# @def_cxxflags_* is the same as @def_cflags_*.
my @def_cppflags = ();
my @def_cppflags_fortify = (
- '-D_FORTIFY_SOURCE=2',
+ '-D_FORTIFY_SOURCE=2', # must be first, see cppflags_fortify_broken()
+);
+my @def_cppflags_fortify_bad = (
+ # These flags may overwrite -D_FORTIFY_SOURCE=2.
+ '-D_FORTIFY_SOURCE=0',
+ '-D_FORTIFY_SOURCE=1',
);
my @def_ldflags = ();
my @def_ldflags_relro = (
# References to all used flags.
my @flag_refs_all = (
@flag_refs,
+ \@def_cppflags_fortify_bad,
\@def_ldflags_pic,
);
# Renaming rules for the output so the regex parts are not visible. Also
return 0;
}
+sub cppflags_fortify_broken {
+ my ($line, $missing_flags) = @_;
+
+ # This doesn't take the position into account, but is a simple solution.
+ # And if the build system tries to force -D_FORTIFY_SOURCE=0/1, something
+ # is wrong anyway.
+
+ if (any_flags_used($line, @def_cppflags_fortify_bad)) {
+ # $def_cppflags_fortify[0] must be -D_FORTIFY_SOURCE=2!
+ push @{$missing_flags}, $def_cppflags_fortify[0];
+ return 1;
+ }
+
+ return 0;
+}
+
# Modifies $missing_flags_ref array.
sub pic_pie_conflict {
my ($line, $pie, $missing_flags_ref, @flags_pie) = @_;
[Cc]ompiler[\s.]*:?\s+
/xo;
next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
+ # `moc-qt4`, contains '-I/usr/share/qt4/mkspecs/linux-g++' (or
+ # similar for other architectures) which gets recognized as a
+ # compiler line. Ignore it.
+ next if $line =~ m{^/usr/bin/moc-qt4
+ \s.+\s
+ -I/usr/share/qt4/mkspecs/[a-z]+-g\++(?:-64)?
+ \s}x;
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
- $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie);
+ $harden_pie = 1 if any_flags_used($line, @def_cflags_pie,
+ @def_ldflags_pie);
$harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow);
push @input, $line;
}
$exit |= $exit_code{flags_missing};
}
- if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
+ if ($preprocess
+ and (not all_flags_used($line, \@missing, @cppflags)
+ # The fortify flag might be overwritten, detect that.
+ or ($harden_fortify
+ and cppflags_fortify_broken($line, \@missing)))
# Assume dpkg-buildflags returns the correct flags.
and index($line, '`dpkg-buildflags --get CPPFLAGS`') == -1) {
if (not $option_buildd) {
tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
to help maintainers detect missing hardening flags in their packages.
+If there's no output, no flags are missing and the build log is fine.
+
=head1 OPTIONS
=over 8
blhc path/to/log/file
+If there's no output, no flags are missing and the build log is fine.
+
Parse multiple log files. The exit code is ORed over all files.
blhc path/to/directory/with/log/files/*