X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=cfdcbba0fd103770b0b0a068d56fe0c1223083c5;hp=6e5e8f44b1b16ae125776d49688b9663babe22d5;hb=290a8e3484c700ebb91c3460820310e03ca38cb2;hpb=db749f492c88f727c2b6c402984b273548335ba0

diff --git a/bin/blhc b/bin/blhc
index 6e5e8f4..cfdcbba 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -33,7 +33,7 @@ our $VERSION = '0.07';
 my $cc_regex = qr/
     (?<!\s-)               # ignore options, e.g. "-c++" [sic!] (used by swig)
     (?<!\.)                # ignore file names, e.g. "test.gcc"
-    (?:cc|gcc|g\+\+|c\+\+)
+    (?:cc|gcc|g\+\+|c\+\+|gfortran|mpicc|mpicxx|mpifort)
     (?:-[\d.]+)?           # version suffix, e.g. "gcc-4.6"
     /x;
 # Full regex which matches the complete compiler name. Used in a few places to
@@ -63,6 +63,10 @@ my @source_preprocess_compile_cpp = (
     # Objective-C++
     qw( mm M ),
 );
+my @source_preprocess_compile_fortran = (
+    # Fortran
+    qw( F FOR fpp FPP FTN F90 F95 F03 F08 ),
+);
 my @source_preprocess_compile = (
     # C
     qw( c ),
@@ -71,7 +75,7 @@ my @source_preprocess_compile = (
     # (Objective-)C++
     @source_preprocess_compile_cpp,
     # Fortran
-    qw( F FOR fpp FPP FTN F90 F95 F03 F08 ),
+    @source_preprocess_compile_fortran,
 );
 my @source_preprocess_no_compile = (
     # Assembly
@@ -94,6 +98,10 @@ my @source_no_preprocess_compile_ada = (
     # Ada body
     qw( adb ),
 );
+my @source_no_preprocess_compile_fortran = (
+    # Fortran
+    qw( f for ftn f90 f95 f03 f08 ),
+);
 my @source_no_preprocess_compile = (
     # C
     qw( i ),
@@ -102,7 +110,7 @@ my @source_no_preprocess_compile = (
     # Objective-C
     qw( mi ),
     # Fortran
-    qw( f for ftn f90 f95 f03 f08 ),
+    @source_no_preprocess_compile_fortran,
     # Ada
     @source_no_preprocess_compile_ada,
 );
@@ -169,6 +177,10 @@ my %extensions_ada = map { $_ => 1 } (
     @source_no_preprocess_compile_ada,
     @source_no_preprocess_no_compile_ada,
 );
+my %extensions_fortran = map { $_ => 1 } (
+    @source_no_preprocess_compile_fortran,
+    @source_preprocess_compile_fortran,
+);
 my %extensions_object = map { $_ => 1 } (
     @object,
 );
@@ -730,12 +742,18 @@ foreach my $file (@ARGV) {
     # different CFLAGS. But only perform ada checks if an ada compiler is used
     # for performance reasons.
     my $ada = 0;
+    # Fortran also requires different CFLAGS.
+    my $fortran = 0;
 
     # Number of parallel jobs to prevent false positives when detecting
     # non-verbose builds. As not all jobs declare the number of parallel jobs
     # use a large enough default.
     my $parallel = 10;
 
+    # Don't check for PIE flags if automatically applied by the compiler. Only
+    # used in buildd mode.
+    my $disable_harden_pie = 0;
+
     while (my $line = <$fh>) {
         # Detect architecture automatically unless overridden. For buildd logs
         # only, doesn't use the dpkg-buildpackage header. Necessary to ignore
@@ -758,6 +776,10 @@ foreach my $file (@ARGV) {
         # flags are not checked.
         #
         # Strong stack protector is used since dpkg 1.17.11.
+        #
+        # Recent GCC versions automatically use PIE (only on supported
+        # architectures) and dpkg respects this properly since 1.18.15 and
+        # doesn't pass PIE flags manually.
         if ($option_buildd
                 and index($line, 'Toolchain package versions: ') == 0) {
             require Dpkg::Version;
@@ -772,6 +794,9 @@ foreach my $file (@ARGV) {
                 if (Dpkg::Version::version_compare($1, '1.17.11') >= 0) {
                     $disable_strong = 0;
                 }
+                if (Dpkg::Version::version_compare($1, '1.18.15') >= 0) {
+                    $disable_harden_pie = 1;
+                }
             }
 
