X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=b5177bdda7b88e6a452c57c93f091318c5d4301d;hp=9525baa33c7675c17c4356c063e721660f2638af;hb=4a632b4ff1fd63e85196fe3fcbea273d75b4b4ed;hpb=fbfa7bab6a0c7f1705ca56a37b1ccc1d5d3c5288
diff --git a/bin/blhc b/bin/blhc
index 9525baa..b5177bd 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
# Build log hardening check, checks build logs for missing hardening flags.
-# Copyright (C) 2012 Simon Ruderich
+# Copyright (C) 2012-2013 Simon Ruderich
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
use Getopt::Long ();
use Text::ParseWords ();
-our $VERSION = '0.03';
+our $VERSION = '0.04';
# CONSTANTS/VARIABLES
@@ -176,13 +176,14 @@ my $file_extension_regex = qr/
# terminated with "\n".
/x;
-# Expected (hardening) flags. All flags are used as regexps.
+# Expected (hardening) flags. All flags are used as regexps (and compiled to
+# real regexps below for better execution speed).
my @def_cflags = (
'-g',
'-O(?:2|3)',
);
my @def_cflags_format = (
- '-Wformat',
+ '-Wformat(?:=2)?', # -Wformat=2 implies -Wformat, accept it too
'-Werror=format-security', # implies -Wformat-security
);
my @def_cflags_fortify = (
@@ -190,7 +191,7 @@ my @def_cflags_fortify = (
);
my @def_cflags_stack = (
'-fstack-protector',
- '--param=ssp-buffer-size=4',
+ '--param[= ]ssp-buffer-size=4',
);
my @def_cflags_pie = (
'-fPIE',
@@ -250,9 +251,11 @@ my @flag_refs_all = (
# Renaming rules for the output so the regex parts are not visible. Also
# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
- '-O(?:2|3)' => '-O2',
- '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
- '-Wl,(?:-z,)?now' => '-Wl,-z,now',
+ '-O(?:2|3)' => '-O2',
+ '-Wformat(?:=2)?' => '-Wformat',
+ '--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
+ '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+ '-Wl,(?:-z,)?now' => '-Wl,-z,now',
);
my %exit_code = (
@@ -438,6 +441,7 @@ sub is_non_verbose_build {
#
# C++ compiler setting.
return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+ return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
# "Compiling" with no file name.
if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
# $file_extension_regex may need spaces around the filename.
@@ -472,6 +476,7 @@ sub is_non_verbose_build {
return 1;
}
+# Remove @flags from $flag_refs_ref, and $flag_renames_ref.
sub remove_flags {
my ($flag_refs_ref, $flag_renames_ref, @flags) = @_;
@@ -489,35 +494,37 @@ sub remove_flags {
return;
}
+# Modifies $flag_renames_ref hash.
sub compile_flag_regexp {
my ($flag_renames_ref, @flags) = @_;
my @result = ();
foreach my $flag (@flags) {
+ # Compile flag regexp for faster execution.
+ my $regex = qr/\s$flag(?:\s|\\)/;
+
# Store flag name in replacement string for correct flags in messages
# with qr//ed flag regexps.
- $flag_renames_ref->{qr/\s$flag(?:\s|\\)/}
+ $flag_renames_ref->{$regex}
= (exists $flag_renames_ref->{$flag})
? $flag_renames_ref->{$flag}
: $flag;
- # Compile flag regexp for faster execution.
- push @result, qr/\s$flag(?:\s|\\)/;
+ push @result, $regex;
}
return @result;
}
+# Does any extension in @extensions exist in %{$extensions_ref}?
sub extension_found {
my ($extensions_ref, @extensions) = @_;
- my $found = 0;
foreach my $extension (@extensions) {
if (exists $extensions_ref->{$extension}) {
- $found = 1;
- last;
+ return 1;
}
}
- return $found;
+ return 0;
}
@@ -563,7 +570,8 @@ if ($option_help) {
Pod::Usage::pod2usage(1);
}
if ($option_version) {
- print "blhc $VERSION Copyright (C) 2012 Simon Ruderich
+ print <<"EOF";
+blhc $VERSION Copyright (C) 2012-2013 Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -577,7 +585,7 @@ GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
-";
+EOF
exit 0;
}
@@ -721,7 +729,10 @@ foreach my $file (@ARGV) {
}
}
- if (index($line, 'Build-Depends: ') == 0) {
+ # Debian's build daemons use Build-Depends: for the build
+ # dependencies, but pbuilder just uses Depends:; support both.
