fix false positive with `gcc -v`

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index be3fd3fb41c094d0612d8f2b4ffc2e147f2cc7df..cc4f44bb723a2fc6c2321b08a84ce4c3f23a2cac 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2013  Simon Ruderich
+# Copyright (C) 2012-2015  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.04';
+our $VERSION = '0.05';
 
 
 # CONSTANTS/VARIABLES
@@ -38,8 +38,11 @@ my $cc_regex = qr/
     /x;
 # Full regex which matches the complete compiler name. Used in a few places to
 # prevent false negatives.
+my $cc_regex_full_prefix = qr/
+    [a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?
+    /x;
 my $cc_regex_full = qr/
-    (?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
+    (?:$cc_regex_full_prefix-)?
     $cc_regex
     /x;
 # Regex to check if a line contains a compiler command.
@@ -51,6 +54,7 @@ my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
 # Regex to catch libtool commands and not lines which show commands executed
 # by libtool (e.g. libtool: link: ...).
 my $libtool_regex = qr/\blibtool\s.*--mode=/;
+my $libtool_link_regex = qr/\blibtool: link: /;
 
 # List of source file extensions which require preprocessing.
 my @source_preprocess_compile_cpp = (
@@ -214,7 +218,8 @@ my @def_cxxflags = (
 my @def_cppflags = ();
 my @def_cppflags_fortify = (
     '-D_FORTIFY_SOURCE=2', # must be first, see cppflags_fortify_broken()
-    # If you add another flag fix hack below (search for "Hack to fix").
+    # If you add another flag fix hack below (search for "Hack to fix") and
+    # $def_cppflags_fortify[0].
 );
 my @def_cppflags_fortify_bad = (
     # These flags may overwrite -D_FORTIFY_SOURCE=2.
@@ -600,7 +605,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2013  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2015  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -709,7 +714,7 @@ foreach my $file (@ARGV) {
     my $harden_pie     = $option_pie;     # defaults to 0
 
     # Does this build log use ada? Ada also uses gcc as compiler but uses
-    # different CFLAGS. But only perform ada checks if an ada compiler used
+    # different CFLAGS. But only perform ada checks if an ada compiler is used
     # for performance reasons.
     my $ada = 0;
 
@@ -941,6 +946,12 @@ foreach my $file (@ARGV) {
                 next if     not $before =~ /$cc_regex_normal/o
                         and not $after  =~ /$cc_regex_normal/o;
             }
+            # Ignore false positives caused by gcc -v. It outputs a line
+            # looking like a normal compiler line but which is sometimes
+            # missing hardening flags, although the normal compiler line
+            # contains them.
+            next if $line =~ m{^\s+/usr/lib/gcc/$cc_regex_full_prefix/
+                                   [0-9.]+/cc1(?:plus)?}xo;
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -981,7 +992,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.17.11
+        # The following was partially copied from dpkg-dev 1.18.2
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
         # <kees@debian.org>, Canonical, Ltd. licensed under GPL version 2 or
@@ -991,17 +1002,13 @@ foreach my $file (@ARGV) {
         my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
 
         # Disable unsupported hardening options.
-        if ($os !~ /^(?:linux|knetbsd|hurd)$/ or
-                $cpu =~ /^(?:hppa|mips|mipsel|avr32)$/) {
+        if ($os !~ /^(?:linux|knetbsd|hurd)$/ or $cpu =~ /^(?:hppa|avr32)$/) {
             $harden_pie = 0;
         }
-        if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
+        if ($cpu =~ /^(?:ia64|alpha|hppa)$/ or $arch eq 'arm') {
             $harden_stack = 0;
             $harden_stack_strong = 0;
         }
-        if ($arch =~ /^(?:m68k|or1k|powerpcspe|sh4|x32)$/) {
-            $harden_stack_strong = 0;
-        }
         if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
@@ -1104,6 +1111,8 @@ LINE:
         # is_non_verbose_build()).
         next if $skip;
 
+        my $orig_line = $line;
+
         # Remove everything until and including the compiler command. Makes
         # checks easier and faster.
         $line =~ s/^.*?$cc_regex//o;
@@ -1154,7 +1163,11 @@ LINE:
         }
         # These file types require preprocessing.
         if (extension_found(\%extensions_preprocess, @extensions)) {
-            $preprocess = 1;
+            # Prevent false positives with "libtool: link: g++ -include test.h
+            # .." compiler lines.
+            if ($orig_line !~ /$libtool_link_regex/o) {
+                $preprocess = 1;
+            }
         }
 
         if (not $flag_preprocess) {
@@ -1213,6 +1226,7 @@ LINE:
         # for a debug build.
         if (any_flags_used($line, @def_cflags_debug)) {
             remove_flags([\@cflags], \%flag_renames, $def_cflags[1]);
+            remove_flags([\@cppflags], \%flag_renames, $def_cppflags_fortify[0]);
         }
 
         # Check hardening flags.
@@ -1574,7 +1588,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2013 by Simon Ruderich
+Copyright (C) 2012-2015 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by