X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=d2a8771515e5e01d8a3890db542cb7cf08244f21;hp=af644d3597621d2ad04de3bac77f7d78be1b01a7;hb=7d9ae6314e499d9e76bc32a0e1c4a5686bb59158;hpb=0f1a49d52e94c258e444548c34903d27346d8a52

diff --git a/bin/blhc b/bin/blhc
index af644d3..d2a8771 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2013  Simon Ruderich
+# Copyright (C) 2012-2015  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,7 +24,7 @@ use warnings;
 use Getopt::Long ();
 use Text::ParseWords ();
 
-our $VERSION = '0.04';
+our $VERSION = '0.05';
 
 
 # CONSTANTS/VARIABLES
@@ -201,6 +201,9 @@ my @def_cflags_stack = (
     '-fstack-protector',
     '--param[= ]ssp-buffer-size=4',
 );
+my @def_cflags_stack_strong = (
+    '-fstack-protector-strong',
+);
 my @def_cflags_pie = (
     '-fPIE',
 );
@@ -211,7 +214,8 @@ my @def_cxxflags = (
 my @def_cppflags = ();
 my @def_cppflags_fortify = (
     '-D_FORTIFY_SOURCE=2', # must be first, see cppflags_fortify_broken()
-    # If you add another flag fix hack below (search for "Hack to fix").
+    # If you add another flag fix hack below (search for "Hack to fix") and
+    # $def_cppflags_fortify[0].
 );
 my @def_cppflags_fortify_bad = (
     # These flags may overwrite -D_FORTIFY_SOURCE=2.
@@ -241,6 +245,7 @@ my @flag_refs = (
     \@def_cflags_format,
     \@def_cflags_fortify,
     \@def_cflags_stack,
+    \@def_cflags_stack_strong,
     \@def_cflags_pie,
     \@def_cxxflags,
     \@def_cppflags,
@@ -596,7 +601,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2013  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2015  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -699,6 +704,7 @@ foreach my $file (@ARGV) {
     my $harden_format  = 1;
     my $harden_fortify = 1;
     my $harden_stack   = 1;
+    my $harden_stack_strong = 1;
     my $harden_relro   = 1;
     my $harden_bindnow = $option_bindnow; # defaults to 0
     my $harden_pie     = $option_pie;     # defaults to 0
@@ -728,11 +734,25 @@ foreach my $file (@ARGV) {
         #
         # Packages which were built before 1.16.1 but used their own hardening
         # flags are not checked.
+        #
+        # Strong stack protector is used since dpkg 1.17.11.
         if ($option_buildd
                 and index($line, 'Toolchain package versions: ') == 0) {
             require Dpkg::Version;
-            if (not $line =~ /\bdpkg-dev_(\S+)/
-                    or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
+
+            my $disable = 1;
+            my $disable_strong = 1;
+
+            if ($line =~ /\bdpkg-dev_(\S+)/) {
+                if (Dpkg::Version::version_compare($1, '1.16.1') >= 0) {
+                    $disable = 0;
+                }
+                if (Dpkg::Version::version_compare($1, '1.17.11') >= 0) {
+                    $disable_strong = 0;
+                }
+            }
+
+            if ($disable) {
                 $harden_format  = 0;
                 $harden_fortify = 0;
                 $harden_stack   = 0;
@@ -740,6 +760,9 @@ foreach my $file (@ARGV) {
                 $harden_bindnow = 0;
                 $harden_pie     = 0;
             }
+            if ($disable_strong) {
+                $harden_stack_strong = 0;
+            }
         }
 
         # The following two versions of CMake in Debian obeyed CPPFLAGS, but
@@ -969,12 +992,12 @@ foreach my $file (@ARGV) {
         my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
 
         # Disable unsupported hardening options.
-        if ($os !~ /^(?:linux|knetbsd|hurd)$/ or
-                $cpu =~ /^(?:hppa|mips|mipsel|avr32)$/) {
+        if ($os !~ /^(?:linux|knetbsd|hurd)$/ or $cpu =~ /^(?:hppa|avr32)$/) {
             $harden_pie = 0;
         }
-        if ($cpu =~ /^(?:ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
+        if ($cpu =~ /^(?:ia64|alpha|hppa)$/ or $arch eq 'arm') {
             $harden_stack = 0;
+            $harden_stack_strong = 0;
         }
         if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
             $harden_relro   = 0;
@@ -993,7 +1016,10 @@ foreach my $file (@ARGV) {
         @cxxflags = (@cxxflags, @def_cflags_pie);
         @ldflags  = (@ldflags,  @def_ldflags_pie);
     }
-    if ($harden_stack) {
+    if ($harden_stack_strong) {
+        @cflags   = (@cflags,   @def_cflags_stack_strong);
+        @cxxflags = (@cxxflags, @def_cflags_stack_strong);
+    } elsif ($harden_stack) {
         @cflags   = (@cflags,   @def_cflags_stack);
         @cxxflags = (@cxxflags, @def_cflags_stack);
     }
@@ -1184,6 +1210,7 @@ LINE:
         # for a debug build.
         if (any_flags_used($line, @def_cflags_debug)) {
             remove_flags([\@cflags], \%flag_renames, $def_cflags[1]);
+            remove_flags([\@cppflags], \%flag_renames, $def_cppflags_fortify[0]);
         }
 
         # Check hardening flags.
@@ -1545,7 +1572,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2013 by Simon Ruderich
+Copyright (C) 2012-2015 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by