X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=5e8e0181356613dca5de8afe591ce3ab24a5d684;hp=44a698683dc20a65462927a880ec83b1f714cb9c;hb=f0ae7b1580cd26bcf44dc5b780f1c2e081314479;hpb=060422c95a34e2a42161f42fc71c925a8c8d0570 diff --git a/bin/blhc b/bin/blhc index 44a6986..5e8e018 100755 --- a/bin/blhc +++ b/bin/blhc @@ -31,8 +31,10 @@ our $VERSION = '0.01'; # Regex to catch compiler commands. my $cc_regex = qr/ - (? \$option_help, - 'version' => \$option_version, + 'help|h|?' => \$option_help, + 'version' => \$option_version, # Hardening options. - 'pie' => \$option_pie, - 'bindnow' => \$option_bindnow, - 'all' => \$option_all, + 'pie' => \$option_pie, + 'bindnow' => \$option_bindnow, + 'all' => \$option_all, + # Ignore. + 'ignore-arch=s' => \@option_ignore_arch, + 'ignore-flag=s' => \@option_ignore_flag, + 'ignore-line=s' => \@option_ignore_line, # Misc. - 'color' => \$option_color, - 'arch=s' => \$option_arch, - 'buildd' => \$option_buildd, + 'color' => \$option_color, + 'arch=s' => \$option_arch, + 'buildd' => \$option_buildd, ) or scalar @ARGV == 0) { require Pod::Usage; @@ -480,16 +489,36 @@ if ($option_all) { $option_bindnow = 1; } +# Strip flags which should be ignored. +if (scalar @option_ignore_flag > 0) { + my %ignores = map { $_ => 1 } @option_ignore_flag; + foreach my $flags (@flag_refs) { + @{$flags} = grep { + # Flag found as string. + not exists $ignores{$_} + # Flag found as string representation of regexp. + and (not defined $flag_renames{$_} + or not exists $ignores{$flag_renames{$_}}) + } @{$flags}; + } +} + # Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot # faster with this. foreach my $flags (@flag_refs_all) { @{$flags} = compile_flag_regexp(\%flag_renames, @{$flags}); } +# Precompile ignore line regexps, also anchor at beginning and end of line. +foreach my $ignore (@option_ignore_line) { + $ignore = qr/^$ignore$/; +} + # Final exit code. my $exit = 0; -FILE: foreach my $file (@ARGV) { +FILE: +foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; open my $fh, '<', $file or die "$!: $file"; @@ -506,15 +535,25 @@ FILE: foreach my $file (@ARGV) { my $harden_pie = $option_pie; # defaults to 0 while (my $line = <$fh>) { + # Detect architecture automatically unless overridden. For buildd logs + # only, doesn't use the dpkg-buildpackage header. Necessary to ignore + # build logs which aren't built (wrong architecture, build error, + # etc.). + if (not $arch + and $line =~ /^Architecture: (.+)$/) { + $arch = $1; + } + # dpkg-buildflags only provides hardening flags since 1.16.1, don't # check for hardening flags in buildd mode if an older dpkg-dev is # used. Default flags (-g -O2) are still checked. # # Packages which were built before 1.16.1 but used their own hardening # flags are not checked. - if ($option_buildd and $line =~ /^Toolchain package versions: /) { + if ($option_buildd + and index($line, 'Toolchain package versions: ') == 0) { require Dpkg::Version; - if ($line !~ /\bdpkg-dev_(\S+)/ + if (not $line =~ /\bdpkg-dev_(\S+)/ or Dpkg::Version::version_compare($1, '1.16.1') < 0) { $harden_format = 0; $harden_fortify = 0; @@ -531,7 +570,7 @@ FILE: foreach my $file (@ARGV) { # enabled, even though they may be not correctly set and are missing # when build with later CMake versions. Thanks to Aron Xu for letting # me know. - if ($line =~ /^Package versions: / + if (index($line, 'Package versions: ') == 0 and $line =~ /\bcmake_(\S+)/ and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { if (not $option_buildd) { @@ -544,7 +583,8 @@ FILE: foreach my $file (@ARGV) { # If hardening wrapper is used (wraps calls to gcc and adds hardening # flags automatically) we can't perform any checks, abort. - if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { + if (index($line, 'Build-Depends: ') == 0 + and $line =~ /\bhardening-wrapper\b/) { if (not $option_buildd) { error_hardening_wrapper(); } else { @@ -556,7 +596,7 @@ FILE: foreach my $file (@ARGV) { # We skip over unimportant lines at the beginning of the log to # prevent false positives. - last if $line =~ /^dpkg-buildpackage:/; + last if index($line, 'dpkg-buildpackage: ') == 0; } # Input lines, contain only the lines with compiler commands. @@ -579,7 +619,7 @@ FILE: foreach my $file (@ARGV) { # Ignore compiler warnings for now. next if $line =~ /$warning_regex/o; - if (not $option_buildd and $line =~ /\033/) { # esc + if (not $option_buildd and index($line, "\033") != -1) { # esc # Remove all ANSI color sequences which are sometimes used in # non-verbose builds. $line = Term::ANSIColor::colorstrip($line); @@ -596,7 +636,7 @@ FILE: foreach my $file (@ARGV) { # One line may contain multiple commands (";"). Treat each one as # single line. parse_line() is slow, only use it when necessary. - my @line = (not $line =~ /;/) + my @line = (index($line, ';') == -1) ? ($line) : map { # Ensure newline at the line end - necessary for @@ -614,7 +654,7 @@ FILE: foreach my $file (@ARGV) { $complete_line .