X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=22ebd6f8a802e380e02d5a1fa02b0d92c45111a6;hb=b254eba41857cd7c2cd9d9e3ac019fae1979aae2;hp=544c567b37bc7434a414abb047638ee1fa9cc74a;hpb=a1ade38eef7f07b148c07f1d2721fae8f1c8d5b1;p=blhc%2Fblhc.git diff --git a/bin/blhc b/bin/blhc index 544c567..22ebd6f 100755 --- a/bin/blhc +++ b/bin/blhc @@ -42,6 +42,10 @@ my $cc_regex_full = qr/ (?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)? $cc_regex /x; +# Regex to check if a line contains a compiler command. +my $cc_regex_normal = qr/ + \b$cc_regex(?:\s|\\) + /x; # Regex to catch (GCC) compiler warnings. my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/; @@ -102,10 +106,22 @@ my @header_preprocess = ( # C++ qw( hh H hp hxx hpp HPP h++ tcc ), ); +# Object files. +my @object = ( + # Normal object files. + qw ( o ), + # Libtool object files. + qw ( lo la ), + # Dynamic libraries. bzip2 uses .sho. + qw ( so sho ), + # Static libraries. + qw ( a ), +); # Hashes for fast extensions lookup to check if a file falls in one of these # categories. my %extensions_no_preprocess = map { $_ => 1 } ( + # There's no @header_no_preprocess. @source_no_preprocess, ); my %extensions_preprocess = map { $_ => 1 } ( @@ -128,10 +144,14 @@ my %extensions_compile_cpp = map { $_ => 1 } ( @source_preprocess_compile_cpp, @source_no_preprocess_compile_cpp, ); +my %extensions_object = map { $_ => 1 } ( + @object, +); my %extension = map { $_ => 1 } ( @source_no_preprocess, @header_preprocess, @source_preprocess, + @object, ); # Regexp to match file extensions. @@ -555,7 +575,7 @@ if (scalar @option_ignore_flag > 0) { # Same for arch specific ignore flags, but only prepare here. if (scalar @option_ignore_arch_flag > 0) { foreach my $ignore (@option_ignore_arch_flag) { - my ($ignore_arch, $ignore_flag) = split ':', $ignore, 2; + my ($ignore_arch, $ignore_flag) = split /:/, $ignore, 2; if (not $ignore_arch or not $ignore_flag) { printf STDERR 'Value "%s" invalid for option ignore-arch-flag ' @@ -581,7 +601,7 @@ foreach my $ignore (@option_ignore_line) { # Same for arch specific ignore lines. if (scalar @option_ignore_arch_line > 0) { foreach my $ignore (@option_ignore_arch_line) { - my ($ignore_arch, $ignore_line) = split ':', $ignore, 2; + my ($ignore_arch, $ignore_line) = split /:/, $ignore, 2; if (not $ignore_arch or not $ignore_line) { printf STDERR 'Value "%s" invalid for option ignore-arch-line ' @@ -601,6 +621,8 @@ FILE: foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; + -f $file or die "No such file: $file"; + open my $fh, '<', $file or die $!; # Architecture of this file. @@ -619,8 +641,7 @@ foreach my $file (@ARGV) { # only, doesn't use the dpkg-buildpackage header. Necessary to ignore # build logs which aren't built (wrong architecture, build error, # etc.). - if (not $arch - and $line =~ /^Architecture: (.+)$/) { + if (not $arch and $line =~ /^Architecture: (.+)$/) { $arch = $1; } @@ -655,10 +676,10 @@ foreach my $file (@ARGV) { and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { if (not $option_buildd) { error_invalid_cmake($1); + $exit |= $exit_code{invalid_cmake}; } else { print "$buildd_tag{invalid_cmake}|$1|\n"; } - $exit |= $exit_code{invalid_cmake}; } # If hardening wrapper is used (wraps calls to gcc and adds hardening @@ -667,10 +688,10 @@ foreach my $file (@ARGV) { and $line =~ /\bhardening-wrapper\b/) { if (not $option_buildd) { error_hardening_wrapper(); + $exit |= $exit_code{hardening_wrapper}; } else { print "$buildd_tag{hardening_wrapper}||\n"; } - $exit |= $exit_code{hardening_wrapper}; next FILE; } @@ -681,6 +702,10 @@ foreach my $file (@ARGV) { # Input lines, contain only the lines with compiler commands. my @input = (); + # Non-verbose