             if ($disable) {
@@ -827,6 +852,10 @@ foreach my $file (@ARGV) {
             if ($line =~ /\bgnat\b/) {
                 $ada = 1;
             }
+            # Fortran compiler.
+            if ($line =~ /\bgfortran\b/) {
+                $fortran = 1;
+            }
         }
 
         # This flags is not always available, but if it is use it.
@@ -1022,7 +1051,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.18.15
+        # The following was partially copied from dpkg-dev 1.18.24
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_hardening_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Kees Cook
         # <kees@debian.org>, Canonical, Ltd. licensed under GPL version 2 or
@@ -1038,6 +1067,11 @@ foreach my $file (@ARGV) {
             (undef, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
         }
 
+        my %builtin_pie_arch = map { $_ => 1 } qw(
+            amd64 arm64 armel armhf i386 kfreebsd-amd64 kfreebsd-i386
+            mips mipsel mips64el ppc64el s390x sparc sparc64
+        );
+
         # Disable unsupported hardening options.
         if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/
                 or $cpu =~ /^(?:hppa|avr32)$/) {
@@ -1051,6 +1085,10 @@ foreach my $file (@ARGV) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
+
+        if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
+            $harden_pie = 0;
+        }
     }
 
     # Default values.
@@ -1087,14 +1125,13 @@ foreach my $file (@ARGV) {
         @ldflags = (@ldflags, @def_ldflags_bindnow);
     }
 
-    # Stores normal CFLAGS when @cflags_ada are temporarily used.
-    my @cflags_backup;
-    # Ada CFLAGS, only set if ada is used.
-    my @cflags_ada;
     # Ada doesn't support format hardening flags, see #680117 for more
-    # information. Filter them out if ada is used.
-    if ($ada and $harden_format) {
-        @cflags_ada = grep {
+    # information. Same for fortran. Filter them out if either language is
+    # used.
+    my @cflags_backup;
+    my @cflags_noformat;
+    if (($ada or $fortran) and $harden_format) {
+        @cflags_noformat = grep {
             my $ok = 1;
             foreach my $flag (@def_cflags_format) {
                 $ok = 0 if $_ eq $flag;
@@ -1236,7 +1273,7 @@ LINE:
         }
 
         my $compile_cpp = 0;
-        my $compile_ada = 0;
+        my $restore_cflags = 0;
         # Assume CXXFLAGS are required when a C++ file is specified in the
         # compiler line.
         if ($compile
@@ -1246,10 +1283,16 @@ LINE:
         # Ada needs special CFLAGS, use them if only ada files are compiled.
         } elsif ($ada
                 and extension_found(\%extensions_ada, @extensions)) {
-            $compile_ada = 1;
+            $restore_cflags = 1;
             $preprocess = 0; # Ada uses no CPPFLAGS
             @cflags_backup = @cflags;
-            @cflags        = @cflags_ada;
+            @cflags        = @cflags_noformat;
+        # Same for fortran.
+        } elsif ($fortran
+                and extension_found(\%extensions_fortran, @extensions)) {
+            $restore_cflags = 1;
+            @cflags_backup = @cflags;
+            @cflags        = @cflags_noformat;
         }
 
         if ($option_buildd) {
@@ -1324,7 +1367,7 @@ LINE:
         }
 
         # Restore normal CFLAGS.
-        if ($compile_ada) {
+        if ($restore_cflags) {
             @cflags = @cflags_backup;
         }
     }