From: Aydın Mercan <aydin@isc.org>
Date: Mon, 1 Sep 2025 07:33:22 +0000 (+0300)
Subject: embed default sanitizer flags in executables
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e16a3d7a8e82b79296feac31c18dbfd52761a0ad;p=thirdparty%2Fbind9.git

embed default sanitizer flags in executables

Replicating CI failures requires the developer to piece together the
sanitizer flags by hand, reducing ergonomics.

Fix this problem by embedding the relevant settings to the executables.
Symbol resolution still needs manual intervention by setting the env
variable `*SAN_SYMBOLIZER_PATH`. However, this doesn't affect any behavior.
---

diff --git a/.gitattributes b/.gitattributes
index 8df340caefc..e2a0641fbfa 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,7 +12,6 @@
 .gitlab-ci.yml			 export-ignore
 .pylintrc			 export-ignore
 .readthedocs.yaml		 export-ignore
-.tsan-suppress			 export-ignore
 .uncrustify.cfg		 export-ignore
 dangerfile.py			 export-ignore
 /.github/**			 export-ignore
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bf7afac45c0..3b8e02c465e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -31,19 +31,9 @@ variables:
 
   CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls
 
-  UBASAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=address,undefined -Didn=enabled -Djemalloc=disabled -Dtracing=disabled"
-  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
-
-  # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0
-  ASAN_SYMBOLIZER_PATH: "${LLVM_SYMBOLIZER}"
-
-  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 atexit_sleep_ms=1000 history_size=7 log_exe_name=true log_path=tsan"
-  TSAN_SUPPRESSIONS: "suppressions=${CI_PROJECT_DIR}/.tsan-suppress"
-  TSAN_OPTIONS_DEBIAN: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=${LLVM_SYMBOLIZER}"
-  TSAN_OPTIONS_FEDORA: "${TSAN_OPTIONS_COMMON} ${TSAN_SUPPRESSIONS} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-
-  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
+  TSAN_CONFIGURE_FLAGS_COMMON: "-Db_sanitize=thread -Doptimization=2 -Ddebug=true -Didn=enabled -Dlocktype=system -Djemalloc=disabled -Dnamed-lto=disabled --pkg-config-path /opt/tsan/lib/pkgconfig"
+  TSAN_SYMBOLIZER_PATH_DEBIAN: "${LLVM_SYMBOLIZER}"
+  TSAN_SYMBOLIZER_PATH_FEDORA: "/usr/bin/llvm-symbolizer"
 
   WITHOUT_LIBEDIT: "-Dline=disabled"
   WITH_LIBEDIT: "-Dline=enabled"
@@ -449,6 +439,9 @@ stages:
     #- test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
     - test -z "${CROSS_COMPILATION}" || file build/lib/dns/gen | grep -F -q "ELF 64-bit LSB"
     #- test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
+    - *find_python
+    # Check that embedded sanitizer flags are in sync with the `meson.build` file.
+    - $PYTHON ${CI_PROJECT_DIR}/ci/sanitizer_default_check.py build
     - build/named -V
     - *fips_feature_test
   needs: []
@@ -1572,8 +1565,6 @@ gcc:asan:
   <<: *build_job
 
 system:gcc:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *fedora_43_amd64_image
   <<: *system_test_job
   needs:
@@ -1596,8 +1587,6 @@ clang:asan:
   <<: *build_job
 
 system:clang:asan:
-  variables:
-    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
   <<: *base_image
   <<: *system_test_job
   <<: *extra_system_tests_triggering_rules
@@ -1626,7 +1615,6 @@ gcc:tsan:
 
 system:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *system_test_tsan_job
   <<: *extra_system_tests_triggering_rules
@@ -1636,7 +1624,7 @@ system:gcc:tsan:
 
 unit:gcc:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_FEDORA}"
   <<: *tsan_fedora_43_amd64_image
   <<: *unit_test_tsan_job
   <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
@@ -1651,12 +1639,12 @@ clang:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false -Dnamed-lto=disabled --native-file ci/clang-trixie.ini"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false --native-file ci/clang-trixie.ini"
   <<: *build_job
 
 system:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *system_test_tsan_job
   needs:
@@ -1665,7 +1653,7 @@ system:clang:tsan:
 
