation command of CMake. In this case the warning message appears:

CMake Warning at CMakeLists.txt:231 (message):
  Verification of a dependency signature during dynamic run-time linking is
  explicitly disabled.This may lead to security vulnerabilities.  It is
  recommended to leave it enabled by default or set
  TBB_VERIFY_DEPENDENCY_SIGNATURE ON to enable it explicitly.

The patch also adds optional reporting of dynamic link issues. Examples of the output:

oneTBB dynamic link warning: The module "<path-to-dll>" is unsigned or has invalid signature.
oneTBB dynamic link warning: The module "<path-to-dll>" was not found. System error: 126

The issues reporting is disabled by default and can be enabled by setting TBB_DYNAMIC_LINK_WARNING macro during the build.

CMakeLists.txt

src/tbb/dynamic_link.cpp

egfefey · 2025-01-13T17:16:10Z

src/tbb/dynamic_link.cpp

+            DYNAMIC_LINK_WARNING( dl_sig_other_error, filepath, retval);
+            break;
+        }
+    }


Similar here: Is the case for an expired certificate covered somewhere?

It is covered by untrusted root case as the whole chain of certificates is checked.

src/tbb/dynamic_link.cpp

src/tbb/CMakeLists.txt

egfefey · 2025-01-17T21:54:55Z

src/tbb/dynamic_link.cpp

+        pWVTData.dwProvFlags         = WTD_CACHE_ONLY_URL_RETRIEVAL | WTD_REVOCATION_CHECK_CHAIN;
+        pWVTData.dwUIContext         = WTD_UICONTEXT_EXECUTE;          // UI Context to run the file
+
+        const auto rc = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &pgActionID, &pWVTData);


Better to use LONG instead of auto to prevent ambiguity and unintended typecasting when doing comparisons later with the return code from WinVerifyTrust

egfefey

From the security standpoint, this is good for now.
A few notes:

This is still up for discussion but anything beside ERROR_SUCCESS from WinVerifyTrust should result in an error instead of a warning sometimes. The user always has to option to turn off signature verification if they want, so once it's on, it's either success or failure.
Might also need review from the TBB team.
If there are some testing results that we can share, that will be great.

egfefey

Update to use SearchPathA is good from the security point of view.

Signed-off-by: Fedotov, Aleksei <[email protected]>

aleksei-fedotov · 2025-01-29T11:06:39Z

Update to use SearchPathA is good from the security point of view.

Thanks, @egfefey! Then I proceed with productization of this patch.

isaevil · 2025-02-11T14:51:16Z

CMakeLists.txt

@@ -122,6 +122,7 @@ cmake_dependent_option(TBBMALLOC_PROXY_BUILD "Enable tbbmalloc_proxy build" ON "
 option(TBB_CPF "Enable preview features of the library" OFF)
 option(TBB_FIND_PACKAGE "Enable search for external oneTBB using find_package instead of build from sources" OFF)
 option(TBB_DISABLE_HWLOC_AUTOMATIC_SEARCH "Disable HWLOC automatic search by pkg-config tool" ${CMAKE_CROSSCOMPILING})
+option(TBB_VERIFY_DEPENDENCY_SIGNATURE "Verify signature of a dependency during its dynamic run-time linking" ON)


Please document this option in cmake/README.md as well.

Good point!

Also, I wanted reverting the meaning by re-naming it as, for example, TBB_SKIP_DEPENDENCY_SIGNATURE_VALIDATION to extend the compilation command only if user disables validation, and miss it for the normal builds.
Additionally, but less important is to make the option longer so that users are less leaner towards using it. 🙂

I personally prefer the current name :)

isaevil · 2025-02-11T15:01:27Z

CMakeLists.txt

+        "This may lead to security vulnerabilities. It is recommended to leave it enabled by default"
+        " or set TBB_VERIFY_DEPENDENCY_SIGNATURE ON to enable it explicitly.")


What about making it shorter a little bit?

Suggested change

"This may lead to security vulnerabilities. It is recommended to leave it enabled by default"

" or set TBB_VERIFY_DEPENDENCY_SIGNATURE ON to enable it explicitly.")

