X-Git-Url: https://ruderich.org/simon/gitweb/?p=blhc%2Fblhc.git;a=blobdiff_plain;f=bin%2Fblhc;h=f9455868e6996e59c45f50825110ec1f11119cbd;hp=d2e5df761c09e45e5943cc7ba328cd8f34f3746f;hb=a7795c35f46dfbff0e3a832a48ff288107fcc81d;hpb=ea4a36f6673fe09075554d52d327149469d427a7 diff --git a/bin/blhc b/bin/blhc index d2e5df7..f945586 100755 --- a/bin/blhc +++ b/bin/blhc @@ -30,14 +30,16 @@ our $VERSION = '0.01'; # CONSTANTS/VARIABLES # Regex to catch compiler commands. -my $cc_regex = qr/(?:x86_64-linux-gnu-)?(?:(? '-O2', '-Wl,(-z,)?relro' => '-Wl,-z,relro', '-Wl,(-z,)?now' => '-Wl,-z,now', ); @@ -116,7 +119,7 @@ sub any_flags_used { my ($line, @flags) = @_; foreach my $flag (@flags) { - return 1 if $line =~ /\s$flag(?:\s|\\|$)/; + return 1 if $line =~ /\s$flag(?:\s|\\)/; } return 0; @@ -126,14 +129,12 @@ sub all_flags_used { my @missing_flags = (); foreach my $flag (@flags) { - if ($line !~ /\s$flag(?:\s|\\|$)/) { + if ($line !~ /\s$flag(?:\s|\\)/) { push @missing_flags, $flag; } } - if (scalar @missing_flags == 0) { - return 1; - } + return 1 if scalar @missing_flags == 0; @{$missing_flags_ref} = @missing_flags; return 0; @@ -165,7 +166,7 @@ sub is_non_verbose_build { my ($line, $next_line, $skip_ref) = @_; if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/ - or $line =~ /^\s*(?:CC|CCLD)\s+(.+?)$/ + or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD)\]?\s+(.+?)$/ or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/ or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/ or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) { @@ -216,6 +217,7 @@ my $option_help = 0; my $option_version = 0; my $option_all = 0; my $option_arch = undef; +my $option_buildd = 0; if (not Getopt::Long::GetOptions( 'help|h|?' => \$option_help, 'version' => \$option_version, @@ -225,6 +227,7 @@ if (not Getopt::Long::GetOptions( 'all' => \$option_all, # Misc. 'arch' => \$option_arch, + 'buildd' => \$option_buildd, )) { require Pod::Usage; Pod::Usage::pod2usage(2); @@ -265,9 +268,30 @@ my @input = (); my $start = 0; my $continuation = 0; +my $complete_line = undef; while (my $line = <>) { - # We skip over unimportant lines at the beginning to prevent false - # positives. + # dpkg-buildflags only provides hardening flags since 1.16.1, don't check + # for hardening flags in buildd mode if an older dpkg-dev is used. Default + # flags (-g -O2) are still checked. + # + # Packages which were built before 1.16.1 but used their own hardening + # flags are not checked. + if ($option_buildd and not $start + and $line =~ /^Toolchain package versions: /) { + require Dpkg::Version; + if ($line !~ /dpkg-dev_(\S+)/ + or Dpkg::Version::version_compare($1, '1.16.1') < 0) { + $harden_format = 0; + $harden_fortify = 0; + $harden_stack = 0; + $harden_relro = 0; + $harden_bindnow = 0; + $harden_pie = 0; + } + } + + # We skip over unimportant lines at the beginning of the log to prevent + # false positives. $start = 1 if $line =~ /^dpkg-buildpackage:/; next if not $start; @@ -280,6 +304,16 @@ while (my $line = <>) { # Ignore compiler warnings for now. next if $line =~ /$warning_regex/; + # Remove all ANSI color sequences which are sometimes used in non-verbose + # builds. + $line = Term::ANSIColor::colorstrip($line); + # Also strip '\0xf' (delete previous character), used by Elinks' build + # system. + $line =~ s/\x0f//g; + # And "ESC(B" which seems to be used on armhf and hurd (not sure what it + # does). + $line =~ s/\033\(B//g; + # Check if this line indicates a non verbose build. my $non_verbose = is_non_verbose_build($line); @@ -296,10 +330,26 @@ while (my $line = <>) { # Join lines, but leave the "\" in place so it's clear where the # original line break was. - chomp $input[-1]; - $input[-1] .= ' ' . $line; + chomp $complete_line; + $complete_line .= ' ' . $line; + } + # Line continuation, line ends with "\". + if ($line =~ /\\\s*$/) { + $continuation = 1; + # Start line continuation. + if (not defined $complete_line) { + $complete_line = $line; + } + next; + } + + if (not $continuation) { + # Use the complete line if a line continuation occurred. + if (defined $complete_line) { + $line = $complete_line; + $complete_line = undef; + } - } else { # Ignore lines with no compiler commands. next if $line !~ /\b$cc_regex(?:\s|\\)/ and not $non_verbose; @@ -307,13 +357,20 @@ while (my $line = <>) { # # `./configure` output. next if not $non_verbose and $line =~ /^checking /; + next if $line =~ /^\s*(?:C\s+)? + (?:C|c)ompiler[\s.]*:\s+ + $cc_regex + (?:\s-std=[a-z0-9:+]+)?\s*$ + /x + or $line =~ /^\s*(?:- )?(?:CC|CXX)\s*=\s*$cc_regex\s*$/ + or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: / + or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/; + # Debian buildd output. + next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/ + and $line !~ /\s-./; # option, prevent false negatives - push @input, $line; - } - # Line continuation, line ends with "\". - if ($line =~ /\\\s*$/) { - $continuation = 1; + push @input, $line; } } } @@ -386,12 +443,6 @@ for (my $i = 0; $i < scalar @input; $i++) { # Even if it's a verbose build, we might have to skip this line. next if $skip; - # Ignore false positives. - # - # ./configure summary. - next if $line =~ /^\s*(?:C|c)ompiler[\s.]*:\s+$cc_regex(?:\s-std=[a-z0-9:+]+)?\s*$/ - or $line =~ /^\s*- (?:CC|CXX)\s*=\s*$cc_regex\s*$/ - or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /; # Is this a compiler or linker command? my $compiler = 1; @@ -403,7 +454,8 @@ for (my $i = 0; $i < scalar @input; $i++) { (?:[/.A-Za-z0-9~_-]+/)? # path to file [A-Za-z0-9~_-]+ # binary name (no dots!) (?:[0-9.]*\.so[0-9.]*[a-z]? # library (including version) - |\.la)? + |\.la + |\.cgi)? # CGI binary (?:\s|\\|$) # end of file name }x or $line =~ /^libtool: link: / @@ -460,6 +512,7 @@ B [--pie] [--bindnow] [--all] --bindnow force +bindbow check --all force +all (+pie, +bindnow) check --arch set architecture (autodetected) + --buildd parser mode for buildds =head1 DESCRIPTION @@ -497,10 +550,25 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically disables hardening flags not available on this architecture. Is detected automatically if dpkg-buildpackage is used. +=item B<--buildd> + +Special mode for buildds when automatically parsing log files. The following +changes are in effect: + +=over 2 + +=item + +Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is +detected). + +=back + =back -Auto detection only works if at least one command uses the required hardening -flag (e.g. -fPIE). Then it's required for all other commands as well. +Auto detection for B<--pie> and B<--bindnow> only works if at least one +command uses the required hardening flag (e.g. -fPIE). Then it's required for +all other commands as well. =head1 EXIT STATUS