Sdl (#86)

* adding cmake to conda env
* new pre-commit hooks, including bandit and isort
* using recommended compiler/linker args, removing warnings
* adding Security.md

Author: fschlimb

.bandit.yml

@@ -4,8 +4,19 @@ repos:
 -   repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
-    -   id: end-of-file-fixer
-    -   id: trailing-whitespace
+        -   id: check-ast
+        -   id: check-builtin-literals
+        -   id: check-case-conflict
+        -   id: check-executables-have-shebangs
+        -   id: check-merge-conflict
+        -   id: check-shebang-scripts-are-executable
+        -   id: check-toml
+        -   id: debug-statements
+        -   id: destroyed-symlinks
+        -   id: end-of-file-fixer
+        -   id: fix-byte-order-marker
+        -   id: mixed-line-ending
+        -   id: trailing-whitespace
 -   repo: https://github.com/pocc/pre-commit-hooks
     rev: v1.3.5
     hooks:
@@ -16,3 +27,13 @@ repos:
     hooks:
     - id: black
       language_version: python3
+-   repo: https://github.com/PyCQA/bandit
+    rev: '1.7.7'
+    hooks:
+    -   id: bandit
+        args: ["-c", ".bandit.yml"]
+-   repo: https://github.com/pycqa/isort
+    rev: 5.13.2
+    hooks:
+    -   id: isort
+        name: isort (python)

.pre-commit-config.yaml

@@ -68,7 +68,18 @@ list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_DIR}")
 #include(AddIMEX)
 
 # macro for mlir root directory
-add_compile_definitions(CMAKE_MLIR_ROOT="${MLIR_ROOT}" CMAKE_IMEX_ROOT="${IMEX_ROOT}")
+add_compile_definitions(CMAKE_MLIR_ROOT="${MLIR_ROOT}" CMAKE_IMEX_ROOT="${IMEX_ROOT}" FORTIFY_SOURCE=2 USE_MKL=1)
+add_compile_options(
+    "-ftemplate-backtrace-limit=0"
+    "-flarge-source-files"
+    "-Wall" "-Wformat" "-fPIC" "-Wno-comment"
+    "$<$<CONFIG:DEBUG>:-fstack-protector>"
+    "$<$<CONFIG:RELEASE>:-flto>"
+    "$<$<CONFIG:RELEASE>:-z>"
+    "$<$<CONFIG:RELEASE>:noexecstack>"
+    "$<$<CONFIG:RELEASE>:-fstack-protector-strong>"
+)
+add_link_options("-pie" "$<$<CONFIG:RELEASE>:-Wl,-z,relro,-z,now>")
 
 #find_package(OpenMP)
 
@@ -127,8 +138,6 @@ pybind11_add_module(_sharpy MODULE ${SHARPYSrcs} ${Hpps})
 add_library(idtr SHARED ${IDTRSrcs} ${Hpps})
 set(AllTargets _sharpy idtr)
 
-add_compile_definitions(USE_MKL=1)
-add_compile_options("-ftemplate-backtrace-limit=0")
 include_directories(
   ${PROJECT_SOURCE_DIR}/src/include
   ${PROJECT_SOURCE_DIR}/third_party/bitsery/include

CMakeLists.txt

@@ -0,0 +1,5 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation.
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project [utilizing the guidelines here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).

