MAJOR: feature and security improvements for haproxy wrapper

Author: dkorunic

build/Dockerfile

@@ -18,8 +18,24 @@ WORKDIR /src
 
 COPY pkg/protection/block_secrets.c .
 COPY pkg/protection/haproxy_wrapper.c .
-RUN gcc -O3 -Wall -flto -fPIC -shared -s -o libblock_secrets.so block_secrets.c -ldl
-RUN gcc -O3 -Wall -g -s -o haproxy_wrapper haproxy_wrapper.c
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -flto -fPIC -shared -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed -Wl,-z,defs \
+    -o libblock_secrets.so block_secrets.c -ldl
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -fPIE -pie -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed \
+    -o haproxy_wrapper haproxy_wrapper.c
 
 FROM golang:1.25-alpine AS builder
 RUN apk --no-cache add git openssh

build/Dockerfile.dev

@@ -16,8 +16,24 @@ RUN apk add --no-cache build-base gcc musl-dev
 WORKDIR /src
 COPY pkg/protection/block_secrets.c .
 COPY pkg/protection/haproxy_wrapper.c .
-RUN gcc -O3 -Wall -flto -fPIC -shared -s -o libblock_secrets.so block_secrets.c -ldl
-RUN gcc -O3 -Wall -g -s -o haproxy_wrapper haproxy_wrapper.c
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -flto -fPIC -shared -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed -Wl,-z,defs \
+    -o libblock_secrets.so block_secrets.c -ldl
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -fPIE -pie -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed \
+    -o haproxy_wrapper haproxy_wrapper.c
 
 FROM haproxytech/haproxy-alpine:3.2
 ARG TARGETPLATFORM

build/Dockerfile.pebble

@@ -17,8 +17,24 @@ WORKDIR /src
 
 COPY pkg/protection/block_secrets.c .
 COPY pkg/protection/haproxy_wrapper.c .
-RUN gcc -O3 -Wall -flto -fPIC -shared -s -o libblock_secrets.so block_secrets.c -ldl
-RUN gcc -O3 -Wall -g -s -o haproxy_wrapper haproxy_wrapper.c
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -flto -fPIC -shared -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed -Wl,-z,defs \
+    -o libblock_secrets.so block_secrets.c -ldl
+RUN gcc -O3 -std=c11 -pipe \
+    -Wall -Wextra -Wformat=2 -Wformat-security \
+    -Wnull-dereference -Wshadow -Wstrict-prototypes \
+    -D_FORTIFY_SOURCE=2 \
+    -fstack-protector-strong -fstack-clash-protection \
+    -fno-omit-frame-pointer \
+    -fPIE -pie -s \
+    -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,--as-needed \
+    -o haproxy_wrapper haproxy_wrapper.c
 
 FROM golang:1.25-alpine AS builder
 

pkg/protection/block_secrets.c

@@ -12,6 +12,8 @@
 /* See the License for the specific language governing permissions and        */
 /* limitations under the License.                                             */
 
+#define _XOPEN_SOURCE 700
+
 #include <dirent.h>
 #include <dlfcn.h>
 #include <errno.h>
@@ -263,7 +265,7 @@ static int (*real_symlinkat)(const char *, int, const char *) = NULL;
 
 /* Priority 101 (0–100 reserved). dlsym before realpath so any internal
    hook recursion finds populated pointers. */
-__attribute__((constructor(101), cold)) static void block_secrets_init() {
+__attribute__((constructor(101), cold)) static void block_secrets_init(void) {
   real_open = dlsym(RTLD_NEXT, "open");
   real_open64 = dlsym(RTLD_NEXT, "open64");
   real_fopen = dlsym(RTLD_NEXT, "fopen");

pkg/protection/haproxy_wrapper.c

@@ -13,37 +13,37 @@
 /* limitations under the License.                                             */
 
 #define _GNU_SOURCE
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
-#define LIB_PATH "LD_PRELOAD=/usr/local/lib/libblock_secrets.so"
+#define LIB_PATH "/usr/local/lib/libblock_secrets.so"
 #define TARGET_PATH "/usr/local/sbin/haproxy"
 
-int main(int argc, char *argv[], char *envp[]) {
-    char **newargv = malloc((argc + 1) * sizeof(char *));
+int main(int argc, char *argv[]) {
+    int n = argc > 0 ? argc : 1;
+    char **newargv = malloc((n + 1) * sizeof(char *));
     if (!newargv) {
         perror("malloc");
-        return 1;
+        return EXIT_FAILURE;
     }
     newargv[0] = (char *)TARGET_PATH;
-    for (int i = 1; i < argc; i++) {
+    for (int i = 1; i < n; i++) {
         newargv[i] = argv[i];
     }
-    newargv[argc] = NULL;
+    newargv[n] = NULL;
 
-    int envc = 0;
-    while (environ[envc]) envc++;
-
-    char **new_envp = malloc((envc + 2) * sizeof(char *));
-    for (int i = 0; i < envc; i++) {
-        new_envp[i] = environ[i];
+    if (setenv("LD_PRELOAD", LIB_PATH, 1) != 0) {
+        perror("setenv LD_PRELOAD");
+        free(newargv);
+        return EXIT_FAILURE;
     }
-    new_envp[envc] = LIB_PATH;
-    new_envp[envc + 1] = NULL;
 
-    execve(TARGET_PATH, newargv, new_envp);
+    execv(TARGET_PATH, newargv);
 
-    perror("execve");
-    return 1;
+    fprintf(stderr, "execv %s: %s\n", TARGET_PATH, strerror(errno));
+    free(newargv);
+    return EXIT_FAILURE;
 }