X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=3ee85373e188ec7e52e18cce100b5294ebe77d5c;hp=e03ac2889aa039ed04eaad66720dec1ac73fab18;hb=8bb0bc6382d4f8b3f957cd3ab0546e6cbb750beb;hpb=23020a59781f2a07a8d56053972d14c6d3cae2b3
diff --git a/bin/blhc b/bin/blhc
index e03ac28..3ee8537 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
# Build log hardening check, checks build logs for missing hardening flags.
-# Copyright (C) 2012 Simon Ruderich
+# Copyright (C) 2012-2013 Simon Ruderich
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
use Getopt::Long ();
use Text::ParseWords ();
-our $VERSION = '0.03';
+our $VERSION = '0.04';
# CONSTANTS/VARIABLES
@@ -176,13 +176,14 @@ my $file_extension_regex = qr/
# terminated with "\n".
/x;
-# Expected (hardening) flags. All flags are used as regexps.
+# Expected (hardening) flags. All flags are used as regexps (and compiled to
+# real regexps below for better execution speed).
my @def_cflags = (
'-g',
'-O(?:2|3)',
);
my @def_cflags_format = (
- '-Wformat',
+ '-Wformat(?:=2)?', # -Wformat=2 implies -Wformat, accept it too
'-Werror=format-security', # implies -Wformat-security
);
my @def_cflags_fortify = (
@@ -190,7 +191,7 @@ my @def_cflags_fortify = (
);
my @def_cflags_stack = (
'-fstack-protector',
- '--param=ssp-buffer-size=4',
+ '--param[= ]ssp-buffer-size=4',
);
my @def_cflags_pie = (
'-fPIE',
@@ -250,9 +251,11 @@ my @flag_refs_all = (
# Renaming rules for the output so the regex parts are not visible. Also
# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
- '-O(?:2|3)' => '-O2',
- '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
- '-Wl,(?:-z,)?now' => '-Wl,-z,now',
+ '-O(?:2|3)' => '-O2',
+ '-Wformat(?:=2)?' => '-Wformat',
+ '--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
+ '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+ '-Wl,(?:-z,)?now' => '-Wl,-z,now',
);
my %exit_code = (
@@ -319,6 +322,8 @@ sub error_flags {
printf '%s (%s)%s %s',
error_color($message, 'red'), $flags, error_color(':', 'yellow'),
$line;
+
+ return;
}
sub error_non_verbose_build {
my ($line) = @_;
@@ -327,6 +332,8 @@ sub error_non_verbose_build {
error_color('NONVERBOSE BUILD', 'red'),
error_color(':', 'yellow'),
$line;
+
+ return;
}
sub error_invalid_cmake {
my ($version) = @_;
@@ -335,12 +342,16 @@ sub error_invalid_cmake {
error_color('INVALID CMAKE', 'red'),
error_color(':', 'yellow'),
$version;
+
+ return;
}
sub error_hardening_wrapper {
printf "%s%s %s\n",
error_color('HARDENING WRAPPER', 'red'),
error_color(':', 'yellow'),
'no checks possible, aborting';
+
+ return;
}
sub error_color {
my ($message, $color) = @_;
@@ -430,6 +441,7 @@ sub is_non_verbose_build {
#
# C++ compiler setting.
return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+ return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
# "Compiling" with no file name.
if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
# $file_extension_regex may need spaces around the filename.
@@ -464,6 +476,7 @@ sub is_non_verbose_build {
return 1;
}
+# Remove @flags from $flag_refs_ref, and $flag_renames_ref.
sub remove_flags {
my ($flag_refs_ref, $flag_renames_ref, @flags) = @_;
@@ -477,37 +490,41 @@ sub remove_flags {
or not exists $removes{$flag_renames_ref->{$_}})
} @{$flags};
}
+
+ return;
}
+# Modifies $flag_renames_ref hash.
sub compile_flag_regexp {
my ($flag_renames_ref, @flags) = @_;
my @result = ();
foreach my $flag (@flags) {
+ # Compile flag regexp for faster execution.
+ my $regex = qr/\s$flag(?:\s|\\)/;
+
# Store flag name in replacement string for correct flags in messages
# with qr//ed flag regexps.
- $flag_renames_ref->{qr/\s$flag(?:\s|\\)/}
+ $flag_renames_ref->{$regex}
= (exists $flag_renames_ref->{$flag})
? $flag_renames_ref->{$flag}
: $flag;
- # Compile flag regexp for faster execution.