 unit:clang:tsan:
   variables:
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   <<: *tsan_debian_trixie_amd64_image
   <<: *unit_test_tsan_job
   needs:
@@ -2278,9 +2266,9 @@ respdiff:tsan:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON}"
     LDFLAGS: "-Wl,--disable-new-dtags"
-    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Dnamed-lto=disabled -Db_lundef=false"
+    EXTRA_CONFIGURE: "${TSAN_CONFIGURE_FLAGS_COMMON} -Db_lundef=false"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.3"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
+    TSAN_SYMBOLIZER_PATH: "${TSAN_SYMBOLIZER_PATH_DEBIAN}"
   script:
     - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
     - cd ../.. && ninja -C build clean >/dev/null 2>&1
diff --git a/.tsan-suppress b/.tsan-suppress
deleted file mode 100644
index c12884d27ae..00000000000
--- a/.tsan-suppress
+++ /dev/null
@@ -1,9 +0,0 @@
-# Uninstrumented libraries
-called_from_lib:libfstrm.so
-race:dummyrpz
-
-# FreeBSD false-positive, see GL#5267
-race:libexec/rtld-elf/rtld_malloc.c
-
-# FreeBSD false-positive, see GL#5266
-deadlock:add_trace_entry
diff --git a/ci/sanitizer_default_check.py b/ci/sanitizer_default_check.py
new file mode 100755
index 00000000000..9a72a00387a
--- /dev/null
+++ b/ci/sanitizer_default_check.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+
+from pathlib import Path
+
+import argparse
+import json
+import subprocess
+import sys
+
+ASAN = False
+UBSAN = False
+TSAN = False
+
+args = argparse.ArgumentParser()
+args.add_argument("build")
+args = args.parse_args()
+
+build = Path(args.build)
+
+# https://mesonbuild.com/IDE-integration.html#build-options
+#
+# e.g. { "name": "b_sanitize", "value": ["address", "undefined"], ... }
+#
+with (build / "meson-info" / "intro-buildoptions.json").open() as f:
+    options = json.load(f)
+
+    for opt in options:
+        if opt["name"] == "b_sanitize":
+            ASAN = "address" in opt["value"]
+            UBSAN = "undefined" in opt["value"]
+            TSAN = "thread" in opt["value"]
+            break
+
+if not (ASAN or UBSAN or TSAN):
+    print("no sanitizer check necessary")
+    sys.exit(0)
+
+with (build / "meson-info" / "intro-targets.json").open() as f:
+    targets = json.load(f)
+
+    for target in targets:
+        if target["type"] == "executable" and Path(target["filename"][0]).exists():
+            nm = subprocess.run(
+                ["nm", target["filename"][0]],
+                stdin=None,
+                stdout=subprocess.PIPE,
+                timeout=1,
+                check=True,
+                shell=False,
+            )
+
+            if ASAN and b"__asan_default_options" not in nm.stdout:
+                print(f"Default ASAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+            if UBSAN and b"__ubsan_default_options" not in nm.stdout:
+                print(
+                    f"Default UBSAN options missing for executable '{target['name']}'"
+                )
+                sys.exit(1)
+
+            if TSAN and b"__tsan_default_options" not in nm.stdout:
+                print(f"Default TSAN options missing for executable '{target['name']}'")
+                sys.exit(1)
+
+print("all relevant sanitizer defaults are set")
diff --git a/doc/misc/meson.build b/doc/misc/meson.build
index c27e129eb00..17c6b1a75af 100644
--- a/doc/misc/meson.build
+++ b/doc/misc/meson.build
@@ -15,6 +15,7 @@ cfg_test = executable(
     'cfg_test',
     files('cfg_test.c'),
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libisccfg_dep,
diff --git a/lib/dns/meson.build b/lib/dns/meson.build
index 96168d5e368..61b64bbfa44 100644
--- a/lib/dns/meson.build
+++ b/lib/dns/meson.build
@@ -23,6 +23,7 @@ dns_gen_headers = []
 dns_header_gen = executable(
     'gen',
     files('gen.c'),
+    sources: default_sanitize_options,
     install: false,
     native: true,
 )
diff --git a/meson.build b/meson.build
index 91d49243564..81e608cfbd5 100644
--- a/meson.build
+++ b/meson.build
@@ -246,6 +246,22 @@ sys_defines = [
 
 add_project_arguments(sys_defines, language: 'c')
 
+### Sanitizer
+asan_options = 'abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1:detect_odr_violation=0'
+tsan_options = 'disable_coredump=0:second_deadlock_stack=1:atexit_sleep_ms=1000:history_size=7:log_exe_name=true:log_path=tsan'
+ubsan_options = 'halt_on_error=1:abort_on_error=1:disable_coredump=0'
+
+# Refer to sanitize.c.in for the justification
+config_sanitize = configuration_data()
+
+config_sanitize.set10('BIND_ASAN_ENABLED', 'address' in sanitizer)
+config_sanitize.set10('BIND_LSAN_ENABLED', 'leak' in sanitizer)
+config_sanitize.set10('BIND_TSAN_ENABLED', 'thread' in sanitizer)
+config_sanitize.set10('BIND_UBSAN_ENABLED', 'undefined' in sanitizer)
+config_sanitize.set('BIND_ASAN_OPTIONS', asan_options)
+config_sanitize.set('BIND_TSAN_OPTIONS', tsan_options)
+config_sanitize.set('BIND_UBSAN_OPTIONS', ubsan_options)
+
 ### Environment
 
 env = environment(
@@ -256,6 +272,15 @@ env = environment(
     },
 )
 