"This may lead to security vulnerabilities. It is recommended to set "

"TBB_VERIFY_DEPENDENCY_SIGNATURE to ON (default value)")

isaevil · 2025-02-11T15:03:15Z

src/tbb/CMakeLists.txt

+if (TBB_VERIFY_DEPENDENCY_SIGNATURE)
+    target_compile_definitions(tbb PRIVATE __TBB_VERIFY_DEPENDENCY_SIGNATURE)
+endif()


See target_compile_definitions call at line 58. You should be able to use the same pattern as for BUILD_SHARED_LIBS.

github-actions bot added the enhancement label Jan 7, 2025

aleksei-fedotov marked this pull request as ready for review January 8, 2025 16:11

aleksei-fedotov requested review from pavelkumbrasev and removed request for pavelkumbrasev January 8, 2025 16:11

egfefey reviewed Jan 9, 2025

View reviewed changes

CMakeLists.txt Outdated Show resolved Hide resolved

egfefey reviewed Jan 9, 2025

View reviewed changes

src/tbb/dynamic_link.cpp Outdated Show resolved Hide resolved

egfefey reviewed Jan 9, 2025

View reviewed changes

src/tbb/dynamic_link.cpp Outdated Show resolved Hide resolved

egfefey reviewed Jan 13, 2025

View reviewed changes

src/tbb/dynamic_link.cpp Show resolved Hide resolved

egfefey reviewed Jan 13, 2025

View reviewed changes

src/tbb/dynamic_link.cpp Show resolved Hide resolved

aleksei-fedotov requested a review from isaevil January 14, 2025 13:11

aleksei-fedotov force-pushed the load-dependencies-by-name branch from 3872b7b to 4605226 Compare January 14, 2025 13:13

kboyarinov reviewed Jan 14, 2025

View reviewed changes

src/tbb/CMakeLists.txt Outdated Show resolved Hide resolved

egfefey reviewed Jan 17, 2025

View reviewed changes

egfefey reviewed Jan 29, 2025

View reviewed changes

aleksei-fedotov added 14 commits January 29, 2025 12:04

Add TBB_VERIFY_DEPENDENCY_SIGNATURE option

8f1eb34

Avoid manual setting of a size for TCM link table

f99525c

Don't load library from working dir on WIN32

b11857e

Allow dependency loading without building abs path

a649f02

Load TCM using only its module name

25bb280

Verify module signature during dynamic linking

39c0b6f

Signed-off-by: Fedotov, Aleksei <[email protected]>

Do not determine full filepath when it is built

f7db5d5

Signed-off-by: Fedotov, Aleksei <[email protected]>

Use mbsrtowcs for character conversion

9f23763

Signed-off-by: Fedotov, Aleksei <[email protected]>

Remove unnecessary variable

6f16361

Signed-off-by: Fedotov, Aleksei <[email protected]>

Add TBB's own DYNAMIC_LINK_WARNING implementation

22c7558

Signed-off-by: Fedotov, Aleksei <[email protected]>

Actualize commentaries

e090698

Signed-off-by: Fedotov, Aleksei <[email protected]>

Remove debug code

4323787

Unify loading flags for Windows

31f2041

Fix build on Linux

076557d

aleksei-fedotov added 14 commits January 29, 2025 12:04

Improve commentary and fix build w/o dynamic load

bf7189e

Use fprintf_s when it is supported

e201a77

Clarify CMake message

5621c11

Remove outdated commentary

5553efb

Document singature validating function

2f67580

Use built-in CMake's function for defining macros

107fdd4

Use actual return type instead of auto keyword

64f901c

Use SearchPath to find full path to the module

a871fe8

Reuse previously allocated array on the stack

b4b9c0f

Shorten the function name

e183aae

Remove unnecessary code

1ffd421

Correct dynamic link error messages

a912937

Update copyright year in CMakeLists.txt files

08cdc32

Print dynamic link warnings instead of errors

5e6c672

aleksei-fedotov force-pushed the load-dependencies-by-name branch from dd5a544 to 5e6c672 Compare January 29, 2025 11:05

isaevil reviewed Feb 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Load dependencies by name #1594

Load dependencies by name #1594

aleksei-fedotov commented Jan 7, 2025 •

edited

Loading

egfefey Jan 13, 2025

aleksei-fedotov Jan 14, 2025

egfefey Jan 17, 2025

egfefey left a comment

egfefey left a comment

aleksei-fedotov commented Jan 29, 2025

isaevil Feb 11, 2025

aleksei-fedotov Feb 11, 2025

isaevil Feb 11, 2025

isaevil Feb 11, 2025

isaevil Feb 11, 2025

		"This may lead to security vulnerabilities. It is recommended to leave it enabled by default"
		" or set TBB_VERIFY_DEPENDENCY_SIGNATURE ON to enable it explicitly.")

Load dependencies by name #1594

Are you sure you want to change the base?

Load dependencies by name #1594

Conversation

aleksei-fedotov commented Jan 7, 2025 • edited Loading

Description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

egfefey left a comment

Choose a reason for hiding this comment

egfefey left a comment

Choose a reason for hiding this comment

aleksei-fedotov commented Jan 29, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aleksei-fedotov commented Jan 7, 2025 •

edited

Loading