X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=8b21c8f2d4cfd509f928aa745f2c761f918b76d3;hp=618fa7698dc69406157114cd56bcd866dcdfc31d;hb=48f6d8ed0c3c7ae59c3a55c9d2e9dd6c8aa5f052;hpb=4b7b1141cf7ced73a3ed2445068233e429987865 diff --git a/bin/blhc b/bin/blhc index 618fa76..8b21c8f 100755 --- a/bin/blhc +++ b/bin/blhc @@ -145,42 +145,42 @@ my $file_extension_regex = qr/ /x; # Expected (hardening) flags. All flags are used as regexps. -my @cflags = ( +my @def_cflags = ( '-g', '-O(?:2|3)', ); -my @cflags_format = ( +my @def_cflags_format = ( '-Wformat', '-Wformat-security', '-Werror=format-security', ); -my @cflags_fortify = ( +my @def_cflags_fortify = ( # fortify needs at least -O1, but -O2 is recommended anyway ); -my @cflags_stack = ( +my @def_cflags_stack = ( '-fstack-protector', '--param=ssp-buffer-size=4', ); -my @cflags_pie = ( +my @def_cflags_pie = ( '-fPIE', ); -my @cxxflags = ( +my @def_cxxflags = ( '-g', '-O(?:2|3)', ); -# @cxxflags_* is the same as @cflags_*. -my @cppflags = (); -my @cppflags_fortify = ( +# @def_cxxflags_* is the same as @def_cflags_*. +my @def_cppflags = (); +my @def_cppflags_fortify = ( '-D_FORTIFY_SOURCE=2', ); -my @ldflags = (); -my @ldflags_relro = ( +my @def_ldflags = (); +my @def_ldflags_relro = ( '-Wl,(-z,)?relro', ); -my @ldflags_bindnow = ( +my @def_ldflags_bindnow = ( '-Wl,(-z,)?now', ); -my @ldflags_pie = ( +my @def_ldflags_pie = ( '-fPIE', '-pie', ); @@ -338,17 +338,11 @@ sub extension_found { # MAIN -# Hardening options. Not all architectures support all hardening options. -my $harden_format = 1; -my $harden_fortify = 1; -my $harden_stack = 1; -my $harden_relro = 1; -my $harden_bindnow = 0; -my $harden_pie = 0; - # Parse command line arguments. my $option_help = 0; my $option_version = 0; +my $option_pie = 0; +my $option_bindnow = 0; my $option_all = 0; my $option_arch = undef; my $option_buildd = 0; @@ -357,8 +351,8 @@ if (not Getopt::Long::GetOptions( 'help|h|?' => \$option_help, 'version' => \$option_version, # Hardening options. - 'pie' => \$harden_pie, - 'bindnow' => \$harden_bindnow, + 'pie' => \$option_pie, + 'bindnow' => \$option_bindnow, 'all' => \$option_all, # Misc. 'color' => \$option_color, @@ -392,20 +386,31 @@ along with this program. If not, see . } if ($option_all) { - $harden_pie = 1; - $harden_bindnow = 1; + $option_pie = 1; + $option_bindnow = 1; } # Final exit code. my $exit = 0; +FILE: foreach my $file (@ARGV) { +open my $fh, '<', $file or die "$!: $file"; + +# Hardening options. Not all architectures support all hardening options. +my $harden_format = 1; +my $harden_fortify = 1; +my $harden_stack = 1; +my $harden_relro = 1; +my $harden_bindnow = $option_bindnow; # defaults to 0 +my $harden_pie = $option_pie; # defaults to 0 + # Input lines, contain only the lines with compiler commands. my @input = (); my $start = 0; my $continuation = 0; my $complete_line = undef; -while (my $line = <>) { +while (my $line = <$fh>) { # dpkg-buildflags only provides hardening flags since 1.16.1, don't check # for hardening flags in buildd mode if an older dpkg-dev is used. Default # flags (-g -O2) are still checked. @@ -431,7 +436,7 @@ while (my $line = <>) { if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { error_hardening_wrapper(); $exit |= 1 << 4; - exit $exit; + next FILE; } # We skip over unimportant lines at the beginning of the log to prevent @@ -524,18 +529,20 @@ while (my $line = <>) { # Check if additional hardening options were used. Used to ensure # they are used for the complete build. - $harden_pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie); - $harden_bindnow = 1 if any_flags_used($line, @ldflags_bindnow); + $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie); + $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow); push @input, $line; } } } +close $fh; + if (scalar @input == 0) { print "No compiler commands!\n"; $exit |= 1; - exit $exit; + next FILE; } # Option or auto detected. @@ -559,30 +566,35 @@ if ($option_arch) { } } +# Default values. +my @cflags = @def_cflags; +my @cxxflags = @def_cxxflags; +my @cppflags = @def_cppflags; +my @ldflags = @def_ldflags; # Check the specified hardening options, same order as dpkg-buildflags. if ($harden_pie) { - @cflags = (@cflags, @cflags_pie); - @cxxflags = (@cxxflags, @cflags_pie); - @ldflags = (@ldflags, @ldflags_pie); + @cflags = (@cflags, @def_cflags_pie); + @cxxflags = (@cxxflags, @def_cflags_pie); + @ldflags = (@ldflags, @def_ldflags_pie); } if ($harden_stack) { - @cflags = (@cflags, @cflags_stack); - @cxxflags = (@cxxflags, @cflags_stack); + @cflags = (@cflags, @def_cflags_stack); + @cxxflags = (@cxxflags, @def_cflags_stack); } if ($harden_fortify) { - @cflags = (@cflags, @cflags_fortify); - @cxxflags = (@cxxflags, @cflags_fortify); - @cppflags = (@cppflags, @cppflags_fortify); + @cflags = (@cflags, @def_cflags_fortify); + @cxxflags = (@cxxflags, @def_cflags_fortify); + @cppflags = (@cppflags, @def_cppflags_fortify); } if ($harden_format) { - @cflags = (@cflags, @cflags_format); - @cxxflags = (@cxxflags, @cflags_format); + @cflags = (@cflags, @def_cflags_format); + @cxxflags = (@cxxflags, @def_cflags_format); } if ($harden_relro) { - @ldflags = (@ldflags, @ldflags_relro); + @ldflags = (@ldflags, @def_ldflags_relro); } if ($harden_bindnow) { - @ldflags = (@ldflags, @ldflags_bindnow); + @ldflags = (@ldflags, @def_ldflags_bindnow); } for (my $i = 0; $i < scalar @input; $i++) { @@ -661,7 +673,7 @@ for (my $i = 0; $i < scalar @input; $i++) { if ($compile and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be linked # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie) + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CFLAGS`/) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $input[$i]); @@ -669,7 +681,7 @@ for (my $i = 0; $i < scalar @input; $i++) { } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be linked # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie) + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_cflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) { error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $input[$i]); @@ -683,13 +695,14 @@ for (my $i = 0; $i < scalar @input; $i++) { } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. - and not pic_pie_conflict($line, $harden_pie, \@missing, @ldflags_pie) + and not pic_pie_conflict($line, $harden_pie, \@missing, @def_ldflags_pie) # Assume dpkg-buildflags returns the correct flags. and not $line =~ /`dpkg-buildflags --get LDFLAGS`/) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $input[$i]); $exit |= 1 << 3; } } +} exit $exit; @@ -702,7 +715,7 @@ blhc - build log hardening check, checks build logs for missing hardening flags =head1 SYNOPSIS -B [options] +B [options] .. --all force +all (+pie, +bindnow) check --arch set architecture (autodetected)