+# Meson defines these variables in unit tests when not set
+test_env = environment(
+    {
+        'ASAN_OPTIONS': asan_options,
+        'TSAN_OPTIONS': tsan_options,
+        'UBSAN_OPTIONS': ubsan_options,
+    },
+)
+
 ### Configuration
 config = configuration_data()
 
@@ -1093,6 +1118,12 @@ bind_keys = custom_target(
     ],
 )
 
+default_sanitize_options = configure_file(
+    input: files('sanitize.c.in'),
+    output: 'sanitize.c',
+    configuration: config_sanitize,
+)
+
 # Headers
 dns_inc = include_directories('lib' / 'dns' / 'include')
 isc_inc = include_directories('lib' / 'isc' / 'include')
@@ -1313,6 +1344,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
     ],
@@ -1324,7 +1356,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: true,
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libisccfg_dep,
@@ -1338,6 +1370,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1353,6 +1386,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1366,6 +1400,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1379,6 +1414,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1392,6 +1428,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1405,6 +1442,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1418,6 +1456,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1431,6 +1470,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1444,6 +1484,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1457,6 +1498,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1470,6 +1512,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1484,6 +1527,7 @@ if config.has('HAVE_DNSTAP')
         export_dynamic: true,
         implicit_include_directories: true,
         install: true,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1499,6 +1543,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1514,6 +1559,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1527,7 +1573,7 @@ executable(
     implicit_include_directories: true,
     include_directories: [bin_inc],
     install: true,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1541,6 +1587,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,
@@ -1561,6 +1608,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1573,6 +1621,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1585,6 +1634,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1599,6 +1649,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1653,7 +1704,7 @@ executable(
     include_directories: [named_inc, bin_inc],
     install: true,
     install_dir: sbindir,
-    sources: bind_keys,
+    sources: [bind_keys, default_sanitize_options],
     dependencies: named_deps
     + [
         openssl_dep,
@@ -1677,6 +1728,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1689,6 +1741,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1705,6 +1758,7 @@ executable(
     export_dynamic: true,
     implicit_include_directories: false,
     install: true,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1724,6 +1778,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1737,6 +1792,7 @@ executable(
     implicit_include_directories: false,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1753,6 +1809,7 @@ executable(
     include_directories: confgen_inc_p,
     install: true,
     install_dir: sbindir,
+    sources: default_sanitize_options,
     dependencies: [
         libdns_dep,
         libisc_dep,
@@ -1823,6 +1880,7 @@ foreach name, sources : fuzz_binaries
         install: false,
         c_args: ['-Wno-vla'],
         link_args: fuzz_link_args,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
@@ -1847,6 +1905,7 @@ foreach name, sources : system_test_binaries
         export_dynamic: true,
         implicit_include_directories: false,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libdns_dep,
             libisc_dep,
diff --git a/sanitize.c.in b/sanitize.c.in
new file mode 100644
index 00000000000..8b5a9fcefe6
--- /dev/null
+++ b/sanitize.c.in
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * We do not use `__SANITIZE_XXXX__` or `__has_feature` for the following
+ * reasons:
+ *
+ * - `__SANITIZE_UNDEFINED__` doesn't exist at all (currently GCC 15 & clang 21)
+ * - Other `__SANITIZE_XXXX__` macros don't exist in clang <23 [1]
+ * - `__has_feature` doesn't exist in GCC <14 [2]
+ *
+ * [1]: https://github.com/llvm/llvm-project/pull/153888
+ * [2]: https://gcc.gnu.org/gcc-14/changes.html#c-family
+ */
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-prototypes"
+
+#if @BIND_ASAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__asan_default_options(void) {
+	return "@BIND_ASAN_OPTIONS@";
+}
+#endif
+
