X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=bcae721394c72702bf21630df02e75c71211be77;hp=f43b5935485d219e1b2c85f052eafbb7f7bc6c94;hb=77130673acb919d0b1cfed6cfac6bc2338751878;hpb=6627495234a5de93e9c77b708774dfb6ae25fa20 diff --git a/bin/blhc b/bin/blhc index f43b593..bcae721 100755 --- a/bin/blhc +++ b/bin/blhc @@ -27,6 +27,58 @@ use Term::ANSIColor (); our $VERSION = '0.01'; +# CONSTANTS/VARIABLES + +# Regex to catch compiler commands. +my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)? + (?:(? '-O2', + '-Wl,(-z,)?relro' => '-Wl,-z,relro', + '-Wl,(-z,)?now' => '-Wl,-z,now', +); + + # FUNCTIONS sub error_flags { @@ -44,6 +96,14 @@ sub error_flags { error_color($message, 'red'), $flags, error_color(':', 'yellow'), $line; } +sub error_non_verbose_build { + my ($line) = @_; + + printf "%s%s %s", + error_color('NONVERBOSE BUILD', 'red'), + error_color(':', 'yellow'), + $line; +} sub error_color { my ($message, $color) = @_; @@ -59,7 +119,7 @@ sub any_flags_used { my ($line, @flags) = @_; foreach my $flag (@flags) { - return 1 if $line =~ /\s$flag(\s|\\|$)/; + return 1 if $line =~ /\s$flag(?:\s|\\|$)/; } return 0; @@ -69,7 +129,7 @@ sub all_flags_used { my @missing_flags = (); foreach my $flag (@flags) { - if ($line !~ /\s$flag(\s|\\|$)/) { + if ($line !~ /\s$flag(?:\s|\\|$)/) { push @missing_flags, $flag; } } @@ -87,7 +147,7 @@ sub pic_pie_conflict { my ($line, $pie, $missing_flags_ref, @flags_pie) = @_; return 0 if not $pie; - return 0 if not any_flags_used($line, ('-fPIC')); + return 0 if not any_flags_used($line, ('-fPIC', '-fpic')); my %flags = map { $_ => 1 } @flags_pie; @@ -104,65 +164,70 @@ sub pic_pie_conflict { return scalar @result == 0; } +sub is_non_verbose_build { + my ($line, $next_line, $skip_ref) = @_; -# CONSTANTS/VARIABLES + if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/ + or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD)\]?\s+(.+?)$/ + or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/ + or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/ + or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) { + return 0; + } -# Regex to catch (GCC) compiler warnings. -my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/; + my $file = $1; -# Expected hardening flags. All flags are used as regexps. -my @cflags = ( - '-g', - '-O2', - '-fstack-protector', - '--param=ssp-buffer-size=4', - '-Wformat', - '-Wformat-security', - '-Werror=format-security', -); -my @cflags_pie = ( - '-fPIE', -); -my @cppflags = ( - '-D_FORTIFY_SOURCE=2', -); -my @ldflags = ( - '-Wl,(-z,)?relro', -); -my @ldflags_pie = ( - '-fPIE', - '-pie', -); -my @ldflags_bindnow = ( - '-Wl,(-z,)?now', -); -# All (hardening) flags. -my @flags = (@cflags, @cflags_pie, - @cppflags, - @ldflags, @ldflags_pie, @ldflags_bindnow); -# Renaming rules for the output so the regex parts are not visible. -my %flag_renames = ( - '-Wl,(-z,)?relro' => '-Wl,-z,relro', - '-Wl,(-z,)?now' => '-Wl,-z,now', -); + # On the first pass we only check if this line is verbose or not. + return 1 if not defined $next_line; + + # Second pass, we have access to the next line. + ${$skip_ref} = 0; + + # CMake and other build systems print the non-verbose messages also when + # building verbose. If a compiler and the file name occurs in the next + # line, treat it as verbose build. + if (defined $file) { + # Get filename, we can't use the complete path as only parts of it are + # used in the real compiler command. + $file =~ m{/([a-zA-Z0-9._-]+)$}; + $file = $1; + + if ($next_line =~ /\Q$file\E/ and $next_line =~ /$cc_regex/) { + # We still have to skip the current line as it doesn't contain any + # compiler commands. + ${$skip_ref} = 1; + return 0; + } + } + + return 1; +} # MAIN -# Additional hardening options. -my $pie = 0; -my $bindnow = 0; +# Hardening options. Not all architectures support all hardening options. +my $harden_format = 1; +my $harden_fortify = 1; +my $harden_stack = 1; +my $harden_relro = 1; +my $harden_bindnow = 0; +my $harden_pie = 0; # Parse command line arguments. -my $option_all = 0; my $option_help = 0; my $option_version = 0; +my $option_all = 0; +my $option_arch = undef; if (not Getopt::Long::GetOptions( 'help|h|?' => \$option_help, 'version' => \$option_version, - 'pie' => \$pie, - 'bindnow' => \$bindnow, + # Hardening options. + 'pie' => \$harden_pie, + 'bindnow' => \$harden_bindnow, 'all' => \$option_all, + # Misc. + 'arch' => \$option_arch, )) { require Pod::Usage; Pod::Usage::pod2usage(2); @@ -191,8 +256,8 @@ along with this program. If not, see . } if ($option_all) { - $pie = 1; - $bindnow = 1; + $harden_pie = 1; + $harden_bindnow = 1; } # Final exit code. @@ -201,11 +266,37 @@ my $exit = 0; # Input lines, contain only the lines with compiler commands. my @input = (); +my $start = 0; my $continuation = 0; +my $complete_line = undef; while (my $line = <>) { + # We skip over unimportant lines at the beginning to prevent false + # positives. + $start = 1 if $line =~ /^dpkg-buildpackage:/; + next if not $start; + + # Detect architecture automatically unless overridden. + if (not $option_arch + and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) { + $option_arch = $1; + } + # Ignore compiler warnings for now. next if $line =~ /$warning_regex/; + # Remove all ANSI color sequences which are sometimes used in non-verbose + # builds. + $line = Term::ANSIColor::colorstrip($line); + # Also strip '\0xf' (delete previous character), used by Elink's build + # system. + $line =~ s/\x0f//g; + # And "ESC(B" which seems to be used on armhf and hurd (not sure what it + # does). + $line =~ s/\033\(B//g; + + # Check if this line indicates a non verbose build. + my $non_verbose = is_non_verbose_build($line); + # One line may contain multiple commands (";"). Treat each one as single # line. my @line = split /(?) { # Join lines, but leave the "\" in place so it's clear where the # original line break was. - chomp $input[-1]; - $input[-1] .= ' ' . $line; + chomp $complete_line; + $complete_line .= ' ' . $line; + } + # Line continuation, line ends with "\". + if ($line =~ /\\\s*$/) { + $continuation = 1; + # Start line continuation. + if (not defined $complete_line) { + $complete_line = $line; + } + next; + } + + if (not $continuation) { + # Use the complete line if a line continuation occurred. + if (defined $complete_line) { + $line = $complete_line; + $complete_line = undef; + } - } else { # Ignore lines with no compiler commands. - next if $line !~ /\b(cc\b|gcc\b|g\+\+|c\+\+)/; + next if $line !~ /\b$cc_regex(?:\s|\\)/ and not $non_verbose; # Ignore false positives. # # `./configure` output. - if ($line =~ /^checking /) { - next; - } + next if not $non_verbose and $line =~ /^checking /; + next if $line =~ /^\s*(?:C\s+)? + (?:C|c)ompiler[\s.]*:\s+ + $cc_regex + (?:\s-std=[a-z0-9:+]+)?\s*$ + /x + or $line =~ /^\s*(?:- )?(?:CC|CXX)\s*=\s*$cc_regex\s*$/ + or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / + or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; + # Debian buildd output. + next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/ + and $line !~ /\s-./; # option, prevent false negatives - push @input, $line; - } - # Line continuation, line ends with "\". - if ($line =~ /\\\s*$/) { - $continuation = 1; + push @input, $line; } } } @@ -249,29 +361,83 @@ if (scalar @input == 0) { exit $exit; } +# Option or auto detected. +if ($option_arch) { + # The following was partially copied from dpkg-dev 1.16.1.2 + # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()), + # copyright Raphaël Hertzog , Kees Cook + # , Canonical, Ltd. licensed under GPL version 2 or + # later. Keep it in sync. + + require Dpkg::Arch; + my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch); + + # Disable unsupported hardening options. + if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') { + $harden_stack = 0; + } + if ($cpu =~ /^(ia64|hppa|avr32)$/) { + $harden_relro = 0; + $harden_bindnow = 