Sync architecture specific hardening support with dpkg 1.19.5

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index d56a6c079eb9cd641961f87f13efc609dee4b29f..d9a3bb252b330db2ba43a90a883670b8de4e4581 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.08';
+our $VERSION = '0.09';
 
 
 # CONSTANTS/VARIABLES
@@ -222,11 +222,17 @@ my @def_cflags_fortify = (
     # fortify needs at least -O1, but -O2 is recommended anyway
 );
 my @def_cflags_stack = (
-    '-fstack-protector',
+    '-fstack-protector', # keep first, used by cflags_stack_broken()
     '--param[= ]ssp-buffer-size=4',
 );
 my @def_cflags_stack_strong = (
-    '-fstack-protector-strong',
+    '-fstack-protector-strong', # keep first, used by cflags_stack_broken()
+);
+my @def_cflags_stack_bad = (
+    # Blacklist all stack protector options for simplicity.
+    '-fno-stack-protector',
+    '-fno-stack-protector-all',
+    '-fno-stack-protector-strong',
 );
 my @def_cflags_pie = (
     '-fPIE',
@@ -270,6 +276,7 @@ my @flag_refs = (
     \@def_cflags_fortify,
     \@def_cflags_stack,
     \@def_cflags_stack_strong,
+    \@def_cflags_stack_bad,
     \@def_cflags_pie,
     \@def_cxxflags,
     \@def_cppflags,
@@ -471,6 +478,19 @@ sub cppflags_fortify_broken {
     return 1;
 }
 
+sub cflags_stack_broken {
+    my ($line, $missing_flags, $strong) = @_;
+
+    my $flag = $strong ? $def_cflags_stack_strong[0]
+                       : $def_cflags_stack[0];
+
+    if (not flag_overwritten($line, $flag, \@def_cflags_stack_bad)) {
+        return 0;
+    }
+    push @{$missing_flags}, $flag;
+    return 1;
+}
+
 # Modifies $missing_flags_ref array.
 sub pic_pie_conflict {
     my ($line, $pie, $missing_flags_ref, @flags_pie) = @_;
@@ -1053,7 +1073,9 @@ foreach my $file (@ARGV) {
             # treated as a normal compiler line.
             next if $line =~ m{^\s*rm\s+};
             # Some build systems emit "gcc > file".
-            next if $line =~ m{$cc_regex_normal\s*>\s*\S+};
+            next if $line =~ m{$cc_regex_normal\s*>\s*\S+}o;
+            # Hex output may contain "cc".
+            next if $line =~ m#(?:\b[0-9a-fA-F]{2,}\b\s*){5}#;
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -1095,7 +1117,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.19.0.5
+        # The following was partially copied from dpkg-dev 1.19.5
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_build_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Guillem Jover
         # <guillem@debian.org>, Kees Cook <kees@debian.org>, Canonical, Ltd.
@@ -1112,8 +1134,24 @@ foreach my $file (@ARGV) {
         }
 
         my %builtin_pie_arch = map { $_ => 1 } qw(
-            amd64 arm64 armel armhf hurd-i386 i386 kfreebsd-amd64 kfreebsd-i386
-            mips mipsel mips64el powerpc ppc64 ppc64el s390x sparc sparc64
+            amd64
+            arm64
+            armel
+            armhf
+            hurd-i386
+            i386
+            kfreebsd-amd64
+            kfreebsd-i386
+            mips
+            mipsel
+            mips64el
+            powerpc
+            ppc64
+            ppc64el
+            riscv64
+            s390x
+            sparc
+            sparc64
         );
 
         # Disable unsupported hardening options.
@@ -1356,7 +1394,10 @@ LINE:
 
         # Check hardening flags.
         my @missing;
-        if ($compile and not all_flags_used($line, \@missing, @cflags)
+        if ($compile and (not all_flags_used($line, \@missing, @cflags)
+                    or (($harden_stack or $harden_stack_strong)
+                        and cflags_stack_broken($line, \@missing,
+                                                $harden_stack_strong)))
                 # Libraries linked with -fPIC don't have to (and can't) be
                 # linked with -fPIE as well. It's no error if only PIE flags
                 # are missing.