Security.md

@@ -20,21 +20,32 @@ https://conda.anaconda.org/intel/linux-64/tbb-devel-2021.11.0-intel_49513.tar.bz
 https://conda.anaconda.org/intel/linux-64/_openmp_mutex-4.5-2_gnu.tar.bz2
 https://conda.anaconda.org/intel/linux-64/libgcc-ng-13.2.0-h807b86a_2.conda
 https://conda.anaconda.org/intel/linux-64/bzip2-1.0.8-hb9a14ef_9.tar.bz2
+https://conda.anaconda.org/intel/linux-64/c-ares-1.21.0-hd590300_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/expat-2.5.0-h6a678d5_0.conda
+https://conda.anaconda.org/intel/linux-64/libev-4.33-h7f8727e_1.tar.bz2
 https://conda.anaconda.org/intel/linux-64/libffi-3.4.2-h7f98852_5.tar.bz2
 https://conda.anaconda.org/intel/linux-64/libnsl-2.0.1-hd590300_0.conda
 https://conda.anaconda.org/intel/linux-64/libuuid-2.38.1-h0b41bf4_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/libuv-1.44.2-h5eee18b_0.conda
 https://conda.anaconda.org/intel/linux-64/libzlib-1.2.13-hd590300_5.conda
 https://conda.anaconda.org/intel/linux-64/ncurses-6.4-h59595ed_2.conda
 https://repo.anaconda.com/pkgs/main/linux-64/ninja-base-1.10.2-hd09550d_5.conda
 https://conda.anaconda.org/intel/linux-64/openssl-3.1.4-hd590300_0.conda
-https://conda.anaconda.org/intel/linux-64/xz-5.2.8-h5eee18b_0.tar.bz2
+https://repo.anaconda.com/pkgs/main/linux-64/xz-5.4.5-h5eee18b_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/libedit-3.1.20230828-h5eee18b_0.conda
 https://conda.anaconda.org/intel/linux-64/libsqlite-3.44.0-h2797004_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/libssh2-1.10.0-hdbd6064_2.conda
 https://conda.anaconda.org/intel/linux-64/readline-8.2-h8228510_1.conda
+https://repo.anaconda.com/pkgs/main/linux-64/rhash-1.4.3-hdbd6064_0.conda
 https://conda.anaconda.org/intel/linux-64/tk-8.6.13-noxft_h4845f30_101.conda
 https://conda.anaconda.org/intel/linux-64/zlib-1.2.13-hd590300_5.conda
+https://conda.anaconda.org/intel/linux-64/zstd-1.5.5-hfc55251_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/krb5-1.20.1-h143b758_1.conda
+https://repo.anaconda.com/pkgs/main/linux-64/libnghttp2-1.57.0-h2d74bed_0.conda
 https://conda.anaconda.org/intel/linux-64/python-3.10.13-h4499717_0.tar.bz2
 https://repo.anaconda.com/pkgs/main/linux-64/exceptiongroup-1.2.0-py310h06a4308_0.conda
 https://repo.anaconda.com/pkgs/main/noarch/iniconfig-1.1.1-pyhd3eb1b0_0.tar.bz2
+https://repo.anaconda.com/pkgs/main/linux-64/libcurl-8.5.0-h251f7ec_0.conda
 https://conda.anaconda.org/intel/linux-64/mpi4py-3.1.4-py310h618b5fa_0.tar.bz2
 https://repo.anaconda.com/pkgs/main/linux-64/ninja-1.10.2-h06a4308_5.conda
 https://conda.anaconda.org/intel/noarch/packaging-23.2-pyhd8ed1ab_0.conda
@@ -45,6 +56,7 @@ https://conda.anaconda.org/intel/noarch/six-1.16.0-pyhd3eb1b0_1.tar.bz2
 https://conda.anaconda.org/intel/linux-64/tbb4py-2021.11.0-py310_intel_49513.tar.bz2
 https://repo.anaconda.com/pkgs/main/linux-64/tomli-2.0.1-py310h06a4308_0.conda
 https://conda.anaconda.org/intel/noarch/wheel-0.41.3-pyhd8ed1ab_0.conda
+https://repo.anaconda.com/pkgs/main/linux-64/cmake-3.26.4-h96355d8_0.conda
 https://conda.anaconda.org/intel/linux-64/mkl-service-2.4.0-py310h3539a15_41.tar.bz2
 https://conda.anaconda.org/intel/noarch/pip-23.3.1-pyhd8ed1ab_0.conda
 https://repo.anaconda.com/pkgs/main/linux-64/pybind11-2.10.4-py310hdb19cb5_0.conda

conda-env.txt

@@ -22,9 +22,10 @@
     python black_scholes.py -p M16Gb -b numpy
 
 """
-import numpy
-import time as time_mod
 import argparse
+import time as time_mod
+
+import numpy
 
 try:
     import mpi4py
@@ -150,7 +151,7 @@ def black_scholes(np, erf, nopt, price, strike, t, rate, volatility, call, put):
 def run(nopt, backend, iterations, datatype):
     if backend == "sharpy":
         import sharpy as np
-        from sharpy import init, fini, sync
+        from sharpy import fini, init, sync
 
         init(False)
         erf = np.erf

examples/black_scholes.py

@@ -23,21 +23,21 @@
     python shallow_water.py -b numpy ...
 
 """
+import argparse
 import math
-import numpy
+import os
 import time as time_mod
-import argparse
 
-import os
+import numpy
 
 device = os.getenv("SHARPY_USE_GPU", "")
 
 
 def run(n, backend, datatype, benchmark_mode):
     if backend == "sharpy":
         import sharpy as np
+        from sharpy import fini, init, sync
         from sharpy.numpy import fromfunction
-        from sharpy import init, fini, sync
 
         all_axes = [0, 1]
         init(False)

examples/shallow_water.py

@@ -1,5 +1,3 @@
-#!/usr/bin/env python3
-#
 # Copyright (c) 2015, Intel Corporation
 #
 # Redistribution and use in source and binary forms, with or without
@@ -55,7 +53,8 @@
 #
 # *******************************************************************
 
-import sys, os
+import os
+import sys
 
 print(
     "Python version = ", str(sys.version_info.major) + "." + str(sys.version_info.minor)

examples/stencil-2d.py

@@ -23,21 +23,21 @@
     python wave_equation.py -b numpy ...
 
 """
+import argparse
 import math
-import numpy
+import os
 import time as time_mod
-import argparse
 
-import os
+import numpy
 
 device = os.getenv("SHARPY_USE_GPU", "")
 
 
 def run(n, backend, datatype, benchmark_mode):
     if backend == "sharpy":
         import sharpy as np
+        from sharpy import fini, init, sync
         from sharpy.numpy import fromfunction
-        from sharpy import init, fini, sync
 
         all_axes = [0, 1]
         init(False)

examples/wave_equation.py

@@ -1,4 +1,5 @@
-import sys, os
+import os
+import sys
 
 sys.path.append(os.path.abspath(os.path.dirname(sys.argv[1])))
 exec(f"import {os.path.basename(sys.argv[1]).split('.')[0]} as api")