Package: wxmaxima Version: 12.04.0-1 Severity: normal Tags: patch Dear Maintainer,
The CPPFLAGS hardening flags are missing because the build system
overwrites them in ./configure. For more hardening information
please have a look at [1], [2] and [3].
The attached patch fixes the issue, if possible it should be sent
to upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):
$ hardening-check /usr/bin/wxmaxima
/usr/bin/wxmaxima:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: no, only unprotected functions found!
Read-only relocations: yes
Immediate binding: no not found!
Fortify Source functions is still no, but now the CPPFLAGS are
passed correctly and thus will be used when possible in the
future.
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Don't overwrite CPPFLAGS in ./configure. Necessary for (hardening) flags from dpkg-buildflags. . $WX_CXXFLAGS contains CPPFLAGS and LDFLAGS. As it's called CXXFLAGS append it to CXXFLAGS. Author: Simon Ruderich <[email protected]> Last-Update: 2012-05-02 Index: wxmaxima-12.04.0/configure =================================================================== --- wxmaxima-12.04.0.orig/configure 2012-05-02 22:19:20.028531219 +0200 +++ wxmaxima-12.04.0/configure 2012-05-02 22:26:09.676533036 +0200 @@ -4399,8 +4399,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu LIBS=$ac_save_LIBS - CXXFLAGS=$ac_save_CXXFLAGS - CPPFLAGS=$WX_CXXFLAGS + CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS" fi if test x"${win32}" = x"true" ; then Index: wxmaxima-12.04.0/configure.in =================================================================== --- wxmaxima-12.04.0.orig/configure.in 2012-05-02 22:19:20.028531219 +0200 +++ wxmaxima-12.04.0/configure.in 2012-05-02 22:19:53.996531369 +0200 @@ -130,8 +130,7 @@ AC_MSG_ERROR([Failed to compile a test program])]) AC_LANG_RESTORE LIBS=$ac_save_LIBS - CXXFLAGS=$ac_save_CXXFLAGS - CPPFLAGS=$WX_CXXFLAGS + CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS" fi dnl
signature.asc
Description: Digital signature
