X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=81d3b1237aee9eb6a961c050ec2b6a3a95c522bc;hp=fba278fde270a625a817e33512a4e6658d5e8aec;hb=2468c015390d5de096a2b9ca15e6744eb0fb0447;hpb=5fa7a26d171b5557884db3906ec13de46ab35449

diff --git a/bin/blhc b/bin/blhc
index fba278f..81d3b12 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2019  Simon Ruderich
+# Copyright (C) 2012-2020  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.09';
+our $VERSION = '0.11';
 
 
 # CONSTANTS/VARIABLES
@@ -53,7 +53,7 @@ my $cc_regex_normal = qr/
 my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
 # Regex to catch libtool commands and not lines which show commands executed
 # by libtool (e.g. libtool: link: ...).
-my $libtool_regex = qr/\blibtool\s.*--mode=/;
+my $libtool_regex = qr/\blibtool["']?\s.*--mode=/;
 my $libtool_link_regex = qr/\blibtool: link: /;
 
 # List of source file extensions which require preprocessing.
@@ -684,7 +684,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2019  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2020  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -750,6 +750,7 @@ foreach my $flags (@flag_refs_all) {
 }
 
 # Precompile ignore line regexps, also anchor at beginning and end of line.
+# Additional entries are also extracted from the build log, see below.
 foreach my $ignore (@option_ignore_line) {
     $ignore = qr/^$ignore$/;
 }
@@ -954,6 +955,15 @@ foreach my $file (@ARGV) {
             }
         }
 
+        # Permit dynamic excludes from within the build log to ignore false
+        # positives. Cannot use a separate config file as we often only have
+        # the build log itself.
+        if (index($line, 'blhc: ignore-line-regexp: ') == 0) {
+            my $ignore = substr $line, 26, -1; # -1 to ignore '\n' at the end
+            push @option_ignore_line, qr/^$ignore$/;
+            next;
+        }
+
         next if $line =~ /^\s*#/;
         # Ignore compiler warnings for now.
         next if $line =~ /$warning_regex/o;
@@ -1061,10 +1071,15 @@ foreach my $file (@ARGV) {
             # look like a compiler executable thus causing the line to be
             # treated as a normal compiler line.
             next if $line =~ m{^\s*rm\s+};
+            next if $line =~ m{^\s*dwz\s+};
             # Some build systems emit "gcc > file".
             next if $line =~ m{$cc_regex_normal\s*>\s*\S+}o;
             # Hex output may contain "cc".
             next if $line =~ m#(?:\b[0-9a-fA-F]{2,}\b\s*){5}#;
+            # Meson build output
+            next if $line =~ /^C\+\+ linker for the host machine: /;
+            # Embedded `gcc -print-*` commands
+            next if $line =~ /`$cc_regex_normal\s*[^`]*-print-\S+`/;
 
             # Check if additional hardening options were used. Used to ensure
             # they are used for the complete build.
@@ -1106,7 +1121,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.19.7
+        # The following was partially copied from dpkg-dev 1.20.5
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_build_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Guillem Jover
         # <guillem@debian.org>, Kees Cook <kees@debian.org>, Canonical, Ltd.
@@ -1513,6 +1528,22 @@ If there's no output, no flags are missing and the build log is fine.
 See F<README> for details about performed checks, auto-detection and
 limitations.
 
+=head1 FALSE POSITIVES
+
+To suppress false positives you can embed the following string in the build
+log:
+
+    blhc: ignore-line-regexp: REGEXP
+
+All lines fully matching REGEXP (see B<--ignore-line> for details) will be
+ignored.
+
+Please use this feature sparingly so that missing flags are not overlooked. If
+you find false positives which affect more packages please report a bug.
+
+To generate this string simply use echo in C<debian/rules>; make sure to use @
+to suppress the echo command itself as it could also trigger a false positive.
+
 =head1 OPTIONS
 
 =over 8
@@ -1758,7 +1789,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2019 by Simon Ruderich
+Copyright (C) 2012-2020 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by