lines in the input. Used to reduce calls to + # is_non_verbose_build() (which is quite slow) in the second loop when + # it's already clear if a line is non-verbose or not. + my @input_nonverbose = (); my $continuation = 0; my $complete_line = undef; @@ -699,7 +724,7 @@ foreach my $file (@ARGV) { # Ignore compiler warnings for now. next if $line =~ /$warning_regex/o; - if (not $option_buildd and index($line, "\033") != -1) { # esc + if (not $option_buildd and index($line, "\033") != -1) { # \033 = esc # Remove all ANSI color sequences which are sometimes used in # non-verbose builds. $line = Term::ANSIColor::colorstrip($line); @@ -751,7 +776,7 @@ foreach my $file (@ARGV) { # Ignore lines with no compiler commands. next if not $non_verbose - and not $line =~ /\b$cc_regex(?:\s|\\)/o; + and not $line =~ /$cc_regex_normal/o; # Ignore lines with no filenames with extensions. May miss some # non-verbose builds (e.g. "gcc -o test" [sic!]), but shouldn't be # a problem as the log will most likely contain other non-verbose @@ -766,7 +791,7 @@ foreach my $file (@ARGV) { and $line =~ /^(?:checking|[Cc]onfigure:) /; next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)? [Cc]ompiler[\s.]*:?\s+ - /xo; + /x; next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or # similar for other architectures) which gets recognized as a @@ -775,6 +800,14 @@ foreach my $file (@ARGV) { \s.+\s -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)? \s}x; + # Ignore false positives when the line contains only CC=gcc but no + # other gcc command. + if ($line =~ /(.*)CC=$cc_regex_full(.*)/o) { + my $before = $1; + my $after = $2; + next if not $before =~ /$cc_regex_normal/o + and not $after =~ /$cc_regex_normal/o; + } # Check if additional hardening options were used. Used to ensure # they are used for the complete build. @@ -783,6 +816,7 @@ foreach my $file (@ARGV) { $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); push @input, $line; + push @input_nonverbose, $non_verbose; } } @@ -801,10 +835,10 @@ foreach my $file (@ARGV) { if (scalar @input == 0) { if (not $option_buildd) { print "No compiler commands!\n"; + $exit |= $exit_code{no_compiler_commands}; } else { print "$buildd_tag{no_compiler_commands}||\n"; } - $exit |= $exit_code{no_compiler_commands}; next FILE; } @@ -814,7 +848,7 @@ foreach my $file (@ARGV) { # Option or auto detected. if ($arch) { - # The following was partially copied from dpkg-dev 1.16.1.2 + # The following was partially copied from dpkg-dev 1.16.4.3 # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), # copyright Raphaël Hertzog , Kees Cook # , Canonical, Ltd. licensed under GPL version 2 or @@ -873,9 +907,9 @@ foreach my $file (@ARGV) { # Ignore flags for this arch if requested. if ($arch and exists $option_ignore_arch_flag{$arch}) { - my @flag_refs = (\@cflags, \@cxxflags, \@cppflags, \@ldflags); + my @local_flag_refs = (\@cflags, \@cxxflags, \@cppflags, \@ldflags); - remove_flags(\@flag_refs, + remove_flags(\@local_flag_refs, \%flag_renames, @{$option_ignore_arch_flag{$arch}}); } @@ -896,13 +930,14 @@ LINE: } my $skip = 0; - if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { + if ($input_nonverbose[$i] + and is_non_verbose_build($line, $input[$i + 1], \$skip)) { if (not $option_buildd) { error_non_verbose_build($line); + $exit |= $exit_code{non_verbose_build}; } else { $statistics{commands_nonverbose}++; } - $exit |= $exit_code{non_verbose_build}; next; } # Even if it's a verbose build, we might have to skip this line. @@ -912,7 +947,7 @@ LINE: # checks easier and faster. $line =~ s/^.*?