# Build log hardening check, checks build logs for missing hardening flags.
-# Copyright (C) 2012-2023 Simon Ruderich
+# Copyright (C) 2012-2024 Simon Ruderich
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
use Getopt::Long ();
use Text::ParseWords ();
-our $VERSION = '0.13';
+our $VERSION = '0.14';
# CONSTANTS/VARIABLES
my $cc_regex_normal = qr/
\b$cc_regex(?:\s|\\)
/x;
+my $rustc_regex = qr/
+ \brustc\b
+ /x;
# Regex to catch (GCC) compiler warnings.
my $warning_regex = qr/^(.+?):(\d+):\d+: warning: (.+?) \[(.+?)\]$/;
# Regex to catch libtool commands and not lines which show commands executed
# Expected (hardening) flags. All flags are used as regexps (and compiled to
# real regexps below for better execution speed).
my @def_cflags = (
- '-g',
+ '-g3?',
'-O(?:2|3)', # keep at index 1, search for @def_cflags_debug to change it
);
my @def_cflags_debug = (
'-fno-stack-protector-all',
'-fno-stack-protector-strong',
);
+my @def_cflags_stack_clash = (
+ '-fstack-clash-protection',
+);
my @def_cflags_pie = (
'-fPIE',
);
+my @def_cflags_branch_amd64 = (
+ '-fcf-protection',
+);
+my @def_cflags_branch_arm64 = (
+ '-mbranch-protection=standard',
+);
my @def_cxxflags = (
@def_cflags,
);
\@def_cflags_stack,
\@def_cflags_stack_strong,
\@def_cflags_stack_bad,
+ \@def_cflags_stack_clash,
\@def_cflags_pie,
+ \@def_cflags_branch_amd64,
+ \@def_cflags_branch_arm64,
\@def_cxxflags,
\@def_cppflags,
\@def_cppflags_fortify,
# Renaming rules for the output so the regex parts are not visible. Also
# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
+ '-g3?' => '-g',
'-O(?:2|3)' => '-O2',
'-Wformat(?:=2)?' => '-Wformat',
'--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
}
sub is_non_verbose_build {
- my ($line, $skip_ref, $input_ref, $line_offset, $line_count) = @_;
+ my ($line, $cargo, $skip_ref, $input_ref, $line_offset, $line_count) = @_;
if ($line =~ /$libtool_regex/o) {
# libtool's --silent hides the real compiler flags.
# C++ compiler setting.
return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
return 0 if $line =~ /^\s*C\+\+ Library: stdc\+\+$/;
+ return 0 if $line =~ /^\s*CXX\s*:\s*g\+\+\s*$/;
# "Compiling" non binary files.
return 0 if $line =~ /^\s*Compiling \S+\.(?:py|pyx|el)['"]?\s*(?:\.\.\.|because it changed\.)?$/;
return 0 if $line =~ /^\s*[Cc]ompiling catalog \S+\.po\b/;
+ # cargo build
+ return 0 if $cargo and $line =~ m{^\s*Compiling\s+\S+\s+v\S+(?:\s+\(/(?:<<PKGBUILDDIR>>|builds/\S+)\))?$};
# "Compiling" with no file name.
if ($line =~ /^\s*[Cc]ompiling\s+(.+?)(?:\.\.\.)?$/) {
# $file_extension_regex may need spaces around the filename.
}
if ($option_version) {
print <<"EOF";
-blhc $VERSION Copyright (C) 2012-2023 Simon Ruderich
+blhc $VERSION Copyright (C) 2012-2024 Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
my $harden_fortify = 1;
my $harden_stack = 1;
my $harden_stack_strong = 1;
+ my $harden_stack_clash = 1;
+ my $harden_branch = 1;
my $harden_relro = 1;
my $harden_bindnow = $option_bindnow; # defaults to 0
my $harden_pie = $option_pie; # defaults to 0
$disable_harden_pie = 1;
}
+ # Ignore additional false positives if cargo/rust is used
+ my $cargo = 0;
+
my $number = 0;
while (my $line = <$fh>) {
$number++;
my $disable = 1;
my $disable_strong = 1;
+ my $disable_clash = 1;
+ my $disable_branch = 1;
if ($line =~ /\bdpkg-dev_(\S+)/) {
if (Dpkg::Version::version_compare($1, '1.16.1') >= 0) {
if (Dpkg::Version::version_compare($1, '1.18.15') >= 0) {
$disable_harden_pie = 1;
}
+ if (Dpkg::Version::version_compare($1, '1.22.0') >= 0) {
+ $disable_clash = 0;
+ $disable_branch = 0;
+ }
}
if ($disable) {
if ($disable_strong) {
$harden_stack_strong = 0;
}
+ if ($disable_clash) {
+ $harden_stack_clash = 0;
+ }
+ if ($disable_branch) {
+ $harden_branch = 0;
+ }
}
# The following two versions of CMake in Debian obeyed CPPFLAGS, but
}
next FILE;
}
+
+ if ($line =~ /\bcargo\b/) {
+ $cargo = 1;
