X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=704d323694031709909d15becefea70ab006ffee;hp=79b72f51bc5941b096e0531e82890bb32abe6292;hb=ae5da64f4f6f53ca3eb055d2124988847b2e8d50;hpb=c09596c03ff34112d98185d94016c098a5876f09 diff --git a/bin/blhc b/bin/blhc index 79b72f5..704d323 100755 --- a/bin/blhc +++ b/bin/blhc @@ -24,7 +24,7 @@ use warnings; use Getopt::Long (); use Text::ParseWords (); -our $VERSION = '0.02'; +our $VERSION = '0.03'; # CONSTANTS/VARIABLES @@ -102,6 +102,17 @@ my @header_preprocess = ( # C++ qw( hh H hp hxx hpp HPP h++ tcc ), ); +# Object files. +my @object = ( + # Normal object files. + qw ( o ), + # Libtool object files. + qw ( lo la ), + # Dynamic libraries. bzip2 uses .sho. + qw ( so sho ), + # Static libraries. + qw ( a ), +); # Hashes for fast extensions lookup to check if a file falls in one of these # categories. @@ -128,10 +139,14 @@ my %extensions_compile_cpp = map { $_ => 1 } ( @source_preprocess_compile_cpp, @source_no_preprocess_compile_cpp, ); +my %extensions_object = map { $_ => 1 } ( + @object, +); my %extension = map { $_ => 1 } ( @source_no_preprocess, @header_preprocess, @source_preprocess, + @object, ); # Regexp to match file extensions. @@ -171,7 +186,14 @@ my @def_cxxflags = ( # @def_cxxflags_* is the same as @def_cflags_*. my @def_cppflags = (); my @def_cppflags_fortify = ( - '-D_FORTIFY_SOURCE=2', + '-D_FORTIFY_SOURCE=2', # must be first, see cppflags_fortify_broken() + # If you add another flag fix hack below (search for "Hack to fix"). +); +my @def_cppflags_fortify_bad = ( + # These flags may overwrite -D_FORTIFY_SOURCE=2. + '-U_FORTIFY_SOURCE', + '-D_FORTIFY_SOURCE=0', + '-D_FORTIFY_SOURCE=1', ); my @def_ldflags = (); my @def_ldflags_relro = ( @@ -189,7 +211,7 @@ my @def_ldflags_pic = ( '-fpic', '-shared', ); -# References to all flags checked by the parser. +# References to all flags checked by the flag checker. my @flag_refs = ( \@def_cflags, \@def_cflags_format, @@ -202,11 +224,12 @@ my @flag_refs = ( \@def_ldflags, \@def_ldflags_relro, \@def_ldflags_bindnow, + \@def_ldflags_pie, ); # References to all used flags. my @flag_refs_all = ( @flag_refs, - \@def_ldflags_pie, + \@def_cppflags_fortify_bad, \@def_ldflags_pic, ); # Renaming rules for the output so the regex parts are not visible. Also @@ -325,6 +348,22 @@ sub all_flags_used { return 0; } +sub cppflags_fortify_broken { + my ($line, $missing_flags) = @_; + + # This doesn't take the position into account, but is a simple solution. + # And if the build system tries to force -D_FORTIFY_SOURCE=0/1, something + # is wrong anyway. + + if (any_flags_used($line, @def_cppflags_fortify_bad)) { + # $def_cppflags_fortify[0] must be -D_FORTIFY_SOURCE=2! + push @{$missing_flags}, $def_cppflags_fortify[0]; + return 1; + } + + return 0; +} + # Modifies $missing_flags_ref array. sub pic_pie_conflict { my ($line, $pie, $missing_flags_ref, @flags_pie) = @_; @@ -396,6 +435,21 @@ sub is_non_verbose_build { return 1; } +sub remove_flags { + my ($flag_refs_ref, $flag_renames_ref, @flags) = @_; + + my %removes = map { $_ => 1 } @flags; + foreach my $flags (@{$flag_refs_ref}) { + @{$flags} = grep { + # Flag found as string. + not exists $removes{$_} + # Flag found as string representation of regexp. + and (not defined $flag_renames_ref->{$_} + or not exists $removes{$flag_renames_ref->{$_}}) + } @{$flags}; + } +} + sub compile_flag_regexp { my ($flag_renames_ref, @flags) = @_; @@ -431,32 +485,36 @@ sub extension_found { # MAIN # Parse command line arguments. -my $option_help = 0; -my $option_version = 0; -my $option_pie = 0; -my $option_bindnow = 0; -my @option_ignore_arch = (); -my @option_ignore_flag = (); -my @option_ignore_line = (); -my $option_all = 0; -my $option_arch = undef; -my $option_buildd = 0; - $option_color = 0; +my $option_help = 0; +my $option_version = 0; +my $option_pie = 0; +my $option_bindnow = 0; +my @option_ignore_arch = (); +my @option_ignore_flag = (); +my @option_ignore_arch_flag = (); +my @option_ignore_line = (); +my @option_ignore_arch_line = (); +my $option_all = 0; +my $option_arch = undef; +my $option_buildd = 0; + $option_color = 0; if (not Getopt::Long::GetOptions( - 'help|h|?' => \$option_help, - 'version' => \$option_version, + 'help|h|?' => \$option_help, + 'version' => \$option_version, # Hardening options. - 'pie' => \$option_pie, - 'bindnow' => \$option_bindnow, - 'all' => \$option_all, + 'pie' => \$option_pie, + 'bindnow' => \$option_bindnow, + 'all' => \$option_all, # Ignore. - 'ignore-arch=s' => \@option_ignore_arch, - 'ignore-flag=s' => \@option_ignore_flag, - 'ignore-line=s' => \@option_ignore_line, + 'ignore-arch=s' => \@option_ignore_arch, + 'ignore-flag=s' => \@option_ignore_flag, + 'ignore-arch-flag=s' => \@option_ignore_arch_flag, + 'ignore-line=s' => \@option_ignore_line, + 'ignore-arch-line=s' => \@option_ignore_arch_line, # Misc. - 'color' => \$option_color, - 'arch=s' => \$option_arch, - 'buildd' => \$option_buildd, + 'color' => \$option_color, + 'arch=s' => \$option_arch, + 'buildd' => \$option_buildd, )) { require Pod::Usage; Pod::Usage::pod2usage(2); @@ -501,17 +559,27 @@ if ($option_all) { $option_bindnow = 1; } +# Precompiled ignores for faster lookup. +my %option_ignore_arch_flag = (); +my %option_ignore_arch_line = (); + # Strip flags which should be ignored. if (scalar @option_ignore_flag > 0) { - my %ignores = map { $_ => 1 } @option_ignore_flag; - foreach my $flags (@flag_refs) { - @{$flags} = grep { - # Flag found as string. - not exists $ignores{$_} - # Flag found as string representation of regexp. - and (not defined $flag_renames{$_} - or not exists $ignores{$flag_renames{$_}}) - } @{$flags}; + remove_flags(\@flag_refs, \%flag_renames, @option_ignore_flag); +} +# Same for arch specific ignore flags, but only prepare here. +if (scalar @option_ignore_arch_flag > 0) { + foreach my $ignore (@option_ignore_arch_flag) { + my ($ignore_arch, $ignore_flag) = split ':', $ignore, 2; + + if (not $ignore_arch or not $ignore_flag) { + printf STDERR 'Value "%s" invalid for option ignore-arch-flag ' + . '("arch:flag" expected)' . "\n", $ignore; + require Pod::Usage; + Pod::Usage::pod2usage(2); + } + + push @{$option_ignore_arch_flag{$ignore_arch}}, $ignore_flag; } } @@ -525,6 +593,21 @@ foreach my $flags (@flag_refs_all) { foreach my $ignore (@option_ignore_line) { $ignore = qr/^$ignore$/; } +# Same for arch specific ignore lines. +if (scalar @option_ignore_arch_line > 0) { + foreach my $ignore (@option_ignore_arch_line) { + my ($ignore_arch, $ignore_line) = split ':', $ignore, 2; + + if (not $ignore_arch or not $ignore_line) { + printf STDERR 'Value "%s" invalid for option ignore-arch-line ' + . '("arch:line" expected)' . "\n", $ignore; + require Pod::Usage; + Pod::Usage::pod2usage(2); + } + + push @{$option_ignore_arch_line{$ignore_arch}}, qr/^$ignore_line$/; + } +} # Final exit code. my $exit = 0; @@ -533,7 +616,9 @@ FILE: foreach my $file (@ARGV) { print "checking '$file'...\n" if scalar @ARGV > 1; - open my $fh, '<', $file or die "$!: $file"; + -f $file or die "No such file: $file"; + + open my $fh, '<', $file or die $!; # Architecture of this file. my $arch = $option_arch; @@ -587,10 +672,10 @@ foreach my $file (@ARGV) { and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { if (not $option_buildd) { error_invalid_cmake($1); + $exit |= $exit_code{invalid_cmake}; } else { - print "$buildd_tag{invalid_cmake} $1\n"; + print "$buildd_tag{invalid_cmake}|$1|\n"; } - $exit |= $exit_code{invalid_cmake}; } # If hardening wrapper is used (wraps calls to gcc and adds hardening @@ -599,10 +684,10 @@ foreach my $file (@ARGV) { and $line =~ /\bhardening-wrapper\b/) { if (not $option_buildd) { error_hardening_wrapper(); + $exit |= $exit_code{hardening_wrapper}; } else { - print "$buildd_tag{hardening_wrapper}\n"; + print "$buildd_tag{hardening_wrapper}||\n"; } - $exit |= $exit_code{hardening_wrapper}; next FILE; } @@ -700,10 +785,18 @@ foreach my $file (@ARGV) { [Cc]ompiler[\s.]