$cc_regex//o; # "([...] test.c)" is not detected as 'test.c' - fix this by removing - # the brace and similar characters. + # the brace and similar characters at the line end. $line =~ s/['")]+$//; # Skip unnecessary tests when only preprocessing. @@ -961,18 +996,29 @@ LINE: $preprocess = 1; } - # If there are source files then it's compiling/linking in one step - # and we must check both. We only check for source files here, because - # header files cause too many false positives. - if (not $flag_preprocess - and extension_found(\%extensions_compile_link, @extensions)) { - # Assembly files don't need CFLAGS. - if (not extension_found(\%extensions_compile, @extensions) - and extension_found(\%extensions_no_compile, @extensions)) { - $compile = 0; - # But the rest does. - } else { - $compile = 1; + if (not $flag_preprocess) { + # If there are source files then it's compiling/linking in one + # step and we must check both. We only check for source files + # here, because header files cause too many false positives. + if (extension_found(\%extensions_compile_link, @extensions)) { + # Assembly files don't need CFLAGS. + if (not extension_found(\%extensions_compile, @extensions) + and extension_found(\%extensions_no_compile, @extensions)) { + $compile = 0; + # But the rest does. + } else { + $compile = 1; + } + # No compilable extensions found, either linking or compiling + # header flags. + # + # If there are also no object files we are just compiling headers + # (.h -> .h.gch). Don't check for linker flags in this case. Due + # to our liberal checks for compiler lines, this also reduces the + # number of false positives considerably. + } elsif ($link + and not extension_found(\%extensions_object, @extensions)) { + $link = 0; } } @@ -1003,10 +1049,10 @@ LINE: and index($line, '`dpkg-buildflags --get CFLAGS`') == -1) { if (not $option_buildd) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_missing}++; } - $exit |= $exit_code{flags_missing}; } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be # linked with -fPIE as well. It's no error if only PIE flags @@ -1016,10 +1062,10 @@ LINE: and index($line, '`dpkg-buildflags --get CXXFLAGS`') == -1) { if (not $option_buildd) { error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_cpp_missing}++; } - $exit |= $exit_code{flags_missing}; } if ($preprocess and (not all_flags_used($line, \@missing, @cppflags) @@ -1030,10 +1076,10 @@ LINE: and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) { if (not $option_buildd) { error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{preprocess_missing}++; } - $exit |= $exit_code{flags_missing}; } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. @@ -1042,10 +1088,10 @@ LINE: and index($line, '`dpkg-buildflags --get LDFLAGS`') == -1) { if (not $option_buildd) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{link_missing}++; } - $exit |= $exit_code{flags_missing}; } } } @@ -1109,6 +1155,9 @@ It's designed to check build logs generated by Debian's dpkg-buildpackage (or tools using dpkg-buildpackage like pbuilder or the official buildd build logs) to help maintainers detect missing hardening flags in their packages. +Only gcc is detected as compiler at the moment. If other compilers support +hardening flags as well, please report them. + If there's no output, no flags are missing and the build log is fine. =head1 OPTIONS @@ -1151,6 +1200,11 @@ detected). Don't require Term::ANSIColor. +=item * + +Return exit code 0, unless there was a error (-I, -W messages don't count as +error). + =back =item B<--color> @@ -1332,7 +1386,7 @@ Simon Ruderich, Esimon@ruderich.orgE Thanks to to Bernhard R. Link Ebrlink@debian.orgE and Jaria Alto Ejari.aalto@cante.netE for their valuable input and suggestions. -=head1 COPYRIGHT AND LICENSE +=head1 LICENSE AND COPYRIGHT Copyright (C) 2012 by Simon Ruderich