X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=f90fd7a2e0422971cd2a7558d80b243fc18dd97e;hb=HEAD;hp=26826f07a0abe87740087d16b1a3b63e8233b59f;hpb=766e4499437c6e872cc5870a821c4d10d2d8a63b;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index 26826f0..f90fd7a 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.13';
+our $VERSION = '0.14';
 
 
 # CONSTANTS/VARIABLES
@@ -237,9 +237,18 @@ my @def_cflags_stack_bad = (
     '-fno-stack-protector-all',
     '-fno-stack-protector-strong',
 );
+my @def_cflags_stack_clash = (
+    '-fstack-clash-protection',
+);
 my @def_cflags_pie = (
     '-fPIE',
 );
+my @def_cflags_branch_amd64 = (
+    '-fcf-protection',
+);
+my @def_cflags_branch_arm64 = (
+    '-mbranch-protection=standard',
+);
 my @def_cxxflags = (
     @def_cflags,
 );
@@ -280,7 +289,10 @@ my @flag_refs = (
     \@def_cflags_stack,
     \@def_cflags_stack_strong,
     \@def_cflags_stack_bad,
+    \@def_cflags_stack_clash,
     \@def_cflags_pie,
+    \@def_cflags_branch_amd64,
+    \@def_cflags_branch_arm64,
     \@def_cxxflags,
     \@def_cppflags,
     \@def_cppflags_fortify,
@@ -554,11 +566,12 @@ sub is_non_verbose_build {
     # C++ compiler setting.
     return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
     return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
+    return 0 if $line =~ /^\s*CXX\s*:\s*g\+\+\s*$/;
     # "Compiling" non binary files.
     return 0 if $line =~ /^\s*Compiling \S+\.(?:py|pyx|el)['"]?\s*(?:\.\.\.|because it changed\.)?$/;
     return 0 if $line =~ /^\s*[Cc]ompiling catalog \S+\.po\b/;
     # cargo build
-    return 0 if $cargo and $line =~ m{^\s*Compiling\s+\S+\s+v\S+(?:\s+\(/<<PKGBUILDDIR>>\))?$};
+    return 0 if $cargo and $line =~ m{^\s*Compiling\s+\S+\s+v\S+(?:\s+\(/(?:<<PKGBUILDDIR>>|builds/\S+)\))?$};
     # "Compiling" with no file name.
     if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
         # $file_extension_regex may need spaces around the filename.
@@ -802,6 +815,8 @@ foreach my $file (@ARGV) {
     my $harden_fortify = 1;
     my $harden_stack   = 1;
     my $harden_stack_strong = 1;
+    my $harden_stack_clash = 1;
+    my $harden_branch  = 1;
     my $harden_relro   = 1;
     my $harden_bindnow = $option_bindnow; # defaults to 0
     my $harden_pie     = $option_pie;     # defaults to 0
@@ -856,6 +871,8 @@ foreach my $file (@ARGV) {
 
             my $disable = 1;
             my $disable_strong = 1;
+            my $disable_clash = 1;
+            my $disable_branch = 1;
 
             if ($line =~ /\bdpkg-dev_(\S+)/) {
                 if (Dpkg::Version::version_compare($1, '1.16.1') >= 0) {
@@ -867,6 +884,10 @@ foreach my $file (@ARGV) {
                 if (Dpkg::Version::version_compare($1, '1.18.15') >= 0) {
                     $disable_harden_pie = 1;
                 }
+                if (Dpkg::Version::version_compare($1, '1.22.0') >= 0) {
+                    $disable_clash = 0;
+                    $disable_branch = 0;
+                }
             }
 
             if ($disable) {
@@ -880,6 +901,12 @@ foreach my $file (@ARGV) {
             if ($disable_strong) {
                 $harden_stack_strong = 0;
             }
+            if ($disable_clash) {
+                $harden_stack_clash = 0;
+            }
+            if ($disable_branch) {
+                $harden_branch = 0;
+            }
         }
 
         # The following two versions of CMake in Debian obeyed CPPFLAGS, but
@@ -1153,11 +1180,13 @@ foreach my $file (@ARGV) {
     }
 
     if (scalar @input == 0) {
-        if (not $option_buildd) {
-            print "No compiler commands!\n";
-            $exit |= $exit_code{no_compiler_commands};
-        } else {
-            print "$buildd_tag{no_compiler_commands}||\n";
+        if (not $cargo) {
+            if (not $option_buildd) {
+                print "No compiler commands!\n";
+                $exit |= $exit_code{no_compiler_commands};
+            } else {
+                print "$buildd_tag{no_compiler_commands}||\n";
+            }
         }
         next FILE;
     }
@@ -1167,6 +1196,7 @@ foreach my $file (@ARGV) {
     }
 
     # Option or auto detected.
+    my @harden_branch_flags;
     if ($arch) {
         # The following was partially copied from dpkg-dev 1.22.0
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, set_build_features and
@@ -1195,6 +1225,7 @@ foreach my $file (@ARGV) {
             i386
             kfreebsd-amd64
             kfreebsd-i386
+            loong64
             mips
             mips64
             mips64el
@@ -1217,20 +1248,28 @@ foreach my $file (@ARGV) {
         );
 
         # Disable unsupported hardening options.
-        if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/ or $cpu eq 'hppa') {
+        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
+            $harden_pie = 0;
+        }
+        if ($os !~ /^(?:linux|kfreebsd|hurd)$/
+                or $cpu =~ /^(?:alpha|hppa|ia64)$/) {
             $harden_pie = 0;
         }
         if ($cpu =~ /^(?:ia64|alpha|hppa|nios2)$/ or $arch eq 'arm') {
             $harden_stack = 0;
             $harden_stack_strong = 0;
         }
+        if ($arch !~ /^(?:amd64|arm64|armhf|armel)$/) {
+            $harden_stack_clash = 0;
+        }
         if ($cpu =~ /^(?:ia64|hppa)$/) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
-
-        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
-            $harden_pie = 0;
+        if ($cpu eq 'amd64') {
+            @harden_branch_flags = @def_cflags_branch_amd64;
+        } elsif ($cpu eq 'arm64') {
+            @harden_branch_flags = @def_cflags_branch_arm64;
         }
     }
 
@@ -1252,6 +1291,10 @@ foreach my $file (@ARGV) {
         @cflags   = (@cflags,   @def_cflags_stack);
         @cxxflags = (@cxxflags, @def_cflags_stack);
     }
+    if ($harden_stack_clash) {
+        @cflags   = (@cflags,   @def_cflags_stack_clash);
+        @cxxflags = (@cxxflags, @def_cflags_stack_clash);
+    }
     if ($harden_fortify) {
         @cflags   = (@cflags,   @def_cflags_fortify);
         @cxxflags = (@cxxflags, @def_cflags_fortify);
@@ -1261,6 +1304,10 @@ foreach my $file (@ARGV) {
         @cflags   = (@cflags,   @def_cflags_format);
         @cxxflags = (@cxxflags, @def_cflags_format);
     }
+    if ($harden_branch and @harden_branch_flags) {
+        @cflags   = (@cflags,   @harden_branch_flags);
+        @cxxflags = (@cxxflags, @harden_branch_flags);
+    }
     if ($harden_relro) {
         @ldflags = (@ldflags, @def_ldflags_relro);
     }