From 4ba91e7e7f75d610387a930c45506ad444825d8f Mon Sep 17 00:00:00 2001 From: Himaja Kesari Date: Thu, 28 May 2026 13:08:32 -0700 Subject: [PATCH] BA3003: report NotApplicable for Rust-only binaries rustc enables stack protection via LLVM and does not emit the __stack_chk_fail / __stack_chk_guard / __intel_security_cookie symbols that BA3003 looks for in its symbol-table fallback path. It also does not produce GCC-style DWARF compile units, so the DWARF path yields zero valid GCC entries and BA3003 falls through to the symbol heuristic, which then false-flags every Rust binary as missing a stack protector. When the only producer recorded for the ELF is Rust (and there is no GCC compile unit), report ResultKind.NotApplicable instead, with a message explaining that the GCC heuristic does not apply to this binary. This matches the behavior the rule already uses for other NotApplicable cases via RuleResources.NotApplicable_InvalidMetadata. No behavior change for binaries that contain at least one GCC compile unit (mixed C/Rust links still go through the DWARF path). --- .../DwarfRules/BA3003.EnableStackProtector.cs | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs b/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs index cfb4b7135..4ec9b5f47 100644 --- a/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs +++ b/src/BinSkim.Rules/DwarfRules/BA3003.EnableStackProtector.cs @@ -159,6 +159,27 @@ public override void Analyze(BinaryAnalyzerContext context) } validGccCommandLineInfos.Add(info); } + + // If the binary's only DWARF producer is rustc, the GCC + // stack-protector heuristic does not apply: rustc enables stack + // protection via LLVM and does not emit __stack_chk_fail / + // __stack_chk_guard symbols, so the symbol-table fallback below + // would false-flag every Rust binary as missing stack-protector. + // Report NotApplicable in that case. + if (validGccCommandLineInfos.Count == 0 + && elf.Compilers != null + && elf.Compilers.Any(c => c.Compiler == ElfCompilerType.Rust) + && !elf.Compilers.Any(c => c.Compiler == ElfCompilerType.GCC)) + { + context.Logger.Log(this, + RuleUtilities.BuildResult(ResultKind.NotApplicable, context, null, + nameof(RuleResources.NotApplicable_InvalidMetadata), + context.CurrentTarget.Uri.GetFileName(), + this.Name, + "binary was produced by rustc; the GCC stack-protector heuristic does not apply")); + return; + } + if (validGccCommandLineInfos.Count > 0) { // Check using DWARF info