Current hardening measures for UEFI binaries

[RaitoBezarius]

Hello there,

I am working in NixOS to bring native UEFI cross-compilation (using LLVM lld-link), we got somewhere really nice, but we discovered that our default hardening measures do not really apply (obviously, ELF are different): read-only relocations, bindnow, etc.

Does anyone know if there's any plan to support better hardening measures for such binaries? This seems like an easy thing to get and important one.

Thank you!

[poettering]

last time a looked uefi had no shared library concept. hence relocations/bindnow simply don't apply.

[RaitoBezarius]

Interesting, but my question is open on also: stackprotector, fortify3, format, strictoverflow.

[RaitoBezarius]

(also: https://doc.rust-lang.org/rustc/exploit-mitigations.html)

[bluca]

The NX bit is the only hardening I'm aware of, and it's going to be required by firmwares "soon" (TM)

[RaitoBezarius]

Which is the default for MSVC linker, right? /NXCOMPAT