Your message dated Tue, 29 Apr 2014 10:04:55 +1200 with message-id <20140428220455.GA2863@gemse> and subject line Re: Bug#671270: wxmaxima: CPPFLAGS hardening flags missing has caused the Debian Bug report #671270, regarding wxmaxima: CPPFLAGS hardening flags missing to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 671270: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=671270 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: wxmaxima Version: 12.04.0-1 Severity: normal Tags: patch Dear Maintainer, The CPPFLAGS hardening flags are missing because the build system overwrites them in ./configure. For more hardening information please have a look at [1], [2] and [3]. The attached patch fixes the issue, if possible it should be sent to upstream. To check if all flags were correctly enabled you can use `hardening-check` from the hardening-includes package and check the build log (for example with blhc [4]) (hardening-check doesn't catch everything): $ hardening-check /usr/bin/wxmaxima /usr/bin/wxmaxima: Position Independent Executable: no, normal executable! Stack protected: yes Fortify Source functions: no, only unprotected functions found! Read-only relocations: yes Immediate binding: no not found! Fortify Source functions is still no, but now the CPPFLAGS are passed correctly and thus will be used when possible in the future. (Position Independent Executable and Immediate binding is not enabled by default.) Use find -type f \( -executable -o -name \*.so\* \) -exec hardening-check {} + on the build result to check all files. Regards, Simon [1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags [2]: https://wiki.debian.org/HardeningWalkthrough [3]: https://wiki.debian.org/Hardening [4]: http://ruderich.org/simon/blhc/ -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9Description: Don't overwrite CPPFLAGS in ./configure. Necessary for (hardening) flags from dpkg-buildflags. . $WX_CXXFLAGS contains CPPFLAGS and LDFLAGS. As it's called CXXFLAGS append it to CXXFLAGS. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-05-02 Index: wxmaxima-12.04.0/configure =================================================================== --- wxmaxima-12.04.0.orig/configure 2012-05-02 22:19:20.028531219 +0200 +++ wxmaxima-12.04.0/configure 2012-05-02 22:26:09.676533036 +0200 @@ -4399,8 +4399,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu LIBS=$ac_save_LIBS - CXXFLAGS=$ac_save_CXXFLAGS - CPPFLAGS=$WX_CXXFLAGS + CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS" fi if test x"${win32}" = x"true" ; then Index: wxmaxima-12.04.0/configure.in =================================================================== --- wxmaxima-12.04.0.orig/configure.in 2012-05-02 22:19:20.028531219 +0200 +++ wxmaxima-12.04.0/configure.in 2012-05-02 22:19:53.996531369 +0200 @@ -130,8 +130,7 @@ AC_MSG_ERROR([Failed to compile a test program])]) AC_LANG_RESTORE LIBS=$ac_save_LIBS - CXXFLAGS=$ac_save_CXXFLAGS - CPPFLAGS=$WX_CXXFLAGS + CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS" fi dnl
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---fixed 671270 13.04.2-1 thanks On Wed, May 02, 2012 at 10:31:08PM +0200, Simon Ruderich wrote: > The CPPFLAGS hardening flags are missing because the build system > overwrites them in ./configure. For more hardening information > please have a look at [1], [2] and [3]. > > The attached patch fixes the issue, if possible it should be sent > to upstream. Upstream applied essentially the same change in 13.04.2 (or perhaps in an earlier version not packaged for Debian), and you can see "-D_FORTIFY_SOURCE=2" in the buildd logs for 13.04.2-1, so closing this bug: https://buildd.debian.org/status/fetch.php?pkg=wxmaxima&arch=i386&ver=13.04.2-1&stamp=1371660631 Cheers, Olly
--- End Message ---