+ if (index($line, 'Build-Depends: ') == 0
+ or index($line, 'Depends: ') == 0) {
# If hardening wrapper is used (wraps calls to gcc and adds
# hardening flags automatically) we can't perform any checks,
# abort.
@@ -766,6 +777,13 @@ foreach my $file (@ARGV) {
if (not $arch
and index($line, 'dpkg-buildpackage: host architecture ') == 0) {
$arch = substr $line, 37, -1; # -1 to ignore '\n' at the end
+
+ # Old buildd logs use e.g. "host architecture is alpha", remove
+ # the "is", otherwise debarch_to_debtriplet() will not detect the
+ # architecture.
+ if (index($arch, 'is ') == 0) {
+ $arch = substr $arch, 3;
+ }
}
# Ignore compiler warnings for now.
@@ -839,13 +857,20 @@ foreach my $file (@ARGV) {
next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
[Cc]ompiler[\s.]*:?\s+
/x;
- next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
- # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or
- # similar for other architectures) which gets recognized as a
- # compiler line. Ignore it.
- next if $line =~ m{^/usr/bin/moc-qt4
+ next if $line =~ m{^\s*(?:-\s)?(?:HOST_)?(?:CC|CXX)
+ \s*=\s*$cc_regex_full
+ # optional compiler options, don't allow
+ # "everything" here to prevent false negatives
+ \s*(?:\s-\S+)*\s*$}xo;
+ # `moc-qt4`/`moc-qt5` contain '-I.../linux-g++' in their command
+ # line (or similar for other architectures) which gets recognized
+ # as a compiler line, but `moc-qt*` is only a preprocessor for Qt
+ # C++ files. No hardening flags are relevant during this step,
+ # thus ignore `moc-qt*` lines. The resulting files will be
+ # compiled in a separate step (and therefore checked).
+ next if $line =~ m{^\S+/bin/moc(?:-qt[45])?
\s.+\s
- -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
+ -I\S+/mkspecs/[a-z]+-g\++(?:-64)?
\s}x;
# Ignore false positives when the line contains only CC=gcc but no
# other gcc command.
@@ -895,7 +920,7 @@ foreach my $file (@ARGV) {
# Option or auto detected.
if ($arch) {
- # The following was partially copied from dpkg-dev 1.16.4.3
+ # The following was partially copied from dpkg-dev 1.17.1
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaël Hertzog , Kees Cook
# , Canonical, Ltd. licensed under GPL version 2 or
@@ -905,7 +930,12 @@ foreach my $file (@ARGV) {
my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
# Disable unsupported hardening options.
- if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
+ if ($os !~ /^(?:linux|knetbsd|hurd)$/ or
+ $cpu =~ /^(?:hppa|mips|mipsel|avr32)$/) {
+ $harden_pie = 0;
+ }
+ if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa|arm64)$/
+ or $arch eq 'arm') {
$harden_stack = 0;
}
if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
@@ -1003,7 +1033,8 @@ LINE:
}
next;
}
- # Even if it's a verbose build, we might have to skip this line.
+ # Even if it's a verbose build, we might have to skip this line (see
+ # is_non_verbose_build()).
next if $skip;
# Remove everything until and including the compiler command. Makes
@@ -1465,7 +1496,7 @@ Ejari.aalto@cante.netE for their valuable input and suggestions.
=head1 LICENSE AND COPYRIGHT
-Copyright (C) 2012 by Simon Ruderich
+Copyright (C) 2012-2013 by Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by