X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=5bbfe73255836fd23bba513edaf9f2af1734ba73;hp=7b196a0ccf93a6d6ea521e5f7650847021852c00;hb=c3edfcb8350482755554fea4bcf45973f02137f8;hpb=5ba101e4f167d461647d9481f83528d5151bafac diff --git a/bin/blhc b/bin/blhc index 7b196a0..5bbfe73 100755 --- a/bin/blhc +++ b/bin/blhc @@ -142,13 +142,13 @@ my %extension = map { $_ => 1 } ( # Regexp to match file extensions. my $file_extension_regex = qr/ \s - \S+ # Filename without extension. + \S+ # Filename without extension. \. - ([^\\.\s]+) # File extension. - (?=\s|\\) # At end of word. Can't use \b because some files have non - # word characters at the end and because \b matches double - # extensions (like .cpp.o). Works always as all lines are - # terminated with "\n". + ([^\\.,;:\s]+) # File extension. + (?=\s|\\) # At end of word. Can't use \b because some files have non + # word characters at the end and because \b matches double + # extensions (like .cpp.o). Works always as all lines are + # terminated with "\n". /x; # Expected (hardening) flags. All flags are used as regexps. @@ -193,6 +193,7 @@ my @def_ldflags_pie = ( my @def_ldflags_pic = ( '-fPIC', '-fpic', + '-shared', ); # Renaming rules for the output so the regex parts are not visible. Also # stores string values of flag regexps above, see compile_flag_regexp(). @@ -202,6 +203,30 @@ my %flag_renames = ( '-Wl,(-z,)?now' => '-Wl,-z,now', ); +my %exit_code = ( + no_compiler_commands => 1 << 0, + # used by POD::Usage => 1 << 1, + non_verbose_build => 1 << 2, + flags_missing => 1 << 3, + hardening_wrapper => 1 << 4, + invalid_cmake => 1 << 5, +); + +# Statistics of missing flags and non-verbose build commands. Used for +# $option_buildd. +my %statistics = ( + preprocess => 0, + preprocess_missing => 0, + compile => 0, + compile_missing => 0, + compile_cpp => 0, + compile_cpp_missing => 0, + link => 0, + link_missing => 0, + commands => 0, + commands_nonverbose => 0, +); + # Use colored (ANSI) output? my $option_color; @@ -229,6 +254,14 @@ sub error_non_verbose_build { error_color(':', 'yellow'), $line; } +sub error_invalid_cmake { + my ($version) = @_; + + printf "%s%s %s\n", + error_color('INVALID CMAKE', 'red'), + error_color(':', 'yellow'), + $version; +} sub error_hardening_wrapper { printf "%s%s %s\n", error_color('HARDENING WRAPPER', 'red'), @@ -296,13 +329,16 @@ sub is_non_verbose_build { my ($line, $next_line, $skip_ref) = @_; if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/ - or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/ + or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/ or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/ or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/ or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) { return 0; } + # False positives. + return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/; + my $file = $1; # On the first pass we only check if this line is verbose or not. @@ -317,7 +353,7 @@ sub is_non_verbose_build { if (defined $file) { # Get filename, we can't use the complete path as only parts of it are # used in the real compiler command. - $file =~ m{/([a-zA-Z0-9._-]+)$}; + $file =~ m{/([^/\s]+)$}; $file = $1; if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/o) { @@ -467,11 +503,32 @@ FILE: foreach my $file (@ARGV) { } } + # The following two versions of CMake in Debian obeyed CPPFLAGS, but + # this was later dropped because upstream rejected the patch. Thus + # build logs with these versions will have fortify hardening flags + # enabled, even though they may be not correctly set and are missing + # when build with later CMake versions. Thanks to Aron Xu for letting + # me know. + if ($line =~ /^Package versions: / + and $line =~ /\bcmake_(\S+)/ + and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { + if (not $option_buildd) { + error_invalid_cmake($1); + } else { + print "W-invalid-cmake-used $1\n"; + } + $exit |= $exit_code{invalid_cmake}; + } + # If hardening wrapper is used (wraps calls to gcc and adds hardening # flags automatically) we can't perform any checks, abort. if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { - error_hardening_wrapper(); - $exit |= 1 << 4; + if (not $option_buildd) { + error_hardening_wrapper(); + } else { + print "I-hardening-wrapper-used\n"; + } + $exit |= $exit_code{hardening_wrapper}; next FILE; } @@ -552,23 +609,24 @@ FILE: foreach my $file (@ARGV) { } # Ignore lines with no compiler commands. - next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose; + next if not $non_verbose + and not $line =~ /\b$cc_regex(?:\s|\\)/o; + # Ignore lines with no filenames with extensions. May miss + # some non-verbose builds (e.g. "gcc -o test" [sic!]), but + # shouldn't be a problem as the log will most likely contain + # other non-verbose commands which are detected. + next if not $non_verbose + and not $line =~ /$file_extension_regex/o; # Ignore false positives. # # `./configure` output. next if not $non_verbose and $line =~ /^(?:checking|(?:C|c)onfigure:) /; - next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)? + next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)? (?:C|c)ompiler[\s.]*:?\s+ - $cc_regex_full - (?:\s-std=[a-z0-9:+]+)?