Skip to content

Commit 3bd0869

Browse files
DefaultRyanDefaultRyan
authored
Enable running BinSkim on Foundation (#600)
* Test enabling BinSkim * Test running BinSkim on binaries * Move BinSkim task into build jobs. * Fix some BinSkim issues * Don't check BinSkim during CredScan pre-analysis * Only enable Control Flow Guard for release bits * Disable CFG for debug builds. * Update ProjectReunion-CI.yml for Azure Pipelines to run binskim * Don't run binskim on Debug builds * Refactor build changes into common .props file and bring in more projects.
1 parent 71c3bca commit 3bd0869

14 files changed

Lines changed: 148 additions & 14 deletions

File tree

‎build/ProjectReunion-BuildFoundation.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,31 @@ jobs:
9090

9191
# component detection must happen *within* the build task
9292
- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
93+
94+
- task: BinSkim@3
95+
inputs:
96+
InputType: 'Basic'
97+
Function: 'analyze'
98+
AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\*.dll;$(Build.ArtifactStagingDirectory)\*.exe'
99+
AnalyzeVerbose: true
100+
- task: PostAnalysis@1
101+
inputs:
102+
AllTools: false
103+
APIScan: false
104+
BinSkim: true
105+
BinSkimBreakOn: 'Error'
106+
CodesignValidation: false
107+
CredScan: false
108+
FortifySCA: false
109+
FxCop: false
110+
ModernCop: false
111+
PoliCheck: false
112+
RoslynAnalyzers: false
113+
SDLNativeRules: false
114+
Semmle: false
115+
TSLint: false
116+
ToolLogsNotFoundAction: 'Standard'
117+
93118

94119
- job: BuildMRT
95120
pool:
@@ -111,6 +136,30 @@ jobs:
111136
parameters:
112137
buildJobName: 'BuildMRTCore'
113138

139+
- task: BinSkim@3
140+
inputs:
141+
InputType: 'Basic'
142+
Function: 'analyze'
143+
AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\*.dll;$(Build.ArtifactStagingDirectory)\*.exe'
144+
AnalyzeVerbose: true
145+
- task: PostAnalysis@1
146+
inputs:
147+
AllTools: false
148+
APIScan: false
149+
BinSkim: true
150+
BinSkimBreakOn: 'Error'
151+
CodesignValidation: false
152+
CredScan: false
153+
FortifySCA: false
154+
FxCop: false
155+
ModernCop: false
156+
PoliCheck: false
157+
RoslynAnalyzers: false
158+
SDLNativeRules: false
159+
Semmle: false
160+
TSLint: false
161+
ToolLogsNotFoundAction: 'Standard'
162+
114163
- job: PublishMRT
115164
dependsOn:
116165
- BuildMRT

‎build/ProjectReunion-CI.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,32 @@ jobs:
6262
- template: AzurePipelinesTemplates\ProjectReunion-BuildDevProject-Steps.yml
6363
- template: AzurePipelinesTemplates\ProjectReunion-PublishProjectOutput-Steps.yml
6464

65+
- task: BinSkim@3
66+
inputs:
67+
InputType: 'Basic'
68+
Function: 'analyze'
69+
AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\*.dll;$(Build.ArtifactStagingDirectory)\*.exe'
70+
AnalyzeVerbose: true
71+
condition: ne(variables['buildConfiguration'], 'Debug')
72+
73+
- task: PostAnalysis@1
74+
inputs:
75+
AllTools: false
76+
APIScan: false
77+
BinSkim: true
78+
BinSkimBreakOn: 'Error'
79+
CodesignValidation: false
80+
CredScan: false
81+
FortifySCA: false
82+
FxCop: false
83+
ModernCop: false
84+
PoliCheck: false
85+
RoslynAnalyzers: false
86+
SDLNativeRules: false
87+
Semmle: false
88+
TSLint: false
89+
ToolLogsNotFoundAction: 'Standard'
90+
6591
- job: BuildMRT
6692
pool:
6793
vmImage: 'windows-latest'
@@ -82,6 +108,30 @@ jobs:
82108
parameters:
83109
buildJobName: 'BuildMRTCore'
84110