- push @result, qr/\s$flag(?:\s|\\)/;
+ push @result, $regex;
}
return @result;
}
+# Does any extension in @extensions exist in %{$extensions_ref}?
sub extension_found {
my ($extensions_ref, @extensions) = @_;
- my $found = 0;
foreach my $extension (@extensions) {
if (exists $extensions_ref->{$extension}) {
- $found = 1;
- last;
+ return 1;
}
}
- return $found;
+ return 0;
}
@@ -553,7 +570,8 @@ if ($option_help) {
Pod::Usage::pod2usage(1);
}
if ($option_version) {
- print "blhc $VERSION Copyright (C) 2012 Simon Ruderich
+ print <<"EOF";
+blhc $VERSION Copyright (C) 2012-2013 Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -567,7 +585,7 @@ GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
-";
+EOF
exit 0;
}
@@ -711,7 +729,10 @@ foreach my $file (@ARGV) {
}
}
- if (index($line, 'Build-Depends: ') == 0) {
+ # Debian's build daemons use Build-Depends: for the build
+ # dependencies, but pbuilder just uses Depends:; support both.
+ if (index($line, 'Build-Depends: ') == 0
+ or index($line, 'Depends: ') == 0) {
# If hardening wrapper is used (wraps calls to gcc and adds
# hardening flags automatically) we can't perform any checks,
# abort.
@@ -756,6 +777,13 @@ foreach my $file (@ARGV) {
if (not $arch
and index($line, 'dpkg-buildpackage: host architecture ') == 0) {
$arch = substr $line, 37, -1; # -1 to ignore '\n' at the end
+
+ # Old buildd logs use e.g. "host architecture is alpha", remove
+ # the "is", otherwise debarch_to_debtriplet() will not detect the
+ # architecture.
+ if (index($arch, 'is ') == 0) {
+ $arch = substr $arch, 3;
+ }
}
# Ignore compiler warnings for now.
@@ -829,13 +857,20 @@ foreach my $file (@ARGV) {
next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
[Cc]ompiler[\s.]*:?\s+
/x;
- next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
- # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or
- # similar for other architectures) which gets recognized as a
- # compiler line. Ignore it.
- next if $line =~ m{^/usr/bin/moc-qt4
+ next if $line =~ m{^\s*(?:-\s)?(?:HOST_)?(?:CC|CXX)
+ \s*=\s*$cc_regex_full
+ # optional compiler options, don't allow
+ # "everything" here to prevent false negatives
+ \s*(?:\s-\S+)*\s*$}xo;
+ # `moc-qt4`/`moc-qt5` contain '-I.../linux-g++' in their command
+ # line (or similar for other architectures) which gets recognized
+ # as a compiler line, but `moc-qt*` is only a preprocessor for Qt
+ # C++ files. No hardening flags are relevant during this step,
+ # thus ignore `moc-qt*` lines. The resulting files will be
+ # compiled in a separate step (and therefore checked).
+ next if $line =~ m{^\S+/bin/moc(?:-qt[45])?
\s.+\s
- -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
+ -I\S+/mkspecs/[a-z]+-g\++(?:-64)?
\s}x;
# Ignore false positives when the line contains only CC=gcc but no
# other gcc command.
@@ -885,7 +920,7 @@ foreach my $file (@ARGV) {
# Option or auto detected.
if ($arch) {
- # The following was partially copied from dpkg-dev 1.16.4.3
+ # The following was partially copied from dpkg-dev 1.17.1
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaël Hertzog , Kees Cook
# , Canonical, Ltd. licensed under GPL version 2 or
@@ -895,7 +930,12 @@ foreach my $file (@ARGV) {
my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
# Disable unsupported hardening options.
- if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
+ if ($os !~ /^(?:linux|knetbsd|hurd)$/ or
+ $cpu =~ /^(?:hppa|mips|mipsel|avr32)$/) {
+ $harden_pie = 0;
+ }
+ if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa|arm64)$/
+ or $arch eq 'arm') {
$harden_stack = 0;
}
if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
@@ -937,8 +977,8 @@ foreach my $file (@ARGV) {
# Stores normal CFLAGS when @cflags_ada are temporarily used.
my @cflags_backup;
- # Ada CFLAGS.
- my @cflags_ada = @cflags;
+ # Ada CFLAGS, only set if ada is used.
+ my @cflags_ada;
# Ada doesn't support format hardening flags, see #680117 for more
# information. Filter them out if ada is used.
if ($ada and $harden_format) {
@@ -993,7 +1033,8 @@ LINE:
}
next;
}
- # Even if it's a verbose build, we might have to skip this line.
+ # Even if it's a verbose build, we might have to skip this line (see
+ # is_non_verbose_build()).
next if $skip;
# Remove everything until and including the compiler command. Makes
@@ -1455,7 +1496,7 @@ Ejari.aalto@cante.netE for their valuable input and suggestions.
=head1 LICENSE AND COPYRIGHT
-Copyright (C) 2012 by Simon Ruderich
+Copyright (C) 2012-2013 by Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by