X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=704d323694031709909d15becefea70ab006ffee;hp=666a151d847a6567687bcbd3d5394f97d754706a;hb=ae5da64f4f6f53ca3eb055d2124988847b2e8d50;hpb=d8241af33b38ea15eee60caebba0f931c80061be diff --git a/bin/blhc b/bin/blhc index 666a151..704d323 100755 --- a/bin/blhc +++ b/bin/blhc @@ -24,7 +24,7 @@ use warnings; use Getopt::Long (); use Text::ParseWords (); -our $VERSION = '0.02'; +our $VERSION = '0.03'; # CONSTANTS/VARIABLES @@ -102,6 +102,17 @@ my @header_preprocess = ( # C++ qw( hh H hp hxx hpp HPP h++ tcc ), ); +# Object files. +my @object = ( + # Normal object files. + qw ( o ), + # Libtool object files. + qw ( lo la ), + # Dynamic libraries. bzip2 uses .sho. + qw ( so sho ), + # Static libraries. + qw ( a ), +); # Hashes for fast extensions lookup to check if a file falls in one of these # categories. @@ -128,10 +139,14 @@ my %extensions_compile_cpp = map { $_ => 1 } ( @source_preprocess_compile_cpp, @source_no_preprocess_compile_cpp, ); +my %extensions_object = map { $_ => 1 } ( + @object, +); my %extension = map { $_ => 1 } ( @source_no_preprocess, @header_preprocess, @source_preprocess, + @object, ); # Regexp to match file extensions. @@ -601,6 +616,8 @@ FILE: foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; + -f $file or die "No such file: $file"; + open my $fh, '<', $file or die $!; # Architecture of this file. @@ -655,10 +672,10 @@ foreach my $file (@ARGV) { and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { if (not $option_buildd) { error_invalid_cmake($1); + $exit |= $exit_code{invalid_cmake}; } else { - print "$buildd_tag{invalid_cmake} $1\n"; + print "$buildd_tag{invalid_cmake}|$1|\n"; } - $exit |= $exit_code{invalid_cmake}; } # If hardening wrapper is used (wraps calls to gcc and adds hardening @@ -667,10 +684,10 @@ foreach my $file (@ARGV) { and $line =~ /\bhardening-wrapper\b/) { if (not $option_buildd) { error_hardening_wrapper(); + $exit |= $exit_code{hardening_wrapper}; } else { - print "$buildd_tag{hardening_wrapper}\n"; + print "$buildd_tag{hardening_wrapper}||\n"; } - $exit |= $exit_code{hardening_wrapper}; next FILE; } @@ -801,10 +818,10 @@ foreach my $file (@ARGV) { if (scalar @input == 0) { if (not $option_buildd) { print "No compiler commands!\n"; + $exit |= $exit_code{no_compiler_commands}; } else { - print "$buildd_tag{no_compiler_commands}\n"; + print "$buildd_tag{no_compiler_commands}||\n"; } - $exit |= $exit_code{no_compiler_commands}; next FILE; } @@ -899,10 +916,10 @@ LINE: if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { if (not $option_buildd) { error_non_verbose_build($line); + $exit |= $exit_code{non_verbose_build}; } else { $statistics{commands_nonverbose}++; } - $exit |= $exit_code{non_verbose_build}; next; } # Even if it's a verbose build, we might have to skip this line. @@ -961,11 +978,11 @@ LINE: $preprocess = 1; } + if (not $flag_preprocess) { # If there are source files then it's compiling/linking in one step # and we must check both. We only check for source files here, because # header files cause too many false positives. - if (not $flag_preprocess - and extension_found(\%extensions_compile_link, @extensions)) { + if (extension_found(\%extensions_compile_link, @extensions)) { # Assembly files don't need CFLAGS. if (not extension_found(\%extensions_compile, @extensions) and extension_found(\%extensions_no_compile, @extensions)) { @@ -974,6 +991,17 @@ LINE: } else { $compile = 1; } + # No compilable extensions found, either linking or compiling + # header flags. + # + # If there are also no object files we are just compiling headers + # (.h -> .h.gch). Don't check for linker flags in this case. Due + # to our liberal checks for compiler lines, this also reduces the + # number of false positives considerably. + } elsif ($link + and not extension_found(\%extensions_object, @extensions)) { + $link = 0; + } } # Assume CXXFLAGS are required when a C++ file is specified in the @@ -1003,10 +1031,10 @@ LINE: and index($line, '`dpkg-buildflags --get CFLAGS`') == -1) { if (not $option_buildd) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_missing}++; } - $exit |= $exit_code{flags_missing}; } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be # linked with -fPIE as well. It's no error if only PIE flags @@ -1016,10 +1044,10 @@ LINE: and index($line, '`dpkg-buildflags --get CXXFLAGS`') == -1) { if (not $option_buildd) { error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_cpp_missing}++; } - $exit |= $exit_code{flags_missing}; } if ($preprocess and (not all_flags_used($line, \@missing, @cppflags) @@ -1030,10 +1058,10 @@ LINE: and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) { if (not $option_buildd) { error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{preprocess_missing}++; } - $exit |= $exit_code{flags_missing}; } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. @@ -1042,10 +1070,10 @@ LINE: and index($line, '`dpkg-buildflags --get LDFLAGS`') == -1) { if (not $option_buildd) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{link_missing}++; } - $exit |= $exit_code{flags_missing}; } } } @@ -1076,11 +1104,11 @@ if ($option_buildd) { } if (scalar @warning) { local $" = ', '; # array join string - print "$buildd_tag{flags_missing} @warning missing\n"; + print "$buildd_tag{flags_missing}|@warning missing|\n"; } if ($statistics{commands_nonverbose}) { - printf "$buildd_tag{non_verbose_build} %d (of %d) hidden\n", + printf "$buildd_tag{non_verbose_build}|%d (of %d) hidden|\n", $statistics{commands_nonverbose}, $statistics{commands}, } @@ -1109,6 +1137,9 @@ It's designed to check build logs generated by Debian's dpkg-buildpackage (or tools using dpkg-buildpackage like pbuilder or the official buildd build logs) to help maintainers detect missing hardening flags in their packages. +Only gcc is detected as compiler at the moment. If other compilers support +hardening flags as well, please report them. + If there's no output, no flags are missing and the build log is fine. =head1 OPTIONS @@ -1151,6 +1182,10 @@ detected). Don't require Term::ANSIColor. +=item * + +Return exit code 0, unless there was a error. + =back =item B<--color>