111+
- task: BinSkim@3
112+
inputs:
113+
InputType: 'Basic'
114+
Function: 'analyze'
115+
AnalyzeTarget: '$(Build.ArtifactStagingDirectory)\*.dll;$(Build.ArtifactStagingDirectory)\*.exe'
116+
AnalyzeVerbose: true
117+
- task: PostAnalysis@1
118+
inputs:
119+
AllTools: false
120+
APIScan: false
121+
BinSkim: true
122+
BinSkimBreakOn: 'Error'
123+
CodesignValidation: false
124+
CredScan: false
125+
FortifySCA: false
126+
FxCop: false
127+
ModernCop: false
128+
PoliCheck: false
129+
RoslynAnalyzers: false
130+
SDLNativeRules: false
131+
Semmle: false
132+
TSLint: false
133+
ToolLogsNotFoundAction: 'Standard'
134+
85135
- job: PublishMRT
86136
dependsOn:
87137
- BuildMRT

‎dev/Detours/Detours.vcxproj‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\ProjectReunion.Build.Cpp.props" />
34
<ItemGroup Label="ProjectConfigurations">
45
<ProjectConfiguration Include="Debug|ARM">
56
<Configuration>Debug</Configuration>
@@ -160,7 +161,6 @@
160161
<FunctionLevelLinking>true</FunctionLevelLinking>
161162
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
162163
<OmitDefaultLibName>true</OmitDefaultLibName>
163-
<BufferSecurityCheck>false</BufferSecurityCheck>
164164
</ClCompile>
165165
<Link>
166166
<SubSystem>
@@ -180,7 +180,6 @@
180180
<FunctionLevelLinking>true</FunctionLevelLinking>
181181
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
182182
<OmitDefaultLibName>true</OmitDefaultLibName>
183-
<BufferSecurityCheck>false</BufferSecurityCheck>
184183
</ClCompile>
185184
<Link>
186185
<SubSystem>
@@ -203,7 +202,6 @@
203202
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
204203
<OmitDefaultLibName>true</OmitDefaultLibName>
205204
<WholeProgramOptimization>false</WholeProgramOptimization>
206-
<BufferSecurityCheck>false</BufferSecurityCheck>
207205
</ClCompile>
208206
<Link>
209207
<SubSystem>
@@ -228,7 +226,6 @@
228226
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
229227
<OmitDefaultLibName>true</OmitDefaultLibName>
230228
<WholeProgramOptimization>false</WholeProgramOptimization>
231-
<BufferSecurityCheck>false</BufferSecurityCheck>
232229
</ClCompile>
233230
<Link>
234231
<SubSystem>
@@ -250,7 +247,6 @@
250247
<FunctionLevelLinking>true</FunctionLevelLinking>
251248
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
252249
<OmitDefaultLibName>true</OmitDefaultLibName>
253-
<BufferSecurityCheck>false</BufferSecurityCheck>
254250
</ClCompile>
255251
<Link>
256252
<SubSystem>
@@ -270,7 +266,6 @@
270266
<FunctionLevelLinking>true</FunctionLevelLinking>
271267
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
272268
<OmitDefaultLibName>true</OmitDefaultLibName>
273-
<BufferSecurityCheck>false</BufferSecurityCheck>
274269
</ClCompile>
275270
<Link>
276271
<SubSystem>
@@ -293,7 +288,6 @@
293288
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
294289
<OmitDefaultLibName>true</OmitDefaultLibName>
295290
<WholeProgramOptimization>false</WholeProgramOptimization>
296-
<BufferSecurityCheck>false</BufferSecurityCheck>
297291
</ClCompile>
298292
<Link>
299293
<SubSystem>
@@ -318,7 +312,6 @@
318312
<RemoveUnreferencedCodeData>false</RemoveUnreferencedCodeData>
319313
<OmitDefaultLibName>true</OmitDefaultLibName>
320314
<WholeProgramOptimization>false</WholeProgramOptimization>
321-
<BufferSecurityCheck>false</BufferSecurityCheck>
322315
</ClCompile>
323316
<Link>
324317
<SubSystem>
@@ -353,4 +346,4 @@
353346
<ItemGroup>
354347
<PublicHeaders Include="$(MSBuildThisFileDirectory)detours.h" />
355348
</ItemGroup>
356-
</Project>
349+
</Project>