= ' ' . $line; } # Line continuation, line ends with "\". - if ($line =~ /\\\s*$/) { + if ($line =~ /\\$/) { $continuation = 1; # Start line continuation. if (not defined $complete_line) { @@ -623,45 +663,53 @@ FILE: foreach my $file (@ARGV) { next; } - if (not $continuation) { - # Use the complete line if a line continuation occurred. - if (defined $complete_line) { - $line = $complete_line; - $complete_line = undef; - } - - # Ignore lines with no compiler commands. - next if not $non_verbose - and not $line =~ /\b$cc_regex(?:\s|\\)/o; - # Ignore lines with no filenames with extensions. May miss - # some non-verbose builds (e.g. "gcc -o test" [sic!]), but - # shouldn't be a problem as the log will most likely contain - # other non-verbose commands which are detected. - next if not $non_verbose - and not $line =~ /$file_extension_regex/o; - - # Ignore false positives. - # - # `./configure` output. - next if not $non_verbose - and $line =~ /^(?:checking|(?:C|c)onfigure:) /; - next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)? - (?:C|c)ompiler[\s.]*:?\s+ - /xo; - next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; - - # Check if additional hardening options were used. Used to - # ensure they are used for the complete build. - $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); - $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); - - push @input, $line; + # Use the complete line if a line continuation occurred. + if (defined $complete_line) { + $line = $complete_line; + $complete_line = undef; } + + # Ignore lines with no compiler commands. + next if not $non_verbose + and not $line =~ /\b$cc_regex(?:\s|\\)/o; + # Ignore lines with no filenames with extensions. May miss some + # non-verbose builds (e.g. "gcc -o test" [sic!]), but shouldn't be + # a problem as the log will most likely contain other non-verbose + # commands which are detected. + next if not $non_verbose + and not $line =~ /$file_extension_regex/o; + + # Ignore false positives. + # + # `./configure` output. + next if not $non_verbose + and $line =~ /^(?:checking|(?:C|c)onfigure:) /; + next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)? + (?:C|c)ompiler[\s.]*:?\s+ + /xo; + next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; + + # Check if additional hardening options were used. Used to ensure + # they are used for the complete build. + $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); + $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); + + push @input, $line; } } close $fh; + # Ignore arch if requested. + if (scalar @option_ignore_arch > 0 and $arch) { + foreach my $ignore (@option_ignore_arch) { + if ($arch eq $ignore) { + print "ignoring architecture '$arch'\n"; + next FILE; + } + } + } + if (scalar @input == 0) { if (not $option_buildd) { print "No compiler commands!\n"; @@ -688,10 +736,10 @@ FILE: foreach my $file (@ARGV) { my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch); # Disable unsupported hardening options. - if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') { + if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') { $harden_stack = 0; } - if ($cpu =~ /^(ia64|hppa|avr32)$/) { + if ($cpu =~ /^(?:ia64|hppa|avr32)$/) { $harden_relro = 0; $harden_bindnow = 0; } @@ -728,9 +776,15 @@ FILE: foreach my $file (@ARGV) { @ldflags = (@ldflags, @def_ldflags_bindnow); } +LINE: for (my $i = 0; $i < scalar @input; $i++) { my $line = $input[$i]; + # Ignore line if requested. + foreach my $ignore (@option_ignore_line) { + next LINE if $line =~ /$ignore/; + } + my $skip = 0; if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { if (not $option_buildd) { @@ -836,7 +890,7 @@ FILE: foreach my $file (@ARGV) { # are missing. and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { + and index($line, '`dpkg-buildflags --get CFLAGS`') == -1) { if (not $option_buildd) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); } else { @@ -849,7 +903,7 @@ FILE: foreach my $file (@ARGV) { # are missing. and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { + and index($line, '`dpkg-buildflags --get CXXFLAGS`') == -1) { if (not $option_buildd) { error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); } else { @@ -859,7 +913,7 @@ FILE: foreach my $file (@ARGV) { } if ($preprocess and not all_flags_used($line, \@missing, @cppflags) # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get CPPFLAGS`/) { + and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) { if (not $option_buildd) { error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); } else { @@ -871,7 +925,7 @@ FILE: foreach my $file (@ARGV) { # Same here, -fPIC conflicts with -fPIE. and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) # Assume dpkg-buildflags returns the correct flags. - and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { + and index($line, '`dpkg-buildflags --get LDFLAGS`') == -1) { if (not $option_buildd) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); } else { @@ -934,8 +988,12 @@ B [I] Idpkg-buildpackage build log fileE..