# Regex to catch compiler commands.
my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
- (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+ (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
(?:-[\d.]+)?/x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
# Regex for source files which require preprocessing.
+my $source_preprocess_compile_cpp_regex = qr/
+ # C++
+ cc | cp | cxx | cpp | CPP | c\+\+ | C
+ # Objective-C++
+ | mm | M
+ /x;
my $source_preprocess_compile_regex = qr/
# C
c
# Objective-C
| m
- # C++
- | cc | cp | cxx | cpp | CPP | c\+\+ | C
- # Objective-C++
- | mm | M
+ # (Objective-)C++
+ | $source_preprocess_compile_cpp_regex
# Fortran
| F | FOR | fpp | FPP | FTN | F90 | F95 | F03 | F08
/x;
| $source_preprocess_no_compile_regex
/x;
# Regex for source files which don't require preprocessing.
+my $source_no_preprocess_compile_cpp_regex = qr/
+ # C++
+ ii
+ # Objective-C++
+ | mii
+ /x;
my $source_no_preprocess_compile_regex = qr/
# C
i
- # C++
- | ii
+ # (Objective-)C++
+ | $source_no_preprocess_compile_cpp_regex
# Objective-C
| mi
- # Objective-C++
- | mii
# Fortran
| f | for | ftn | f90 | f95 | f03 | f08
/x;
\.(?: $source_preprocess_no_compile_regex
| $source_no_preprocess_no_compile_regex)\b
/x;
+my $file_compile_cpp_regex = qr/
+ $cc_regex.+
+ \.(?: $source_preprocess_compile_cpp_regex
+ | $source_no_preprocess_compile_cpp_regex)\b
+ /x;
# Expected (hardening) flags. All flags are used as regexps.
my @cflags = (
my @cflags_pie = (
'-fPIE',
);
+my @cxxflags = (
+ '-g',
+ '-O(?:2|3)',
+);
+# @cxxflags_* is the same as @cflags_*.
my @cppflags = ();
my @cppflags_fortify = (
'-D_FORTIFY_SOURCE=2',
'-Wl,(-z,)?now' => '-Wl,-z,now',
);
+# Use colored (ANSI) output?
+my $option_color;
+
# FUNCTIONS
sub error_color {
my ($message, $color) = @_;
- # Use colors when writing to a terminal.
- if (-t STDOUT) {
+ if ($option_color) {
return Term::ANSIColor::colored($message, $color);
} else {
return $message;
my $option_all = 0;
my $option_arch = undef;
my $option_buildd = 0;
+ $option_color = 0;
if (not Getopt::Long::GetOptions(
'help|h|?' => \$option_help,
'version' => \$option_version,
'bindnow' => \$harden_bindnow,
'all' => \$option_all,
# Misc.
- 'arch' => \$option_arch,
+ 'color' => \$option_color,
+ 'arch=s' => \$option_arch,
'buildd' => \$option_buildd,
)) {
require Pod::Usage;
# Ignore false positives.
#
# `./configure` output.
- next if not $non_verbose and $line =~ /^checking /;
+ next if not $non_verbose
+ and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
(?:C|c)ompiler[\s.]*:?\s+
$cc_regex
or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # Debian buildd output.
- next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
- and $line !~ /\s-./; # option, prevent false negatives
+ # `make` output.
+ next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
# Check the specified hardening options, same order as dpkg-buildflags.
if ($harden_pie) {
@cflags = (@cflags, @cflags_pie);
+ @cxxflags = (@cxxflags, @cflags_pie);
@ldflags = (@ldflags, @ldflags_pie);
}
if ($harden_stack) {
@cflags = (@cflags, @cflags_stack);
+ @cxxflags = (@cxxflags, @cflags_stack);
}
if ($harden_fortify) {
@cflags = (@cflags, @cflags_fortify);
+ @cxxflags = (@cxxflags, @cflags_fortify);
@cppflags = (@cppflags, @cppflags_fortify);
}
if ($harden_format) {
@cflags = (@cflags, @cflags_format);
+ @cxxflags = (@cxxflags, @cflags_format);
}
if ($harden_relro) {
@ldflags = (@ldflags, @ldflags_relro);
}
}
+ # Assume CXXFLAGS are required when a C++ file is specified in the
+ # compiler line.
+ my $compile_cpp = 0;
+ if ($compile and $line =~ /$file_compile_cpp_regex/) {
+ $compile = 0;
+ $compile_cpp = 1;
+ }
+
# Check hardening flags.
my @missing;
if ($compile and not all_flags_used($line, \@missing, @cflags)
# with -fPIE as well. It's no error if only PIE flags are missing.
and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)
# Assume dpkg-buildflags returns the correct flags.
- and not $line =~ /`dpkg-buildflags --get (?:CFLAGS|CXXFLAGS)`/) {
+ and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
error_flags('CFLAGS missing', \@missing, \%flag_renames, $line);
$exit |= 1 << 3;
+ } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
+ # Libraries linked with -fPIC don't have to (and can't) be linked
+ # with -fPIE as well. It's no error if only PIE flags are missing.
+ and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)
+ # Assume dpkg-buildflags returns the correct flags.
+ and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
+ error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $line);
+ $exit |= 1 << 3;
}
if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
# Assume dpkg-buildflags returns the correct flags.
=head1 SYNOPSIS
-B<blhc> [-h -? --help]
+B<blhc> [options] <dpkg-buildpackage build log file>
-B<blhc> [--pie] [--bindnow] [--all]
-
- --help available options
- --version version number and license
- --pie force +pie check
- --bindnow force +bindbow check
--all force +all (+pie, +bindnow) check
--arch set architecture (autodetected)
+ --bindnow force +bindbow check
--buildd parser mode for buildds
+ --color use colored output
+ --pie force +pie check
+ --help available options
+ --version version number and license
=head1 DESCRIPTION
=over 8
-=item B<-h -? --help>
-
-Print available options.
-
-=item B<--version>
-
-Print version number and license.
-
-=item B<--pie>
-
-Force check for all +pie hardening flags. By default it's auto detected.
-
-=item B<--bindnow>
-
-Force check for all +bindnow hardening flags. By default it's auto detected.
-
=item B<--all>
Force check for all +all (+pie, +bindnow) hardening flags. By default it's
disables hardening flags not available on this architecture. Is detected
automatically if dpkg-buildpackage is used.
+=item B<--bindnow>
+
+Force check for all +bindnow hardening flags. By default it's auto detected.
+
=item B<--buildd>
Special mode for buildds when automatically parsing log files. The following
=back
+=item B<--color>
+
+Use colored (ANSI) output for warning messages.
+
+=item B<--pie>
+
+Force check for all +pie hardening flags. By default it's auto detected.
+
+=item B<-h -? --help>
+
+Print available options.
+
+=item B<--version>
+
+Print version number and license.
+
=back
Auto detection for B<--pie> and B<--bindnow> only works if at least one
The exit status is a "bit mask", each listed status is ORed when the error
condition occurs to get the result.
-=over 8
+=over 4
=item B<0>
ruderich.org/simon / blhc / blhc.git / blobdiff