‎dev/DynamicDependencyDataStore/DynamicDependency.DataStore.ProxyStub/DynamicDependency.DataStore.ProxyStub.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\..\ProjectReunion.Build.Cpp.props" />
34
<ItemGroup Label="ProjectConfigurations">
45
<ProjectConfiguration Include="Debug|ARM">
56
<Configuration>Debug</Configuration>

‎dev/DynamicDependencyDataStore/DynamicDependency.DataStore/DynamicDependency.DataStore.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<Import Project="..\..\..\packages\Microsoft.Windows.CppWinRT.2.0.200703.9\build\native\Microsoft.Windows.CppWinRT.props" Condition="Exists('..\..\..\packages\Microsoft.Windows.CppWinRT.2.0.200703.9\build\native\Microsoft.Windows.CppWinRT.props')" />
4+
<Import Project="..\..\ProjectReunion.Build.Cpp.props" />
45
<ItemGroup Label="ProjectConfigurations">
56
<ProjectConfiguration Include="Debug|ARM">
67
<Configuration>Debug</Configuration>

‎dev/DynamicDependencyLifetimeManager/DynamicDependencyLifetimeManager.ProxyStub/DynamicDependencyLifetimeManager.ProxyStub.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\..\ProjectReunion.Build.Cpp.props" />
34
<ItemGroup Label="ProjectConfigurations">
45
<ProjectConfiguration Include="Debug|ARM">
56
<Configuration>Debug</Configuration>

‎dev/DynamicDependencyLifetimeManager/DynamicDependencyLifetimeManager/DynamicDependencyLifetimeManager.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\..\ProjectReunion.Build.Cpp.props" />
34
<ItemGroup Label="ProjectConfigurations">
45
<ProjectConfiguration Include="Debug|ARM">
56
<Configuration>Debug</Configuration>

‎dev/DynamicDependencyLifetimeManager/IDynamicDependencyLifetimeManager/IDynamicDependencyLifetimeManager.vcxproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\..\ProjectReunion.Build.Cpp.props" />
34
<ItemGroup Label="ProjectConfigurations">
45
<ProjectConfiguration Include="Debug|Win32">
56
<Configuration>Debug</Configuration>

‎dev/MRTCore/mrt/Core/src/MRM.vcxproj‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<Import Project="..\..\..\..\ProjectReunion.Build.Cpp.props" />
34
<PropertyGroup Label="DevEnvironmentScenario">
45
<ConsumeWinRT>false</ConsumeWinRT>
56
<UseModernCompliantVclibs>true</UseModernCompliantVclibs>
@@ -132,12 +133,24 @@
132133
</Link>
133134
<ClCompile>
134135
<LanguageStandard>stdcpp17</LanguageStandard>
136+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">Guard</ControlFlowGuard>
137+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">Guard</ControlFlowGuard>
138+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">Guard</ControlFlowGuard>
139+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">Guard</ControlFlowGuard>
140+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Guard</ControlFlowGuard>
141+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Guard</ControlFlowGuard>
135142
</ClCompile>
136143
</ItemDefinitionGroup>
137144
<ItemDefinitionGroup Condition="'$(Platform)'=='Win32'">
138145
<Link>
139146
<TargetMachine>MachineX86</TargetMachine>
140147
</Link>
148+
<ClCompile>
149+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Guard</ControlFlowGuard>
150+
</ClCompile>
151+
<ClCompile>
152+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Guard</ControlFlowGuard>
153+
</ClCompile>
141154
</ItemDefinitionGroup>
142155
<ItemGroup>
143156
<ClCompile Include="MRM.cpp" />

