X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=72a2c4294ec2d6c04b1e54ff263a2452c2060e63;hp=cfe49d2a3335527a1dcca61fbe80ff264b4640b5;hb=9e0473a48cbaa821c36fb9c456c25b203d46c87c;hpb=4ab50053d9969464c5002db66e135bcfb92bd625 diff --git a/bin/blhc b/bin/blhc index cfe49d2..72a2c42 100755 --- a/bin/blhc +++ b/bin/blhc @@ -48,6 +48,9 @@ my $cc_regex_normal = qr/ /x; # Regex to catch (GCC) compiler warnings. my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/; +# Regex to catch libtool commands and not lines which show commands executed +# by libtool (e.g. libtool: link: ...). +my $libtool_regex = qr/\blibtool\s.*--mode=/; # List of source file extensions which require preprocessing. my @source_preprocess_compile_cpp = ( @@ -429,6 +432,20 @@ sub pic_pie_conflict { sub is_non_verbose_build { my ($line, $next_line, $skip_ref) = @_; + if ($line =~ /$libtool_regex/o) { + # libtool's --silent hides the real compiler flags. + if ($line =~ /\s--silent/) { + return 1; + # If --silent is not present, skip this line as some compiler flags + # might be missing (e.g. -fPIE) which are handled correctly by libtool + # internally. libtool displays the real compiler command on the next + # line, so the flags are checked as usual. + } else { + ${$skip_ref} = 1; + return 0; + } + } + if (not (index($line, 'checking if you want to see long compiling messages... no') == 0 or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/ or $line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/ @@ -442,6 +459,8 @@ sub is_non_verbose_build { # C++ compiler setting. return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/; return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/; + # "Compiling" non binary files. + return 0 if $line =~ /^\s*Compiling \S+\.(?:py|el)['"]?(?:\.\.\.)?$/; # "Compiling" with no file name. if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) { # $file_extension_regex may need spaces around the filename. @@ -500,15 +519,17 @@ sub compile_flag_regexp { my @result = (); foreach my $flag (@flags) { + # Compile flag regexp for faster execution. + my $regex = qr/\s$flag(?:\s|\\)/; + # Store flag name in replacement string for correct flags in messages # with qr//ed flag regexps. - $flag_renames_ref->{qr/\s$flag(?:\s|\\)/} + $flag_renames_ref->{$regex} = (exists $flag_renames_ref->{$flag}) ? $flag_renames_ref->{$flag} : $flag; - # Compile flag regexp for faster execution. - push @result, qr/\s$flag(?:\s|\\)/; + push @result, $regex; } return @result; } @@ -517,14 +538,12 @@ sub compile_flag_regexp { sub extension_found { my ($extensions_ref, @extensions) = @_; - my $found = 0; foreach my $extension (@extensions) { if (exists $extensions_ref->{$extension}) { - $found = 1; - last; + return 1; } } - return $found; + return 0; } @@ -570,7 +589,8 @@ if ($option_help) { Pod::Usage::pod2usage(1); } if ($option_version) { - print "blhc $VERSION Copyright (C) 2012-2013 Simon Ruderich + print <<"EOF"; +blhc $VERSION Copyright (C) 2012-2013 Simon Ruderich This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -584,7 +604,7 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . -"; +EOF exit 0; } @@ -687,8 +707,13 @@ foreach my $file (@ARGV) { # only, doesn't use the dpkg-buildpackage header. Necessary to ignore # build logs which aren't built (wrong architecture, build error, # etc.). - if (not $arch and index($line, 'Architecture: ') == 0) { - $arch = substr $line, 14, -1; # -1 to ignore '\n' at the end + if (not $arch) { + if (index($line, 'Build Architecture: ') == 0) { + $arch = substr $line, 20, -1; # -1 to ignore '\n' at the end + # For old logs (sbuild << 0.63.0-1). + } elsif (index($line, 'Architecture: ') == 0) { + $arch = substr $line, 14, -1; # -1 to ignore '\n' at the end + } } # dpkg-buildflags only provides hardening flags since 1.16.1, don't @@ -728,9 +753,11 @@ foreach my $file (@ARGV) { } } - # Debian's build daemons use Build-Depends: for the build - # dependencies, but pbuilder just uses Depends:; support both. - if (index($line, 'Build-Depends: ') == 0 + # Debian's build daemons use "Filtered Build-Depends:" (or just + # "Build-Depends:" in older versions) for the build dependencies, but + # pbuilder uses "Depends:"; support both. + if (index($line, 'Filtered Build-Depends: ') == 0 + or index($line, 'Build-Depends: ') == 0 or index($line, 'Depends: ') == 0) { # If hardening wrapper is used (wraps calls to gcc and adds # hardening flags automatically) we can't perform any checks, @@ -765,6 +792,7 @@ foreach my $file (@ARGV) { my $continuation = 0; my $complete_line = undef; + my $non_verbose; while (my $line = <$fh>) { # And stop at the end of the build log. Package details (reported by # the buildd logs) are not important for us. This also prevents false @@ -772,6 +800,10 @@ foreach my $file (@ARGV) { last if index($line, 'Build finished at ') == 0 and $line =~ /^Build finished at \d{8}-\d{4}$/; + if (not $continuation) { + $non_verbose = 0; + } + # Detect architecture automatically unless overridden. if (not $arch and index($line, 'dpkg-buildpackage: host architecture ') == 0) { @@ -801,7 +833,9 @@ foreach my $file (@ARGV) { } # Check if this line indicates a non verbose build. - my $non_verbose = is_non_verbose_build($line); + my $skip = 0; + $non_verbose |= is_non_verbose_build($line, undef, \$skip); + next if $skip; # One line may contain multiple commands (";"). Treat each one as # single line. parse_line() is slow, only use it when necessary. @@ -919,7 +953,7 @@ foreach my $file (@ARGV) { # Option or auto detected. if ($arch) { - # The following was partially copied from dpkg-dev 1.16.4.3 + # The following was partially copied from dpkg-dev 1.17.1 # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), # copyright Raphaël Hertzog , Kees Cook # , Canonical, Ltd. licensed under GPL version 2 or @@ -929,7 +963,12 @@ foreach my $file (@ARGV) { my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch); # Disable unsupported hardening options. - if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') { + if ($os !~ /^(?:linux|knetbsd|hurd)$/ or + $cpu =~ /^(?:hppa|mips|mipsel|avr32)$/) { + $harden_pie = 0; + } + if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa|arm64)$/ + or $arch eq 'arm') { $harden_stack = 0; } if ($cpu =~ /^(?:ia64|hppa|avr32)$/) { @@ -971,8 +1010,8 @@ foreach my $file (@ARGV) { # Stores normal CFLAGS when @cflags_ada are temporarily used. my @cflags_backup; - # Ada CFLAGS. - my @cflags_ada = @cflags; + # Ada CFLAGS, only set if ada is used. + my @cflags_ada; # Ada doesn't support format hardening flags, see #680117 for more # information. Filter them out if ada is used. if ($ada and $harden_format) { @@ -1254,14 +1293,18 @@ blhc is a small tool which checks build logs for missing hardening flags. It's licensed under the GPL 3 or later. It's designed to check build logs generated by Debian's dpkg-buildpackage (or -tools using dpkg-buildpackage like pbuilder or the official buildd build logs) -to help maintainers detect missing hardening flags in their packages. +tools using dpkg-buildpackage like pbuilder or sbuild (which is used for the +official buildd build logs)) to help maintainers detect missing hardening +flags in their packages. Only gcc is detected as compiler at the moment. If other compilers support hardening flags as well, please report them. If there's no output, no flags are missing and the build log is fine. +See F for details about performed checks, auto-detection and +limitations. + =head1 OPTIONS =over 8