\s*$ - /xo - or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o - or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / - or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; - # `make` output. - next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++" + /xo; + next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; # Check if additional hardening options were used. Used to # ensure they are used for the complete build. @@ -583,11 +641,19 @@ FILE: foreach my $file (@ARGV) { close $fh; if (scalar @input == 0) { - print "No compiler commands!\n"; - $exit |= 1; + if (not $option_buildd) { + print "No compiler commands!\n"; + } else { + print "W-no-compiler-commands\n"; + } + $exit |= $exit_code{no_compiler_commands}; next FILE; } + if ($option_buildd) { + $statistics{commands} += scalar @input; + } + # Option or auto detected. if ($option_arch) { # The following was partially copied from dpkg-dev 1.16.1.2 @@ -645,8 +711,12 @@ FILE: foreach my $file (@ARGV) { my $skip = 0; if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { - error_non_verbose_build($line); - $exit |= 1 << 2; + if (not $option_buildd) { + error_non_verbose_build($line); + } else { + $statistics{commands_nonverbose}++; + } + $exit |= $exit_code{non_verbose_build}; next; } # Even if it's a verbose build, we might have to skip this line. @@ -655,6 +725,9 @@ FILE: foreach my $file (@ARGV) { # Remove everything until and including the compiler command. Makes # checks easier and faster. $line =~ s/^.*?$cc_regex//o; + # "([...] test.c)" is not detected as 'test.c' - fix this by removing + # the brace and similar characters. + $line =~ s/['")]+$//; # Skip unnecessary tests when only preprocessing. my $flag_preprocess = 0; @@ -711,6 +784,13 @@ FILE: foreach my $file (@ARGV) { $compile_cpp = 1; } + if ($option_buildd) { + $statistics{preprocess}++ if $preprocess; + $statistics{compile}++ if $compile; + $statistics{compile_cpp}++ if $compile_cpp; + $statistics{link}++ if $link; + } + # Check hardening flags. my @missing; if ($compile and not all_flags_used($line, \@missing, @cflags) @@ -720,8 +800,12 @@ FILE: foreach my $file (@ARGV) { and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { - error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; + if (not $option_buildd) { + error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{compile_missing}++; + } + $exit |= $exit_code{flags_missing}; } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be # linked with -fPIE as well. It's no error if only PIE flags @@ -729,26 +813,75 @@ FILE: foreach my $file (@ARGV) { and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { - error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; + if (not $option_buildd) { + error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{compile_cpp_missing}++; + } + $exit |= $exit_code{flags_missing}; } if ($preprocess and not all_flags_used($line, \@missing, @cppflags) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { - error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; + if (not $option_buildd) { + error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{preprocess_missing}++; + } + $exit |= $exit_code{flags_missing}; } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { - error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); - $exit |= 1 << 3; + if (not $option_buildd) { + error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + } else { + $statistics{link_missing}++; + } + $exit |= $exit_code{flags_missing}; } } } +# Print statistics for buildd mode, only output in this mode. +if ($option_buildd) { + my @warning; + + if ($statistics{preprocess_missing}) { + push @warning, sprintf "CPPFLAGS %d (of %d)", + $statistics{preprocess_missing}, + $statistics{preprocess}; + } + if ($statistics{compile_missing}) { + push @warning, sprintf "CFLAGS %d (of %d)", + $statistics{compile_missing}, + $statistics{compile}; + } + if ($statistics{compile_cpp_missing}) { + push @warning, sprintf "CXXFLAGS %d (of %d)", + $statistics{compile_cpp_missing}, + $statistics{compile_cpp}; + } + if ($statistics{link_missing}) { + push @warning, sprintf "LDFLAGS %d (of %d)", + $statistics{link_missing}, + $statistics{link}; + } + if (scalar @warning) { + local $" = ', '; # array join string + print "W-dpkg-buildflags-missing @warning missing\n"; + } + + if ($statistics{commands_nonverbose}) { + printf "W-compiler-flags-hidden %d (of %d) hidden\n", + $statistics{commands_nonverbose}, + $statistics{commands}, + } +} + + exit $exit; @@ -760,16 +893,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags =head1 SYNOPSIS -B [options] .. - - --all force +all (+pie, +bindnow) check - --arch set architecture (autodetected) - --bindnow force +bindbow check - --buildd parser mode for buildds - --color use colored output - --pie force +pie check - --help available options - --version version number and license +B [I] Idpkg-buildpackage build log fileE..> =head1 DESCRIPTION @@ -785,7 +909,7 @@ other important warnings. It's licensed under the GPL 3 or later. Force check for all +all (+pie, +bindnow) hardening flags. By default it's auto detected. -=item B<--arch> +=item B<--arch> I Set the specific architecture (e.g. amd64, armel, etc.), automatically disables hardening flags not available on this architecture. Is detected