Greetings! A Debian user requested this security patch be forwarded to
you.
Take care,
=============================================================================
Subject: Bug#665202: cxref: CPPFLAGS hardening flags missing
Reply-To: Simon Ruderich <si...@ruderich.org>, 665...@bugs.debian.org
Resent-From: Simon Ruderich <si...@ruderich.org>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: si...@ruderich.org, Camm Maguire <c...@debian.org>
Resent-Sender: ow...@bugs.debian.org
X-Spam-Status: No, score=-17.7 required=4.0 tests=BAYES_00,FOURLA,
FVGT_m_MULTI_ODD,HAS_PACKAGE,MURPHY_DRUGS_REL8,PGPSIGNATURE,RCVD_IN_DNSWL_LOW,
SPF_PASS,X_DEBBUGS_CC autolearn=ham
version=3.3.1-bugs.debian.org_2005_01_02
Date: Thu, 22 Mar 2012 16:32:16 +0100
From: Simon Ruderich <si...@ruderich.org>
To: Debian Bug Tracking System <sub...@bugs.debian.org>
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="=_zucker.schokokeks.org-18589-1332430337-0001-2"
Content-Disposition: inline
[1:multipart/mixed Hide]
[1/1:text/plain Hide]
Package: cxref
Severity: important
Tags: patch
Dear Maintainer,
The CPPFLAGS hardening flags are missing because the build system
ignores them.
The attached patch fixes the issue. If possible it should be sent
upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/cxref /usr/bin/cxref-query
/usr/bin/cxref-cpp.upstream
/usr/bin/cxref:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/cxref-query:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/cxref-cpp.upstream:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
[1/2:text/x-diff Show Save:use-cppflags.patch (10kB)]
[2:application/pgp-signature Show Save:signature.asc (836B)]
=============================================================================
--
Camm Maguire c...@maguirefamily.org
==========================================================================
"The earth is but one country, and mankind its citizens." -- Baha'u'llah
Description: Use CPPFLAGS.
Necessary for hardening flags.
Author: Simon Ruderich <si...@ruderich.org>
Last-Update: 2012-03-22
Index: cxref-1.6c/src/Makefile.in
===================================================================
--- cxref-1.6c.orig/src/Makefile.in 2012-03-22 16:14:44.000000000 +0100
+++ cxref-1.6c/src/Makefile.in 2012-03-22 16:14:44.000000000 +0100
@@ -33,6 +33,7 @@
LD=@CC@
CFLAGS=@CFLAGS@
+CPPFLAGS=@CPPFLAGS@
LDFLAGS=@LDFLAGS@
# The Yacc program
@@ -175,15 +176,15 @@
.SUFFIXES: .c .o
.c.o:
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE)
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE)
cxref.o : cxref.c cxref.h datatype.h memory.h parse-yy.h version.h
- [ ! -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) "-DCXREF_CPP=\"$(cpp_dir)/cxref-cpp -cxref-cpp-defines $(cpp_dir)/cxref-cpp.defines -lang-c -C -dD -dI\""
- [ -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE)
+ [ ! -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) "-DCXREF_CPP=\"$(cpp_dir)/cxref-cpp -cxref-cpp-defines $(cpp_dir)/cxref-cpp.defines -lang-c -C -dD -dI\""
+ [ -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE)
cxref-inst.o : cxref.c cxref.h datatype.h memory.h parse-yy.h
- [ ! -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) '-DCXREF_CPP="cxref-cpp -lang-c -C -dD -dI"'
- [ -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE)
+ [ ! -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) '-DCXREF_CPP="cxref-cpp -lang-c -C -dD -dI"'
+ [ -f ../cpp/cxref-cpp ] || $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE)
func.o : func.c cxref.h datatype.h memory.h parse-yy.h
type.o : type.c cxref.h datatype.h memory.h parse-yy.h
@@ -203,7 +204,7 @@
html.o : html.c cxref.h datatype.h memory.h version.h
html-style.o : html-style.c
rtf.o : rtf.c cxref.h datatype.h memory.h version.h
- $(CC) -c $(CFLAGS) $< -o $@ -DPAGE=\"$(PAGE)\" $(INCLUDE)
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ -DPAGE=\"$(PAGE)\" $(INCLUDE)
sgml.o : sgml.c cxref.h datatype.h memory.h version.h
parse-yacc.o : parse-yacc.c cxref.h datatype.h memory.h parse-yy.h parse-yacc.h
Index: cxref-1.6c/cpp/Makefile.in
===================================================================
--- cxref-1.6c.orig/cpp/Makefile.in 2004-11-06 18:29:54.000000000 +0100
+++ cxref-1.6c/cpp/Makefile.in 2012-03-22 16:18:37.193409068 +0100
@@ -35,6 +35,7 @@
LD=@CC@
CFLAGS=@CFLAGS@
+CPPFLAGS=@CPPFLAGS@
LDFLAGS=@LDFLAGS@
# The Yacc program
@@ -93,20 +94,20 @@
########
cccp.o : cccp.c config.h pcp.h autoconfig.h
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC \
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC \
'-DCXREF_CPP_DEFINES="$(datadir)/cxref-cpp.defines"'
@touch $@
cexp.o : cexp.c config.h autoconfig.h gansidecl.h ansidecl.h system.h libiberty.h intl.h
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC
@touch $@
prefix.o : prefix.c config.h autoconfig.h gansidecl.h ansidecl.h system.h libiberty.h prefix.h
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC -DPREFIX=\"/\"
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC -DPREFIX=\"/\"
@touch $@
version.o : version.c
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE) -DIN_GCC
@touch $@
########
--- cxref-1.6c.orig/query/Makefile.in
+++ cxref-1.6c/query/Makefile.in
@@ -34,6 +34,7 @@ CC=@CC@
LD=@CC@
CFLAGS=@CFLAGS@
+CPPFLAGS=@CPPFLAGS@
LDFLAGS=@LDFLAGS@
########
@@ -84,7 +85,7 @@ cxref-query : $(OBJ_FILES)
.SUFFIXES: .c .o
.c.o:
- $(CC) -c $(CFLAGS) $< -o $@ $(INCLUDE)
+ $(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@ $(INCLUDE)
query.o : query.c query.h ../src/cxref.h ../src/datatype.h ../src/memory.h
input.o : input.c query.h ../src/cxref.h ../src/datatype.h ../src/memory.h