+/* ASAN will usually also enable LSAN */
+#if @BIND_ASAN_ENABLED@ || @BIND_LSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__lsan_default_suppressions(void) {
+    return
+        /* These are known leaks in libp11 */
+        "leak:BN_MONT_CTX_new\n"
+        "leak:C_LoadModule\n"
+        "leak:ctx_new\n"
+        "leak:ctx_try_load_object\n"
+        "leak:dlfcn_name_converter\n"
+        "leak:EC_GROUP_set_seed\n"
+        "leak:CRYPTO_strdup\n"
+        "leak:CRYPTO_zalloc\n"
+        "leak:pkcs11_check_token\n"
+        "leak:pkcs11_CTX_new\n"
+        "leak:pkcs11_enumerate_slots\n"
+        "leak:pkcs11_getattr_alloc\n"
+        "leak:pkcs11_init_key\n"
+        "leak:pkcs11_strdup\n"
+        "leak:xmlGetGlobalState\n"
+        "leak:xmlNewGlobalState\n"
+        "leak:__xmlDefaultBufferSize\n";
+}
+#endif
+
+#if @BIND_TSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_options(void) {
+	return "@BIND_TSAN_OPTIONS@";
+}
+
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__tsan_default_suppressions(void) {
+	return
+		/* Uninstrumented libraries */
+		"called_from_lib:libfstrm.so\n"
+		"race:dummyrpz\n"
+		/* FreeBSD false-positive, see GL#5267 */
+		"race:libexec/rtld-elf/rtld_malloc.c\n"
+		/* FreeBSD false-positive, see GL#5266 */
+		"deadlock:add_trace_entry";
+}
+#endif
+
+#if @BIND_UBSAN_ENABLED@
+__attribute__((no_sanitize("address", "leak", "thread", "undefined")))
+const char *
+__ubsan_default_options(void) {
+	return "@BIND_UBSAN_OPTIONS@";
+}
+#endif
+
+#pragma GCC diagnostic pop
diff --git a/suppr-lsan.txt b/suppr-lsan.txt
deleted file mode 100644
index ac08aa9a881..00000000000
--- a/suppr-lsan.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-# These are known leaks in libp11.
-leak:BN_MONT_CTX_new
-leak:C_LoadModule
-leak:ctx_new
-leak:ctx_try_load_object
-leak:dlfcn_name_converter
-leak:EC_GROUP_set_seed
-leak:CRYPTO_strdup
-leak:CRYPTO_zalloc
-leak:pkcs11_check_token
-leak:pkcs11_CTX_new
-leak:pkcs11_enumerate_slots
-leak:pkcs11_getattr_alloc
-leak:pkcs11_init_key
-leak:pkcs11_strdup
-leak:xmlGetGlobalState
-leak:xmlNewGlobalState
-leak:__xmlDefaultBufferSize
diff --git a/tests/bench/meson.build b/tests/bench/meson.build
index b16b529ada9..ec1bf9dee96 100644
--- a/tests/bench/meson.build
+++ b/tests/bench/meson.build
@@ -24,6 +24,7 @@ foreach bench : [
         files(fs.replace_suffix(bench, '.c')),
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -42,6 +43,7 @@ executable(
     export_dynamic: true,
     include_directories: '..' / '..' / 'fuzz',
     install: false,
+    sources: default_sanitize_options,
     dependencies: [
         libisc_dep,
         libdns_dep,
diff --git a/tests/dns/meson.build b/tests/dns/meson.build
index 72b67547193..ba166f5a72b 100644
--- a/tests/dns/meson.build
+++ b/tests/dns/meson.build
@@ -77,6 +77,7 @@ foreach unit : dns_tests
                 meson.project_source_root() / 'bin' / 'tests' / 'system' / 'geoip2' / 'data',
             ),
         ],
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -95,6 +96,7 @@ foreach unit : dns_tests
         unit,
         test_bin,
         depends: master_data,
+        env: test_env,
         suite: ['dns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),
diff --git a/tests/isc/meson.build b/tests/isc/meson.build
index 5aa7ecafeed..0029ae6130e 100644
--- a/tests/isc/meson.build
+++ b/tests/isc/meson.build
@@ -77,6 +77,7 @@ foreach unit : isc_test
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libtest_dep,
@@ -101,9 +102,9 @@ foreach unit : isc_test
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: suites,
         timeout: timeout,
         workdir: meson.current_source_dir(),
-        env: env,
     )
 endforeach
diff --git a/tests/isccfg/meson.build b/tests/isccfg/meson.build
index ece606e0a0b..0055f42f43b 100644
--- a/tests/isccfg/meson.build
+++ b/tests/isccfg/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libisccfg_dep,
@@ -32,6 +33,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['isccfg', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),
diff --git a/tests/ns/meson.build b/tests/ns/meson.build
index dc14986280e..75c52602235 100644
--- a/tests/ns/meson.build
+++ b/tests/ns/meson.build
@@ -20,6 +20,7 @@ foreach unit : [
         build_by_default: false,
         export_dynamic: true,
         install: false,
+        sources: default_sanitize_options,
         dependencies: [
             libisc_dep,
             libdns_dep,
@@ -36,6 +37,7 @@ foreach unit : [
     test(
         unit,
         test_bin,
+        env: test_env,
         suite: ['ns', 'cmocka'],
         timeout: 300,
         workdir: meson.current_source_dir(),