‎dev/MRTCore/mrt/Microsoft.ApplicationModel.Resources/src/Microsoft.ApplicationModel.Resources.vcxproj‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<Import Project="..\..\packages\Microsoft.Windows.CppWinRT.2.0.200729.8\build\native\Microsoft.Windows.CppWinRT.props" Condition="Exists('..\..\packages\Microsoft.Windows.CppWinRT.2.0.200729.8\build\native\Microsoft.Windows.CppWinRT.props')" />
4+
<Import Project="..\..\..\..\ProjectReunion.Build.Cpp.props" />
45
<PropertyGroup Label="Globals">
56
<CppWinRTOptimized>true</CppWinRTOptimized>
67
<CppWinRTRootNamespaceAutoMerge>true</CppWinRTRootNamespaceAutoMerge>
@@ -109,7 +110,7 @@
109110
<WarningLevel>Level4</WarningLevel>
110111
<AdditionalOptions>%(AdditionalOptions) /bigobj</AdditionalOptions>
111112
<!--Temporarily disable cppwinrt heap enforcement to work around xaml compiler generated std::shared_ptr use -->
112-
<AdditionalOptions Condition="'$(CppWinRTHeapEnforcement)'==''">/DWINRT_NO_MAKE_DETECTION %(AdditionalOptions)</AdditionalOptions>
113+
<AdditionalOptions Condition="'$(CppWinRTHeapEnforcement)'==''">/DWINRT_NO_MAKE_DETECTION /ZH:SHA_256 %(AdditionalOptions)</AdditionalOptions>
113114
<DisableSpecificWarnings>
114115
</DisableSpecificWarnings>
115116
<PreprocessorDefinitions>_WINRT_DLL;WIN32_LEAN_AND_MEAN;WINRT_LEAN_AND_MEAN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
@@ -125,11 +126,17 @@
125126
<ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
126127
<ClCompile>
127128
<PreprocessorDefinitions>_DEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
129+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">false</ControlFlowGuard>
130+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</ControlFlowGuard>
131+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</ControlFlowGuard>
128132
</ClCompile>
129133
</ItemDefinitionGroup>
130134
<ItemDefinitionGroup Condition="'$(Configuration)'=='Release'">
131135
<ClCompile>
132136
<PreprocessorDefinitions>NDEBUG;%(PreprocessorDefinitions)</PreprocessorDefinitions>
137+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">Guard</ControlFlowGuard>
138+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Guard</ControlFlowGuard>
139+
<ControlFlowGuard Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Guard</ControlFlowGuard>
133140
</ClCompile>
134141
<Link>
135142
<EnableCOMDATFolding>true</EnableCOMDATFolding>
@@ -182,10 +189,10 @@
182189
</ItemGroup>
183190
<PropertyGroup>
184191
<Udk-Arch Condition="'$(Platform)' == 'AnyCPU'">x86</Udk-Arch>
185-
<Udk-Arch Condition="'$(Platform)' == 'Win32'" >x86</Udk-Arch>
186-
<Udk-Arch Condition="'$(Platform)' == 'x86'" >x86</Udk-Arch>
187-
<Udk-Arch Condition="'$(Platform)' == 'x64'" >amd64</Udk-Arch>
188-
<Udk-Arch Condition="'$(Platform)' == 'arm64'" >arm64</Udk-Arch>
192+
<Udk-Arch Condition="'$(Platform)' == 'Win32'">x86</Udk-Arch>
193+
<Udk-Arch Condition="'$(Platform)' == 'x86'">x86</Udk-Arch>
194+
<Udk-Arch Condition="'$(Platform)' == 'x64'">amd64</Udk-Arch>
195+
<Udk-Arch Condition="'$(Platform)' == 'arm64'">arm64</Udk-Arch>
189196
</PropertyGroup>
190197
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
191198
<ImportGroup Label="ExtensionTargets">

0 commit comments

Comments
 (0)