0; + } +} + # Check if additional hardening options were used. Used to ensure they are # used for the complete build. foreach my $line (@input) { - $pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie); - $bindnow = 1 if any_flags_used($line, @ldflags_bindnow); + $harden_pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie); + $harden_bindnow = 1 if any_flags_used($line, @ldflags_bindnow); } -if ($pie) { +# Check the specified hardening options, same order as dpkg-buildflags. +if ($harden_pie) { @cflags = (@cflags, @cflags_pie); @ldflags = (@ldflags, @ldflags_pie); } -if ($bindnow) { +if ($harden_stack) { + @cflags = (@cflags, @cflags_stack); +} +if ($harden_fortify) { + @cflags = (@cflags, @cflags_fortify); + @cppflags = (@cppflags, @cppflags_fortify); +} +if ($harden_format) { + @cflags = (@cflags, @cflags_format); +} +if ($harden_relro) { + @ldflags = (@ldflags, @ldflags_relro); +} +if ($harden_bindnow) { @ldflags = (@ldflags, @ldflags_bindnow); } -foreach my $line (@input) { +for (my $i = 0; $i < scalar @input; $i++) { + my $line = $input[$i]; + + my $skip = 0; + if (is_non_verbose_build($line, $input[$i + 1], \$skip)) { + error_non_verbose_build($line); + $exit |= 1 << 2; + next; + } + # Even if it's a verbose build, we might have to skip this line. + next if $skip; + + # Is this a compiler or linker command? my $compiler = 1; my $linker = 0; # Linker commands. - if ($line =~ /\s-l[A-Za-z0-9.-]+(\s|\\|$)/ - or $line =~ m{\s-o ([A-Za-z0-9_/.-]+/)?[A-Za-z0-9_-]+(\.so|\.la)?(\s|\\|\$)} + if ($line =~ m{\s-o # -o + [\s\\]*\s+ # possible line continuation + (?:[/.A-Za-z0-9~_-]+/)? # path to file + [A-Za-z0-9~_-]+ # binary name (no dots!) + (?:[0-9.]*\.so[0-9.]*[a-z]? # library (including version) + |\.la + |\.cgi)? # CGI binary + (?:\s|\\|$) # end of file name + }x or $line =~ /^libtool: link: / or $line =~ m{\s*/bin/bash .+?libtool\s+(.+?\s+)?--mode=(re)?link}) { $compiler = 0; @@ -280,7 +446,7 @@ foreach my $line (@input) { # If there are source files then it's compiling/linking in one step and we # must check both. - if ($line =~ /\.(c|cc|cpp)\b/) { + if ($line =~ /\.(?:c|cc|cpp)\b/) { $compiler = 1; } @@ -289,19 +455,19 @@ foreach my $line (@input) { if ($compiler and not all_flags_used($line, \@missing, @cflags) # Libraries linked with -fPIC don't have to (and can't) be linked # with -fPIE as well. It's no error if only PIE flags are missing. - and not pic_pie_conflict($line, $pie, \@missing, @cflags_pie)) { + and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)) { error_flags('CFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 2; + $exit |= 1 << 3; } if ($compiler and not all_flags_used($line, \@missing, @cppflags)) { error_flags('CPPFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 2; + $exit |= 1 << 3; } if ($linker and not all_flags_used($line, \@missing, @ldflags) # Same here, -fPIC conflicts with -fPIE. - and not pic_pie_conflict($line, $pie, \@missing, @ldflags_pie)) { + and not pic_pie_conflict($line, $harden_pie, \@missing, @ldflags_pie)) { error_flags('LDFLAGS missing', \@missing, \%flag_renames, $line); - $exit |= 1 << 2; + $exit |= 1 << 3; } } @@ -325,6 +491,7 @@ B [--pie] [--bindnow] [--all] --pie force +pie check --bindnow force +bindbow check --all force +all (+pie, +bindnow) check + --arch set architecture (autodetected) =head1 DESCRIPTION @@ -356,6 +523,12 @@ Force check for all +bindnow hardening flags. By default it's auto detected. Force check for all +all (+pie, +bindnow) hardening flags. By default it's auto detected. +=item B<--arch> + +Set the specific architecture (e.g. amd64, armel, etc.), automatically +disables hardening flags not available on this architecture. Is detected +automatically if dpkg-buildpackage is used. + =back Auto detection only works if at least one command uses the required hardening @@ -382,6 +555,10 @@ Invalid arguments/options given to blhc. =item B<4> +Non verbose build. + +=item B<8> + Missing hardening flags. =back