cmd/go: reject cgo -sectcreate linker flags by default

The Darwin linker reads the file named by -sectcreate and embeds its contents in the output. Allowing dependency-supplied #cgo LDFLAGS to use it lets a module read arbitrary files available to the build.

Reject the flag by default. Users who explicitly trust it can retain the existing CGO_LDFLAGS_ALLOW override.

Fixes #78750.

Author: carrerasdarren-cell

src/cmd/go/internal/work/security.go

@@ -158,6 +158,8 @@ var invalidLinkerFlags = []*lazyregexp.Regexp{
 	// On macOS this means the linker loads and executes the next argument.
 	// Have to exclude separately because -lfoo is allowed in general.
 	re(`-lto_library`),
+	// On macOS this means the linker reads the file named by the last argument.
+	re(`-Wl,-sectcreate,.*`),
 }
 
 var validLinkerFlags = []*lazyregexp.Regexp{
@@ -223,7 +225,6 @@ var validLinkerFlags = []*lazyregexp.Regexp{
 	re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]*)`),
 	re(`-Wl,-s`),
 	re(`-Wl,-search_paths_first`),
-	re(`-Wl,-sectcreate,([^,@\-][^,]*),([^,@\-][^,]*),([^,@\-][^,]*)`),
 	re(`-Wl,--start-group`),
 	re(`-Wl,-?-static`),
 	re(`-Wl,-?-subsystem,(native|windows|console|posix|xbox)`),

src/cmd/go/internal/work/security_test.go

@@ -202,7 +202,6 @@ var goodLinkerFlags = [][]string{
 	{"-L", "framework"},
 	{"-framework", "Chocolate"},
 	{"-v"},
-	{"-Wl,-sectcreate,__TEXT,__info_plist,${SRCDIR}/Info.plist"},
 	{"-Wl,-framework", "-Wl,Chocolate"},
 	{"-Wl,-framework,Chocolate"},
 	{"-Wl,-unresolved-symbols=ignore-all"},
@@ -220,7 +219,6 @@ var goodLinkerFlags = [][]string{
 	{"-Wl,-framework,."},
 	{"-Wl,-rpath,."},
 	{"-Wl,-rpath-link,."},
-	{"-Wl,-sectcreate,.,.,."},
 	{"-Wl,-syslibroot,."},
 	{"-Wl,-undefined,."},
 }
@@ -289,6 +287,9 @@ var badLinkerFlags = [][]string{
 	{"-Wl,-e="},
 	{"-Wl,-e,"},
 	{"-Wl,-R,-flag"},
+	{"-Wl,-sectcreate,.,.,."},
+	{"-Wl,-sectcreate,__TEXT,__info_plist,${SRCDIR}/Info.plist"},
+	{"-Wl,-sectcreate,__TEXT,__info,/etc/hosts"},
 	{"-Wl,--push-state,"},
 	{"-Wl,--push-state,@foo"},
 	{"-fplugin=./-Wl,--push-state,-R.so"},

src/cmd/go/testdata/script/darwin_sectcreate_ldflag.txt

@@ -0,0 +1,24 @@
+[!GOOS:darwin] skip
+[!cgo] skip
+
+! go build
+stderr '^ldflag: invalid flag in #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,.*info.txt'
+
+env CGO_LDFLAGS_ALLOW=-Wl,-sectcreate,.*
+go build
+
+-- go.mod --
+module ldflag
+
+go 1.26
+
+-- main.go --
+package main
+
+// #cgo LDFLAGS: -Wl,-sectcreate,__TEXT,__info,${SRCDIR}/info.txt
+import "C"
+
+func main() {}
+
+-- info.txt --
+trusted local input