Package: adios
Version: 1.3-9
Severity: important
Tags: patch
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Maintainer,
The LDFLAGS hardening flags are missing because they are
overwritten in debian/rules.
DEB_*_MAINT_APPEND is the preferred way to set additional flags
(see man dpkg-buildflags for more information). For more
hardening information please have a look at [1], [2] and [3].
The following patch fixes the issue.
diff -Nru adios-1.3/debian/rules adios-1.3/debian/rules
--- adios-1.3/debian/rules 2012-03-09 18:35:00.000000000 +0100
+++ adios-1.3/debian/rules 2012-03-14 01:47:54.000000000 +0100
@@ -27,6 +27,9 @@
endif
BINDIR=debian/libadios-dev/usr/bin
+
+DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+
# magic debhelper rule
%:
dh $@ --with python2
@@ -36,7 +39,7 @@
find . -name '*.pyc' -delete
override_dh_auto_configure:
- LDFLAGS=" -Wl,--as-needed" dh_auto_configure -- $(WITH_LUSTRE)
--enable-shared --prefix=`pwd`/debian/tmp MPIFC=mpif77 CC=$(CC)
+ dh_auto_configure -- $(WITH_LUSTRE) --enable-shared
--prefix=`pwd`/debian/tmp MPIFC=mpif77 CC=$(CC)
override_dh_auto_install:
$(MAKE) install prefix=$(shell pwd)/debian/libadios-dev/usr
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/bp2ncd /usr/bin/bp2h5 /usr/bin/bp2bp ...
/usr/bin/bp2ncd:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/bp2h5:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/bp2bp:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
- -- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJPX+0eAAoJEJL+/bfkTDL5Yw0P/06kkK13cN4jj9ReHtaN0r39
DoRmxdMR23LcOD9jXn6FIWDNDBY1dqIw9WDnL8v1cGlybl+S+FP+kJqxwZt6XR16
qdrY/nQvFuFKJwnnUQVRQ1CQPjsig6oRhRZyWt8NF/kJDNLEYRv1kX9sR3p7qtcO
YbbdbJPuLwROThU9FwB0a5b0WifjBlpBv55ePPRoClkLlJNopJluwtVQ8JJNEPV8
UG+misKWMh0dEwPvsZgawSIa7vyRR4KXs9LkTaLjfz1+2Ez2aLluV9Dy5vpl15xB
c0uz+jn2m4r1bVdnxLQB0wPHbYsqZE6ns2ZbirTYmK3VjrPuUXZaMZvpVSvDCtsD
+u1mNYz1evsll85kucM9N7XB+ZKQ474icW/IESEW65nFJahQwfWBWxgQJBuxtzMY
J0Q+zZi2u2PNR+8GNdMOvbnadldeDwK5UHTKbn35L6tZ+VOePeLhkkTT7ySUwWYV
mm5dxGI4wew2XWKFup25wD7XxGBaJ8fG8rj+wAEGeXT/3Ltcwa4XHLHpIUih2SH2
cH1BiXCkKZ03PjvPCBefp707bKG1AyxZbg9eU3n8u+06uoFS3xMnlunMjC2Y02Of
bAjcN2dNuAzbsX12HJ7wVD5xssAxdBJZZpg+KiMrWVEtgg6VrmCUj8MnvqbmrzKU
AQV67xR3SiuzPqdV8Wim
=OlqJ
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
