# CONSTANTS/VARIABLES
# Regex to catch compiler commands.
-my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux|kfreebsd)-gnu(?:eabi|eabihf)?-)?
- (?:(?<!\.)cc|gcc|g\+\+|c\+\+)
+my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
+ (?<!\.)(?:cc|gcc|g\+\+|c\+\+)
(?:-[\d.]+)?/x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
'-Wl,(-z,)?now' => '-Wl,-z,now',
);
+# Use colored (ANSI) output?
+my $option_color;
+
# FUNCTIONS
error_color(':', 'yellow'),
$line;
}
+sub error_hardening_wrapper {
+ printf "%s%s %s\n",
+ error_color('HARDENING WRAPPER', 'red'),
+ error_color(':', 'yellow'),
+ 'no checks possible, aborting';
+}
sub error_color {
my ($message, $color) = @_;
- # Use colors when writing to a terminal.
- if (-t STDOUT) {
+ if ($option_color) {
return Term::ANSIColor::colored($message, $color);
} else {
return $message;
my $option_all = 0;
my $option_arch = undef;
my $option_buildd = 0;
+ $option_color = 0;
if (not Getopt::Long::GetOptions(
'help|h|?' => \$option_help,
'version' => \$option_version,
'bindnow' => \$harden_bindnow,
'all' => \$option_all,
# Misc.
+ 'color' => \$option_color,
'arch' => \$option_arch,
'buildd' => \$option_buildd,
)) {
}
}
+ # If hardening wrapper is used (wraps calls to gcc and adds hardening
+ # flags automatically) we can't perform any checks, abort.
+ if (not $start and $line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
+ error_hardening_wrapper();
+ $exit |= 1 << 4;
+ exit $exit;
+ }
+
# We skip over unimportant lines at the beginning of the log to prevent
# false positives.
$start = 1 if $line =~ /^dpkg-buildpackage:/;
next if not $start;
+ # And stop at the end of the build log. Package details (reported by the
+ # buildd logs) are not important for us. This also prevents false
+ # positives.
+ last if $line =~ /^Build finished at \d{8}-\d{4}$/;
# Detect architecture automatically unless overridden.
if (not $option_arch
# Ignore false positives.
#
# `./configure` output.
- next if not $non_verbose and $line =~ /^checking /;
+ next if not $non_verbose
+ and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
(?:C|c)ompiler[\s.]*:?\s+
$cc_regex
or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex\s*$/
or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # Debian buildd output.
- next if $line =~ /^\s*Depends: .*?$cc_regex.*?$/
- and $line !~ /\s-./; # option, prevent false negatives
+ # Check if additional hardening options were used. Used to ensure
+ # they are used for the complete build.
+ $harden_pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie);
+ $harden_bindnow = 1 if any_flags_used($line, @ldflags_bindnow);
push @input, $line;
}
}
}
-# Check if additional hardening options were used. Used to ensure they are
-# used for the complete build.
-foreach my $line (@input) {
- $harden_pie = 1 if any_flags_used($line, @cflags_pie, @ldflags_pie);
- $harden_bindnow = 1 if any_flags_used($line, @ldflags_bindnow);
-}
-
# Check the specified hardening options, same order as dpkg-buildflags.
if ($harden_pie) {
@cflags = (@cflags, @cflags_pie);
--all force +all (+pie, +bindnow) check
--arch set architecture (autodetected)
--buildd parser mode for buildds
+ --color use colored output
=head1 DESCRIPTION
=back
+=item B<--color>
+
+Use colored (ANSI) output for warning messages.
+
=back
Auto detection for B<--pie> and B<--bindnow> only works if at least one
Missing hardening flags.
+=item B<16>
+
+Hardening wrapper detected, no tests performed.
+
=back
=head1 AUTHOR