+ }
}
# This flags is not always available, but if it is use it.
# Check if this line indicates a non verbose build.
my $skip = 0;
- $non_verbose |= is_non_verbose_build($line, \$skip);
+ $non_verbose |= is_non_verbose_build($line, $cargo, \$skip);
next if $skip;
# Treat each command as a single line so we don't ignore valid
# Embedded `gcc -print-*` commands
next if $line =~ /`$cc_regex_normal\s*[^`]*-print-\S+`/;
# cmake checking for compiler flags without setting CPPFLAGS
- next if $line =~ m{^\s*/usr/(bin|lib)/(ccache/)?c\+\+ -dM -E -c /usr/share/cmake-\S+/Modules/CMakeCXXCompilerABI\.cpp};
+ next if $line =~ m{^\s*/usr/(bin|lib)/(ccache/)?c\+\+ (?:-std=\S+ )?-dM -E -c /usr/share/cmake-\S+/Modules/CMakeCXXCompilerABI\.cpp};
+ # Some rustc lines look like linker commands
+ next if $cargo and $line =~ /$rustc_regex/o;
# Check if additional hardening options were used. Used to ensure
# they are used for the complete build.
}
if (scalar @input == 0) {
- if (not $option_buildd) {
- print "No compiler commands!\n";
- $exit |= $exit_code{no_compiler_commands};
- } else {
- print "$buildd_tag{no_compiler_commands}||\n";
+ if (not $cargo) {
+ if (not $option_buildd) {
+ print "No compiler commands!\n";
+ $exit |= $exit_code{no_compiler_commands};
+ } else {
+ print "$buildd_tag{no_compiler_commands}||\n";
+ }
}
next FILE;
}
}
# Option or auto detected.
+ my @harden_branch_flags;
if ($arch) {
# The following was partially copied from dpkg-dev 1.22.0
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, set_build_features and
i386
kfreebsd-amd64
kfreebsd-i386
+ loong64
mips
mips64
mips64el
);
# Disable unsupported hardening options.
- if ($os !~ /^(?:linux|kfreebsd|knetbsd|hurd)$/ or $cpu eq 'hppa') {
+ if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
+ $harden_pie = 0;
+ }
+ if ($os !~ /^(?:linux|kfreebsd|hurd)$/
+ or $cpu =~ /^(?:alpha|hppa|ia64)$/) {
$harden_pie = 0;
}
if ($cpu =~ /^(?:ia64|alpha|hppa|nios2)$/ or $arch eq 'arm') {
$harden_stack = 0;
$harden_stack_strong = 0;
}
+ if ($arch !~ /^(?:amd64|arm64|armhf|armel)$/) {
+ $harden_stack_clash = 0;
+ }
if ($cpu =~ /^(?:ia64|hppa)$/) {
$harden_relro = 0;
$harden_bindnow = 0;
}
-
- if ($disable_harden_pie and exists $builtin_pie_arch{$arch}) {
- $harden_pie = 0;
+ if ($cpu eq 'amd64') {
+ @harden_branch_flags = @def_cflags_branch_amd64;
+ } elsif ($cpu eq 'arm64') {
+ @harden_branch_flags = @def_cflags_branch_arm64;
}
}
@cflags = (@cflags, @def_cflags_stack);
@cxxflags = (@cxxflags, @def_cflags_stack);
}
+ if ($harden_stack_clash) {
+ @cflags = (@cflags, @def_cflags_stack_clash);
+ @cxxflags = (@cxxflags, @def_cflags_stack_clash);
+ }
if ($harden_fortify) {
@cflags = (@cflags, @def_cflags_fortify);
@cxxflags = (@cxxflags, @def_cflags_fortify);
@cflags = (@cflags, @def_cflags_format);
@cxxflags = (@cxxflags, @def_cflags_format);
}
+ if ($harden_branch and @harden_branch_flags) {
+ @cflags = (@cflags, @harden_branch_flags);
+ @cxxflags = (@cxxflags, @harden_branch_flags);
+ }
if ($harden_relro) {
@ldflags = (@ldflags, @def_ldflags_relro);
}
my $skip = 0;
if ($input_nonverbose[$i]
- and is_non_verbose_build($line, \$skip,
+ and is_non_verbose_build($line, $cargo, \$skip,
\@input, $i, $parallel)) {
if (not $option_buildd) {
error_non_verbose_build($line, $input_number[$i]);
=head1 LICENSE AND COPYRIGHT
-Copyright (C) 2012-2023 by Simon Ruderich
+Copyright (C) 2012-2024 by Simon Ruderich
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by