X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=91a5f4943c29076d61bde0904dffc7aa8d38a74a;hp=9800eafad367ab187ffedd6fe94ae9f4fc20ea45;hb=53e64de60f08fcb752b1f3ccb41c9e8555be8866;hpb=e8d66101e7bf4ba755df5c5f893402f98131fedf diff --git a/bin/blhc b/bin/blhc index 9800eaf..91a5f49 100755 --- a/bin/blhc +++ b/bin/blhc @@ -129,14 +129,8 @@ my %extensions_compile_cpp = map { $_ => 1 } ( ); my %extension = map { $_ => 1 } ( @source_no_preprocess, - @source_no_preprocess_compile, - @source_no_preprocess_compile_cpp, - @source_no_preprocess_no_compile, @header_preprocess, @source_preprocess, - @source_preprocess_compile, - @source_preprocess_compile_cpp, - @source_preprocess_no_compile, ); # Regexp to match file extensions. @@ -181,10 +175,10 @@ my @def_cppflags_fortify = ( ); my @def_ldflags = (); my @def_ldflags_relro = ( - '-Wl,(-z,)?relro', + '-Wl,(?:-z,)?relro', ); my @def_ldflags_bindnow = ( - '-Wl,(-z,)?now', + '-Wl,(?:-z,)?now', ); my @def_ldflags_pie = ( '-fPIE', @@ -198,9 +192,18 @@ my @def_ldflags_pic = ( # Renaming rules for the output so the regex parts are not visible. Also # stores string values of flag regexps above, see compile_flag_regexp(). my %flag_renames = ( - '-O(?:2|3)' => '-O2', - '-Wl,(-z,)?relro' => '-Wl,-z,relro', - '-Wl,(-z,)?now' => '-Wl,-z,now', + '-O(?:2|3)' => '-O2', + '-Wl,(?:-z,)?relro' => '-Wl,-z,relro', + '-Wl,(?:-z,)?now' => '-Wl,-z,now', +); + +my %exit_code = ( + no_compiler_commands => 1 << 0, + # used by POD::Usage => 1 << 1, + non_verbose_build => 1 << 2, + flags_missing => 1 << 3, + hardening_wrapper => 1 << 4, + invalid_cmake => 1 << 5, ); # Statistics of missing flags and non-verbose build commands. Used for @@ -245,6 +248,14 @@ sub error_non_verbose_build { error_color(':', 'yellow'), $line; } +sub error_invalid_cmake { + my ($version) = @_; + + printf "%s%s %s\n", + error_color('INVALID CMAKE', 'red'), + error_color(':', 'yellow'), + $version; +} sub error_hardening_wrapper { printf "%s%s %s\n", error_color('HARDENING WRAPPER', 'red'), @@ -456,8 +467,13 @@ if ($option_all) { my $exit = 0; FILE: foreach my $file (@ARGV) { + print "checking '$file'...\n" if scalar @ARGV > 1; + open my $fh, '<', $file or die "$!: $file"; + # Architecture of this file. + my $arch = $option_arch; + # Hardening options. Not all architectures support all hardening options. my $harden_format = 1; my $harden_fortify = 1; @@ -475,7 +491,7 @@ FILE: foreach my $file (@ARGV) { # flags are not checked. if ($option_buildd and $line =~ /^Toolchain package versions: /) { require Dpkg::Version; - if ($line !~ /dpkg-dev_(\S+)/ + if ($line !~ /\bdpkg-dev_(\S+)/ or Dpkg::Version::version_compare($1, '1.16.1') < 0) { $harden_format = 0; $harden_fortify = 0; @@ -486,6 +502,23 @@ FILE: foreach my $file (@ARGV) { } } + # The following two versions of CMake in Debian obeyed CPPFLAGS, but + # this was later dropped because upstream rejected the patch. Thus + # build logs with these versions will have fortify hardening flags + # enabled, even though they may be not correctly set and are missing + # when build with later CMake versions. Thanks to Aron Xu for letting + # me know. + if ($line =~ /^Package versions: / + and $line =~ /\bcmake_(\S+)/ + and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) { + if (not $option_buildd) { + error_invalid_cmake($1); + } else { + print "W-invalid-cmake-used $1\n"; + } + $exit |= $exit_code{invalid_cmake}; + } + # If hardening wrapper is used (wraps calls to gcc and adds hardening # flags automatically) we can't perform any checks, abort. if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) { @@ -494,7 +527,7 @@ FILE: foreach my $file (@ARGV) { } else { print "I-hardening-wrapper-used\n"; } - $exit |= 1 << 4; + $exit |= $exit_code{hardening_wrapper}; next FILE; } @@ -515,9 +548,9 @@ FILE: foreach my $file (@ARGV) { last if $line =~ /^Build finished at \d{8}-\d{4}$/; # Detect architecture automatically unless overridden. - if (not $option_arch + if (not $arch and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { - $option_arch = $1; + $arch = $1; } # Ignore compiler warnings for now. @@ -612,7 +645,7 @@ FILE: foreach my $file (@ARGV) { } else { print "W-no-compiler-commands\n"; } - $exit |= 1; + $exit |= $exit_code{no_compiler_commands}; next FILE; } @@ -621,7 +654,7 @@ FILE: foreach my $file (@ARGV) { } # Option or auto detected. - if ($option_arch) { + if ($arch) { # The following was partially copied from dpkg-dev 1.16.1.2 # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), # copyright Raphaël Hertzog , Kees Cook @@ -629,10 +662,10 @@ FILE: foreach my $file (@ARGV) { # later. Keep it in sync. require Dpkg::Arch; - my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch); + my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch); # Disable unsupported hardening options. - if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') { + if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') { $harden_stack = 0; } if ($cpu =~ /^(ia64|hppa|avr32)$/) { @@ -682,7 +715,7 @@ FILE: foreach my $file (@ARGV) { } else { $statistics{commands_nonverbose}++; } - $exit |= 1 << 2; + $exit |= $exit_code{non_verbose_build}; next; } # Even if it's a verbose build, we might have to skip this line. @@ -698,6 +731,7 @@ FILE: foreach my $file (@ARGV) { # Skip unnecessary tests when only preprocessing. my $flag_preprocess = 0; + my $dependency = 0; my $preprocess = 0; my $compile = 0; my $link = 0; @@ -707,11 +741,25 @@ FILE: foreach my $file (@ARGV) { $preprocess = 1; $flag_preprocess = 1 if $1 eq '-E'; $compile = 1 if $1 eq '-S' or $1 eq '-c'; + # Dependency generation for Makefiles. The other flags (-MF -MG -MP + # -MT -MQ) are always used with -M/-MM. + } elsif ($line =~ /\s(?:-M|-MM)\b/) { + $dependency = 1; # Otherwise assume we are linking. } else { $link = 1; } + # -MD/-MMD also cause dependency generation, but they don't imply -E! + if ($line =~ /\s(?:-MD|-MMD)\b/) { + $dependency = 0; + $flag_preprocess = 0; + } + + # Dependency generation for Makefiles, no preprocessing or other flags + # needed. + next if $dependency; + # Get all file extensions on this line. my @extensions = $line =~ /$file_extension_regex/go; # Ignore all unknown extensions to speedup the search below. @@ -771,7 +819,7 @@ FILE: foreach my $file (@ARGV) { } else { $statistics{compile_missing}++; } - $exit |= 1 << 3; + $exit |= $exit_code{flags_missing}; } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be # linked with -fPIE as well. It's no error if only PIE flags @@ -784,7 +832,7 @@ FILE: foreach my $file (@ARGV) { } else { $statistics{compile_cpp_missing}++; } - $exit |= 1 << 3; + $exit |= $exit_code{flags_missing}; } if ($preprocess and not all_flags_used($line, \@missing, @cppflags) # Assume dpkg-buildflags returns the correct flags. @@ -794,7 +842,7 @@ FILE: foreach my $file (@ARGV) { } else { $statistics{preprocess_missing}++; } - $exit |= 1 << 3; + $exit |= $exit_code{flags_missing}; } if ($link and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. @@ -806,7 +854,7 @@ FILE: foreach my $file (@ARGV) { } else { $statistics{link_missing}++; } - $exit |= 1 << 3; + $exit |= $exit_code{flags_missing}; } } }