Package: afnix Version: 2.2.0-1 Severity: important Tags: patch Dear Maintainer,
The hardening flags are missing because the build system ignores
them.
The attached patch (use-dpkg-buildflags.patch) fixes the issue.
The second patch (verbose-build.patch) prevents a false positive
when checking the build log for non-verbose builds.
Btw. you should refresh your quilt patches, some apply with
offset (quilt pop -a; while quilt push && quilt refresh; do :; done).
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/lib/afnix/libafnix-eng.so.2.2.0
/usr/lib/afnix/libafnix-std.so.2.2.0 /usr/lib/afnix/libafnix-plt.so.2.2.0
/usr/bin/axd ...
/usr/lib/afnix/libafnix-eng.so.2.2.0:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/afnix/libafnix-std.so.2.2.0:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/afnix/libafnix-plt.so.2.2.0:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/axd:
Position Independent Executable: no, normal executable!
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use build flags from environment (dpkg-buildflags). Necessary for hardening flags. . CPPFLAGS contains preprocessor flags, not flags for .cpp files. Author: Simon Ruderich <[email protected]> Last-Update: 2012-03-23 Index: afnix-2.2.0/cnf/mak/afnix-rule.mak =================================================================== --- afnix-2.2.0.orig/cnf/mak/afnix-rule.mak 2012-03-23 16:28:31.661433331 +0100 +++ afnix-2.2.0/cnf/mak/afnix-rule.mak 2012-03-23 16:28:32.461433362 +0100 @@ -16,34 +16,34 @@ ifeq ($(CCMODE),debug) ENVFLAGS = $(STDEVFLAGS) $(PLTEVFLAGS) - CPPFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(DEBUGFLAGS) - CXXFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(DEBUGFLAGS) - CCDEFINE = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) + CPPFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(DEBUGFLAGS) + CXXFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(DEBUGFLAGS) + CCDEFINE_ = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) endif ifeq ($(CCMODE),optimized) ENVFLAGS = $(STDEVFLAGS) $(PLTEVFLAGS) - CPPFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(OPTCCFLAGS) - CXXFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(OPTCCFLAGS) - CCDEFINE = $(STDDEFINES) $(PLTDEFINES) $(OPTDEFINES) + CPPFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(OPTCCFLAGS) + CXXFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(OPTCCFLAGS) + CCDEFINE_ = $(STDDEFINES) $(PLTDEFINES) $(OPTDEFINES) endif ifeq ($(CCMODE),profiled) ENVFLAGS = $(STDEVFLAGS) $(PLTEVFLAGS) - CPPFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(PFLCCFLAGS) - CXXFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(PFLCCFLAGS) - CCDEFINE = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) + CPPFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(PFLCCFLAGS) + CXXFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(PFLCCFLAGS) + CCDEFINE_ = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) endif ifeq ($(CCMODE),coverage) ENVFLAGS = $(STDEVFLAGS) $(PLTEVFLAGS) - CPPFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(COVCCFLAGS) - CXXFLAGS = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(COVCCFLAGS) - CCDEFINE = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) + CPPFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CPPCCFLAGS) $(COVCCFLAGS) + CXXFLAGS_ = $(STDCCFLAGS) $(PLTCCFLAGS) $(CXXCCFLAGS) $(COVCCFLAGS) + CCDEFINE_ = $(STDDEFINES) $(PLTDEFINES) $(DBGDEFINES) endif -PPFLAGS = $(CPPFLAGS) $(EXTCPPFLAGS) -XXFLAGS = $(CXXFLAGS) $(EXTCXXFLAGS) +PPFLAGS = $(CPPFLAGS) $(CXXFLAGS) $(CPPFLAGS_) $(EXTCPPFLAGS) +XXFLAGS = $(CPPFLAGS) $(CXXFLAGS) $(CXXFLAGS_) $(EXTCXXFLAGS) DEFINES = $(CCDEFINE) $(EXTCCDEFINE) PPINCLS = $(STDINCLUDE) $(INCLUDE) XXINCLS = $(STDINCLUDE) $(EXTINCLUDES) $(INCLUDE) Index: afnix-2.2.0/cnf/mak/afnix-gcc-4.mak =================================================================== --- afnix-2.2.0.orig/cnf/mak/afnix-gcc-4.mak 2012-03-23 16:28:32.137433348 +0100 +++ afnix-2.2.0/cnf/mak/afnix-gcc-4.mak 2012-03-23 16:28:32.461433362 +0100 @@ -30,7 +30,8 @@ DYNCCFLAGS = -fPIC PLTCCFLAGS = DEBUGFLAGS = -g -OPTCCFLAGS = -O2 +# dpkg-buildflags sets -O2 when noopt is not used +OPTCCFLAGS = PFLCCFLAGS = -g -pg COVCCFLAGS = -g -fprofile-arcs -ftest-coverage CPPCCFLAGS = -nostdinc -nostdinc++ @@ -89,7 +90,7 @@ # adjust for linux platform ifeq ($(PLATNAME),linux) ARFLAGS = rc -LDFLAGS = -shared +LDFLAGS += -shared ifeq ($(LKMODE),soname) LDFLAGS += -Wl,-soname,$(SOMIN) endif @@ -99,7 +100,7 @@ # adjust for solaris platform ifeq ($(PLATNAME),solaris) ARFLAGS = rc -LDFLAGS = -shared +LDFLAGS += -shared ifeq ($(LKMODE),soname) LDFLAGS += -Wl,-h,$(SOMIN) endif @@ -109,7 +110,7 @@ # adjust for freebsd platform ifeq ($(PLATNAME),freebsd) ARFLAGS = rc -LDFLAGS = -shared +LDFLAGS += -shared ifeq ($(LKMODE),soname) LDFLAGS += -Wl,-soname,$(SOMIN) endif @@ -119,7 +120,7 @@ # adjust for gnu/freebsd platform ifeq ($(PLATNAME),gnukbsd) ARFLAGS = rc -LDFLAGS = -shared +LDFLAGS += -shared ifeq ($(LKMODE),soname) LDFLAGS += -Wl,-soname,$(SOMIN) endif @@ -129,7 +130,7 @@ # adjust for gnu platform ifeq ($(PLATNAME),gnu) ARFLAGS = rc -LDFLAGS = -shared +LDFLAGS += -shared ifeq ($(LKMODE),soname) LDFLAGS += -Wl,-soname,$(SOMIN) endif @@ -139,7 +140,7 @@ # adjust for darwin platform ifeq ($(PLATNAME),darwin) ARFLAGS = -rc -LDFLAGS = -dynamiclib $(PLTLDFLAGS) +LDFLAGS += -dynamiclib $(PLTLDFLAGS) ifeq ($(LKMODE),dylib) LDFLAGS += -compatibility_version $(MAJOR).$(MINOR) LDFLAGS += -current_version $(MAJOR).$(MINOR).$(PATCH) @@ -153,21 +154,22 @@ # - platform dependant final executable flags - # ---------------------------------------------------------------------------- -LKFLAGS = +# Can't use LDFLAGS as it's used for library linking flags. +LKFLAGS = $(shell dpkg-buildflags --get LDFLAGS) # adjust linker flags for linux ifeq ($(PLATNAME),linux) -LKFLAGS = -pthread +LKFLAGS += -pthread endif # adjust linker flags for freebsd ifeq ($(PLATNAME),freebsd) -LKFLAGS = -pthread +LKFLAGS += -pthread endif # adjust linker flags for darwin ifeq ($(PLATNAME),darwin) -LKFLAGS = $(PLTLKFLAGS) +LKFLAGS += $(PLTLKFLAGS) endif # ----------------------------------------------------------------------------
Description: Verbose build. Prevents false positives when checking the log for non-verbose builds. Author: Simon Ruderich <[email protected]> Last-Update: 2012-03-23 Index: afnix-2.2.0/prj/std/adp/src/Makefile =================================================================== --- afnix-2.2.0.orig/prj/std/adp/src/Makefile 2012-03-23 16:50:31.169483553 +0100 +++ afnix-2.2.0/prj/std/adp/src/Makefile 2012-03-23 16:51:37.649486083 +0100 @@ -51,12 +51,10 @@ # this rule build all source directories %.axc : %.als - @echo "compiling " $< - @$(AEXEC) --prefix=$(BLDDIR) --binexe=$(AXCEXE) $< + $(AEXEC) --prefix=$(BLDDIR) --binexe=$(AXCEXE) $< $(APPLIB) : $(APPAXC) - @echo "linking " $@ - @$(AEXEC) --noloop --prefix=$(BLDDIR) --binexe=$(AXLEXE) \ + $(AEXEC) --noloop --prefix=$(BLDDIR) --binexe=$(AXLEXE) \ --binopt="-c -m $(APPSTM) -f $@" $(APPAXC) @$(MKDIR) $(BLDPRJ) @$(CP) $@ $(BLDPRJ)
signature.asc
Description: Digital signature
