reopen 656260 thanks Hello,
The hardening flags were not completely enabled because the build
system ignores them in various places: CPPFLAGS are ignored
completely, LDFLAGS in some places. For more hardening
information please have a look at [1], [2] and [3].
The following and the attached patch (which is a revised version
of 810_hardening.patch) fixes the issue.
diff -Nru hylafax-6.1~20111227/debian/rules hylafax-6.1~20111227/debian/rules
--- hylafax-6.1~20111227/debian/rules 2012-01-15 10:12:29.000000000 +0100
+++ hylafax-6.1~20111227/debian/rules 2012-03-15 21:25:19.000000000 +0100
@@ -2,6 +2,9 @@
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1
+# The build system doesn't use any flags from the environment! Pass
+# CFLAGS/CPPFLAGS via OPTIMIZER, LDFLAGS by patching the build system.
+
%:
dh $@
@@ -36,7 +39,7 @@
--with-COL="/usr/bin/col" \
--with-MKFIFO="/usr/bin/mkfifo" \
--with-SORT="/usr/bin/sort" \
- --with-OPTIMIZER="$(CFLAGS)" \
+ --with-OPTIMIZER="$(CFLAGS) $(CPPFLAGS)" \
--with-MANDIR="/usr/share/man" \
--with-PATH_IMPRIP="/usr/bin/psrip" \
--with-AWK="/usr/bin/awk"
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/sbin/lockname /usr/sbin/ondelay /usr/sbin/hfaxd
/usr/sbin/choptest ...
/usr/sbin/lockname:
Position Independent Executable: no, normal executable!
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
/usr/sbin/ondelay:
Position Independent Executable: no, normal executable!
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
/usr/sbin/hfaxd:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/sbin/choptest:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: harden hylafax source an build procedure Applied from Debian bug #656260 Author: Giuseppe Sacco <[email protected]> --- The information above should follow the Patch Tagging Guidelines, please checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here are templates for supplementary fields that you might want to add: Origin: <vendor|upstream|other>, <url of original patch> Bug: <url in upstream bugtracker> Bug-Debian: http://bugs.debian.org/656260 Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber> Forwarded: no Reviewed-By: <name and email of someone who approved the patch> Last-Update: 2012-03-15 Index: hylafax-6.1~20111227/defs.in =================================================================== --- hylafax-6.1~20111227.orig/defs.in 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/defs.in 2012-03-15 21:23:47.229197431 +0100 @@ -262,7 +262,8 @@ # then its make file should override the setting of SHDLIBC with a # line such as "SHDLIBC=". # -LDFLAGS = ${LDOPTS} ${LDLIBS} +LDFLAGS_ENV := $(shell dpkg-buildflags --get LDFLAGS) +LDFLAGS = ${LDFLAGS_ENV} ${LDOPTS} ${LDLIBS} LDOPTS = ${VLDOPTS} ${LLDOPTS} ${GLDOPTS} LDLIBS = ${VLDLIBS} ${LLDLIBS} ${GLDLIBS} Index: hylafax-6.1~20111227/libhylafax/FaxClient.c++ =================================================================== --- hylafax-6.1~20111227.orig/libhylafax/FaxClient.c++ 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/libhylafax/FaxClient.c++ 2012-03-15 21:23:47.233197432 +0100 @@ -116,7 +116,7 @@ void FaxClient::vprintWarning(const char* fmt, va_list ap) { - fprintf(stderr, NLS::TEXT("Warning, ")); + fprintf(stderr, "%s", NLS::TEXT("Warning, ")); vfprintf(stderr, fmt, ap); fputs("\n", stderr); } Index: hylafax-6.1~20111227/libhylafax/SNPPClient.c++ =================================================================== --- hylafax-6.1~20111227.orig/libhylafax/SNPPClient.c++ 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/libhylafax/SNPPClient.c++ 2012-03-15 21:23:47.233197432 +0100 @@ -103,7 +103,7 @@ void SNPPClient::vprintWarning(const char* fmt, va_list ap) { - fprintf(stderr, NLS::TEXT("Warning, ")); + fprintf(stderr, "%s", NLS::TEXT("Warning, ")); vfprintf(stderr, fmt, ap); fputs("\n", stderr); } Index: hylafax-6.1~20111227/libhylafax/TextFormat.c++ =================================================================== --- hylafax-6.1~20111227.orig/libhylafax/TextFormat.c++ 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/libhylafax/TextFormat.c++ 2012-03-15 21:23:47.233197432 +0100 @@ -1371,7 +1371,7 @@ { fxStr emsg; if (!decodeFontName(family, fontpath, emsg)) { - fprintf(stderr,emsg); + fprintf(stderr,"%s", (const char*)emsg); return NULL; } return Sys::fopen(fontpath, "r"); Index: hylafax-6.1~20111227/libhylafax/TypeRules.c++ =================================================================== --- hylafax-6.1~20111227.orig/libhylafax/TypeRules.c++ 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/libhylafax/TypeRules.c++ 2012-03-15 21:23:47.233197432 +0100 @@ -101,7 +101,7 @@ printf(" \"%s\"", value.s); else if (type != ASCII && type != ASCIIESC) { if (op == ANY) - printf(NLS::TEXT(" <any value>")); + printf("%s", NLS::TEXT(" <any value>")); else printf(" %#llx", (long long) value.v); } @@ -109,7 +109,7 @@ } if (off > (off_t)size) { if (verbose) - printf(NLS::TEXT("failed (offset past data)\n")); + printf("%s", NLS::TEXT("failed (offset past data)\n")); return (false); } bool ok = false; @@ -162,7 +162,7 @@ break; } if (verbose) - printf(NLS::TEXT("failed (insufficient data)\n")); + printf("%s", NLS::TEXT("failed (insufficient data)\n")); return (false); case LONG: if (off + 4 < (off_t)size) { @@ -171,7 +171,7 @@ break; } if (verbose) - printf(NLS::TEXT("failed (insufficient data)\n")); + printf("%s", NLS::TEXT("failed (insufficient data)\n")); return (false); } /* @@ -195,7 +195,7 @@ printf(NLS::TEXT("success (result %s, rule \"%s\")\n"), resultNames[result], (const char*) cmd); else - printf(NLS::TEXT("failed (comparison)\n")); + printf("%s", NLS::TEXT("failed (comparison)\n")); } return (ok); } @@ -496,6 +496,6 @@ return (&(*rules)[i + match2(i, data, size, verbose)]); } if (verbose) - printf(NLS::TEXT("no match\n")); + printf("%s", NLS::TEXT("no match\n")); return (NULL); } Index: hylafax-6.1~20111227/faxd/Makefile.in =================================================================== --- hylafax-6.1~20111227.orig/faxd/Makefile.in 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/faxd/Makefile.in 2012-03-15 21:23:47.233197432 +0100 @@ -181,7 +181,7 @@ hash.h: mkhash rm -f hash.h; ./mkhash > hash.h mkhash: ${SRCDIR}/mkhash.c - ${CCF} -o mkhash ${SRCDIR}/mkhash.c + ${CCF} -o mkhash ${SRCDIR}/mkhash.c ${LDFLAGS_ENV} faxQueueApp.o FaxRecv.o: incdepend: hash.h Index: hylafax-6.1~20111227/etc/Makefile.in =================================================================== --- hylafax-6.1~20111227.orig/etc/Makefile.in 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/etc/Makefile.in 2012-03-15 21:23:47.233197432 +0100 @@ -70,9 +70,9 @@ config.fax: ${ECHO} on >config.fax lockname: ${SRCDIR}/lockname.c - ${CCF} -o $@ ${SRCDIR}/lockname.c + ${CCF} -o $@ ${SRCDIR}/lockname.c ${LDFLAGS_ENV} ondelay: ${SRCDIR}/ondelay.c - ${CCF} -o $@ ${SRCDIR}/ondelay.c + ${CCF} -o $@ ${SRCDIR}/ondelay.c ${LDFLAGS_ENV} PUTSERVER = ${INSTALL} -idb ${PRODUCT}.sw.server PUTSAMPLE = ${PUTSERVER} -u ${FAXUSER} -g ${FAXGROUP} \ Index: hylafax-6.1~20111227/libhylafax/Makefile.LINUXdso =================================================================== --- hylafax-6.1~20111227.orig/libhylafax/Makefile.LINUXdso 2012-03-15 21:23:09.009195977 +0100 +++ hylafax-6.1~20111227/libhylafax/Makefile.LINUXdso 2012-03-15 21:23:47.233197432 +0100 @@ -36,7 +36,7 @@ libhylafax-${ABI_VERSION}.${DSO}.${ABI_PATCH}: ${OBJECTS} ${C++} ${DSOOPTS} -o $@ ${OBJECTS} \ ${DSODELAY} ${LIBTIFF} ${DSODELAY} ${LIBZ} ${DSODELAY} ${LIBREGEX} \ - ${MACHDEPLIBS} + ${MACHDEPLIBS} ${LDFLAGS_ENV} #../util/libhylafax-${ABI_VERSION}.${DSO}: libhylafax-${ABI_VERSION}.${DSO}
signature.asc
Description: Digital signature