> =head1 DESCRIPTION -blhc is a small tool which checks build logs for missing hardening flags and -other important warnings. It's licensed under the GPL 3 or later. +blhc is a small tool which checks build logs for missing hardening flags. It's +licensed under the GPL 3 or later. + +It's designed to check build logs generated by Debian's dpkg-buildpackage (or +tools using dpkg-buildpackage like pbuilder or the official buildd build logs) +to help maintainers detect missing hardening flags in their packages. =head1 OPTIONS @@ -965,8 +1023,8 @@ changes are in effect: =item -Print tags instead of normal warnings, see README file for a list of possible -tags. +Print tags instead of normal warnings, see L for a list of +possible tags. =item @@ -983,6 +1041,29 @@ Don't require Term::ANSIColor. Use colored (ANSI) output for warning messages. +=item B<--ignore-arch> I + +Ignore build logs from architectures matching I. I is a string. + +Used to prevent false positives. This option can be specified multiple times. + +=item B<--ignore-flag> I + +Don't print an error when the specific flag is missing in a compiler line. +I is a string. + +Used to prevent false positives. This option can be specified multiple times. + +=item B<--ignore-line> I + +Ignore lines matching the given Perl regex. I is automatically anchored +at the beginning and end of the line to prevent false negatives. + +B: Not the input lines are checked, but the lines which are displayed in +warnings (which have line continuation resolved). + +Used to prevent false positives. This option can be specified multiple times. + =item B<--pie> Force check for all +pie hardening flags. By default it's auto detected. @@ -1001,6 +1082,84 @@ Auto detection for B<--pie> and B<--bindnow> only works if at least one command uses the required hardening flag (e.g. -fPIE). Then it's required for all other commands as well. +=head1 EXAMPLES + +Normal usage, parse a single log file. + + blhc path/to/log/file + +Parse multiple log files. The exit code is ORed over all files. + + blhc path/to/directory/with/log/files/* + +Don't treat missing C<-g> as error: + + blhc --ignore-flag -g path/to/log/file + +Ignore lines consisting exactly of C<./script gcc file> which would cause a +false positive. + + blhc --ignore-line '\./script gcc file' path/to/log/file + +Ignore lines matching C<./script gcc file> somewhere in the line. + + blhc --ignore-line '.*\./script gcc file.*' path/to/log/file + +Use blhc with pbuilder. + + pbuilder path/to/package.dsc | tee path/log/file + blhc path/to/file || echo flags missing + +=head1 BUILDD TAGS + +The following tags are used in I<--buildd> mode. In braces the additional data +which is displayed. + +=over 2 + +=item + +B + +The package uses hardening-wrapper which intercepts calls to gcc and adds +hardening flags. The build log doesn't contain any hardening flags and thus +can't be checked by blhc. + +=item + +B (summary of hidden lines) + +Build log contains lines which hide the real compiler flags. For example: + + CC test-a.c + CC test-b.c + CC test-c.c + LD test + +Most of the time either C or C in +F fixes builds with hidden compiler flags. Sometimes C<.SILENT> +in a F must be removed. And as last resort the F must be +patched to remove the C<@>s hiding the real compiler commands. + +=item + +B (summary of missing flags) + +CPPFLAGS, CFLAGS, CXXFLAGS, LDFLAGS missing. + +=item + +B (version) + +=item + +B + +No compiler commands were detected. Either the log contains none or they were +not correctly detected by blhc (please report the bug in this case). + +=back + =head1 EXIT STATUS The exit status is a "bit mask", each listed status is ORed when the error @@ -1038,6 +1197,9 @@ Hardening wrapper detected, no tests performed. Simon Ruderich, Esimon@ruderich.orgE +Thanks to to Bernhard R. Link Ebrlink@debian.orgE and Jaria Alto +Ejari.aalto@cante.netE for their valuable input and suggestions. + =head1 COPYRIGHT AND LICENSE Copyright (C) 2012 by Simon Ruderich @@ -1055,4 +1217,8 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . +=head1 SEE ALSO + +L, L + =cut