*:?\s+ /xo; next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o; + # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or + # similar for other architectures) which gets recognized as a + # compiler line. Ignore it. + next if $line =~ m{^/usr/bin/moc-qt4 + \s.+\s + -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)? + \s}x; # Check if additional hardening options were used. Used to ensure # they are used for the complete build. - $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); + $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, + @def_ldflags_pie); $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); push @input, $line; @@ -725,10 +818,10 @@ foreach my $file (@ARGV) { if (scalar @input == 0) { if (not $option_buildd) { print "No compiler commands!\n"; + $exit |= $exit_code{no_compiler_commands}; } else { - print "$buildd_tag{no_compiler_commands}\n"; + print "$buildd_tag{no_compiler_commands}||\n"; } - $exit |= $exit_code{no_compiler_commands}; next FILE; } @@ -788,12 +881,34 @@ foreach my $file (@ARGV) { @ldflags = (@ldflags, @def_ldflags_bindnow); } + # Hack to fix cppflags_fortify_broken() if --ignore-flag + # -D_FORTIFY_SOURCE=2 is used to ignore missing fortification. Only works + # as long as @def_cppflags_fortify contains only one variable. + if (scalar @def_cppflags_fortify == 0) { + $harden_fortify = 0; + } + + # Ignore flags for this arch if requested. + if ($arch and exists $option_ignore_arch_flag{$arch}) { + my @flag_refs = (\@cflags, \@cxxflags, \@cppflags, \@ldflags); + + remove_flags(\@flag_refs, + \%flag_renames, + @{$option_ignore_arch_flag{$arch}}); + } + + my @ignore_line = @option_ignore_line; + # Ignore lines for this arch if requested. + if ($arch and exists $option_ignore_arch_line{$arch}) { + @ignore_line = (@ignore_line, @{$option_ignore_arch_line{$arch}}); + } + LINE: for (my $i = 0; $i < scalar @input; $i++) { my $line = $input[$i]; # Ignore line if requested. - foreach my $ignore (@option_ignore_line) { + foreach my $ignore (@ignore_line) { next LINE if $line =~ /$ignore/; } @@ -801,10 +916,10 @@ LINE: if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { if (not $option_buildd) { error_non_verbose_build($line); + $exit |= $exit_code{non_verbose_build}; } else { $statistics{commands_nonverbose}++; } - $exit |= $exit_code{non_verbose_build}; next; } # Even if it's a verbose build, we might have to skip this line. @@ -863,11 +978,11 @@ LINE: $preprocess = 1; } + if (not $flag_preprocess) { # If there are source files then it's compiling/linking in one step # and we must check both. We only check for source files here, because # header files cause too many false positives. - if (not $flag_preprocess - and extension_found(\%extensions_compile_link, @extensions)) { + if (extension_found(\%extensions_compile_link, @extensions)) { # Assembly files don't need CFLAGS. if (not extension_found(\%extensions_compile, @extensions) and extension_found(\%extensions_no_compile, @extensions)) { @@ -876,6 +991,17 @@ LINE: } else { $compile = 1; } + # No compilable extensions found, either linking or compiling + # header flags. + # + # If there are also no object files we are just compiling headers + # (.h -> .h.gch). Don't check for linker flags in this case. Due + # to our liberal checks for compiler lines, this also reduces the + # number of false positives considerably. + } elsif ($link + and not extension_found(\%extensions_object, @extensions)) { + $link = 0; + } } # Assume CXXFLAGS are required when a C++ file is specified in the @@ -905,10 +1031,10 @@ LINE: and index($line, '`dpkg-buildflags --get CFLAGS`') == -1) { if (not $option_buildd) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_missing}++; } - $exit |= $exit_code{flags_missing}; } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be # linked with -fPIE as well. It's no error if only PIE flags @@ -918,20 +1044,24 @@ LINE: and index($line, '`dpkg-buildflags --get CXXFLAGS`') == -1) { if (not $option_buildd) { error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{compile_cpp_missing}++; } - $exit |= $exit_code{flags_missing}; } - if ($preprocess and not all_flags_used($line, \@missing, @cppflags) + if ($preprocess + and (not all_flags_used($line, \@missing, @cppflags) + # The fortify flag might be overwritten, detect that. + or ($harden_fortify + and cppflags_fortify_broken($line, \@missing))) # Assume dpkg-buildflags returns the correct flags. and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) { if (not $option_buildd) { error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{preprocess_missing}++; } - $exit |= $exit_code{flags_missing}; } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. @@ -940,10 +1070,10 @@ LINE: and index($line, '`dpkg-buildflags --get LDFLAGS`') == -1) { if (not $option_buildd) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); + $exit |= $exit_code{flags_missing}; } else { $statistics{link_missing}++; } - $exit |= $exit_code{flags_missing}; } } } @@ -974,11 +1104,11 @@ if ($option_buildd) { } if (scalar @warning) { local $" = ', '; # array join string - print "$buildd_tag{flags_missing} @warning missing\n"; + print "$buildd_tag{flags_missing}|@warning missing|\n"; } if ($statistics{commands_nonverbose}) { - printf "$buildd_tag{non_verbose_build} %d (of %d) hidden\n", + printf "$buildd_tag{non_verbose_build}|%d (of %d) hidden|\n", $statistics{commands_nonverbose}, $statistics{commands}, } @@ -996,7 +1126,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags =head1 SYNOPSIS -B [I] Idpkg-buildpackage build log fileE..> +B [I] I<< .. >> =head1 DESCRIPTION @@ -1007,6 +1137,11 @@ It's designed to check build logs generated by Debian's dpkg-buildpackage (or tools using dpkg-buildpackage like pbuilder or the official buildd build logs) to help maintainers detect missing hardening flags in their packages. +Only gcc is detected as compiler at the moment. If other compilers support +hardening flags as well, please report them. + +If there's no output, no flags are missing and the build log is fine. + =head1 OPTIONS =over 8 @@ -1047,6 +1182,10 @@ detected). Don't require Term::ANSIColor. +=item * + +Return exit code 0, unless there was a error. + =back =item B<--color> @@ -1059,6 +1198,14 @@ Ignore build logs from architectures matching I. I is a string. Used to prevent false positives. This option can be specified multiple times. +=item B<--ignore-arch-flag> I:I + +Like B<--ignore-flag>, but only ignore flag on I. + +=item B<--ignore-arch-line> I:I + +Like B<--ignore-line>, but only ignore line on I. + =item B<--ignore-flag> I Don't print an error when the specific flag is missing in a compiler line. @@ -1100,6 +1247,8 @@ Normal usage, parse a single log file. blhc path/to/log/file +If there's no output, no flags are missing and the build log is fine. + Parse multiple log files. The exit code is ORed over all files. blhc path/to/directory/with/log/files/* @@ -1108,6 +1257,10 @@ Don't treat missing C<-g> as error: blhc --ignore-flag -g path/to/log/file +Don't treat missing C<-pie> on kfreebsd-amd64 as error: + + blhc --ignore-arch-flag kfreebsd-amd64:-pie path/to/log/file + Ignore lines consisting exactly of C<./script gcc file> which would cause a false positive. @@ -1200,6 +1353,11 @@ Missing hardening flags. Hardening wrapper detected, no tests performed. +=item B<32> + +Invalid CMake version used. See B under L for a detailed explanation. + =back =head1 AUTHOR