Don't report missing PIE flags in buildd mode if GCC defaults to PIE

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index 6afff57ff521485c9c6a4db9437bc826ea26b18d..cfdcbba0fd103770b0b0a068d56fe0c1223083c5 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -750,6 +750,10 @@ foreach my $file (@ARGV) {
     # use a large enough default.
     my $parallel = 10;
 
     # use a large enough default.
     my $parallel = 10;
 

+    # Don't check for PIE flags if automatically applied by the compiler. Only
+    # used in buildd mode.
+    my $disable_harden_pie = 0;
+

     while (my $line = <$fh>) {
         # Detect architecture automatically unless overridden. For buildd logs
         # only, doesn't use the dpkg-buildpackage header. Necessary to ignore
     while (my $line = <$fh>) {
         # Detect architecture automatically unless overridden. For buildd logs
         # only, doesn't use the dpkg-buildpackage header. Necessary to ignore


@@ -772,6 +776,10 @@ foreach my $file (@ARGV) {
         # flags are not checked.
         #
         # Strong stack protector is used since dpkg 1.17.11.
         # flags are not checked.
         #
         # Strong stack protector is used since dpkg 1.17.11.

+        #
+        # Recent GCC versions automatically use PIE (only on supported
+        # architectures) and dpkg respects this properly since 1.18.15 and
+        # doesn't pass PIE flags manually.

         if ($option_buildd
                 and index($line, 'Toolchain package versions: ') == 0) {
             require Dpkg::Version;
         if ($option_buildd
                 and index($line, 'Toolchain package versions: ') == 0) {
             require Dpkg::Version;


@@ -786,6 +794,9 @@ foreach my $file (@ARGV) {
                 if (Dpkg::Version::version_compare($1, '1.17.11') >= 0) {
                     $disable_strong = 0;
                 }
                 if (Dpkg::Version::version_compare($1, '1.17.11') >= 0) {
                     $disable_strong = 0;
                 }

+                if (Dpkg::Version::version_compare($1, '1.18.15') >= 0) {
+                    $disable_harden_pie = 1;
+                }

             }
 
             if ($disable) {
             }
 
             if ($disable) {


@@ -1040,7 +1051,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
 
     # Option or auto detected.
     if ($arch) {

-        # The following was partially copied from dpkg-dev 1.18.15
+        # The following was partially copied from dpkg-dev 1.18.24

         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
         # <kees@debian.org>, Canonical, Ltd. licensed under GPL version 2 or
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
         # <kees@debian.org>, Canonical, Ltd. licensed under GPL version 2 or


@@ -1056,6 +1067,11 @@ foreach my $file (@ARGV) {
             (undef, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
         }
 
             (undef, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
         }
 

+        my %builtin_pie_arch = map { $_ => 1 } qw(
+            amd64 arm64 armel armhf i386 kfreebsd-amd64 kfreebsd-i386
+            mips mipsel mips64el ppc64el s390x sparc sparc64
+        );
+

         # Disable unsupported hardening options.
         if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/
                 or $cpu =~ /^(?:hppa|avr32)$/) {
         # Disable unsupported hardening options.
         if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/
                 or $cpu =~ /^(?:hppa|avr32)$/) {


@@ -1069,6 +1085,10 @@ foreach my $file (@ARGV) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }

+
+        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
+            $harden_pie = 0;
+        }

     }
 
     # Default values.
     }
 
     # Default values.