X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;ds=sidebyside;f=bin%2Fblhc;h=49640dd5eb379c70d1fce2d22c47751582a47be7;hb=758fd27d99baec2f20e7ab4291e4aaa998ba338c;hp=b4d87e45eb9dc856e574906e4958afc04f4317d5;hpb=bbdf77da3205abbc957d6b720e01f6d390db46dc;p=blhc%2Fblhc.git
diff --git a/bin/blhc b/bin/blhc
index b4d87e4..49640dd 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -22,7 +22,6 @@ use strict;
use warnings;
use Getopt::Long ();
-use Term::ANSIColor ();
use Text::ParseWords ();
our $VERSION = '0.01';
@@ -49,7 +48,7 @@ my @source_preprocess_compile_cpp = (
# C++
qw( cc cp cxx cpp CPP c++ C ),
# Objective-C++
- qw( mm Mr),
+ qw( mm M ),
);
my @source_preprocess_compile = (
# C
@@ -63,7 +62,7 @@ my @source_preprocess_compile = (
);
my @source_preprocess_no_compile = (
# Assembly
- qw( s ),
+ qw( S sx ),
);
my @source_preprocess = (
@source_preprocess_compile,
@@ -88,7 +87,7 @@ my @source_no_preprocess_compile = (
);
my @source_no_preprocess_no_compile = (
# Assembly
- qw( S sx ),
+ qw( s ),
);
my @source_no_preprocess = (
@source_no_preprocess_compile,
@@ -129,26 +128,20 @@ my %extensions_compile_cpp = map { $_ => 1 } (
);
my %extension = map { $_ => 1 } (
@source_no_preprocess,
- @source_no_preprocess_compile,
- @source_no_preprocess_compile_cpp,
- @source_no_preprocess_no_compile,
@header_preprocess,
@source_preprocess,
- @source_preprocess_compile,
- @source_preprocess_compile_cpp,
- @source_preprocess_no_compile,
);
# Regexp to match file extensions.
my $file_extension_regex = qr/
\s
- \S+ # Filename without extension.
+ \S+ # Filename without extension.
\.
- ([^\\.\s]+) # File extension.
- (?=\s|\\) # At end of word. Can't use \b because some files have non
- # word characters at the end and because \b matches double
- # extensions (like .cpp.o). Works always as all lines are
- # terminated with "\n".
+ ([^\/\\.,;:\s]+)# File extension.
+ (?=\s|\\) # At end of word. Can't use \b because some files have non
+ # word characters at the end and because \b matches double
+ # extensions (like .cpp.o). Works always as all lines are
+ # terminated with "\n".
/x;
# Expected (hardening) flags. All flags are used as regexps.
@@ -181,10 +174,10 @@ my @def_cppflags_fortify = (
);
my @def_ldflags = ();
my @def_ldflags_relro = (
- '-Wl,(-z,)?relro',
+ '-Wl,(?:-z,)?relro',
);
my @def_ldflags_bindnow = (
- '-Wl,(-z,)?now',
+ '-Wl,(?:-z,)?now',
);
my @def_ldflags_pie = (
'-fPIE',
@@ -195,12 +188,41 @@ my @def_ldflags_pic = (
'-fpic',
'-shared',
);
+# References to all flags checked by the parser.
+my @flag_refs = (
+ \@def_cflags,
+ \@def_cflags_format,
+ \@def_cflags_fortify,
+ \@def_cflags_stack,
+ \@def_cflags_pie,
+ \@def_cxxflags,
+ \@def_cppflags,
+ \@def_cppflags_fortify,
+ \@def_ldflags,
+ \@def_ldflags_relro,
+ \@def_ldflags_bindnow,
+);
+# References to all used flags.
+my @flag_refs_all = (
+ @flag_refs,
+ \@def_ldflags_pie,
+ \@def_ldflags_pic,
+);
# Renaming rules for the output so the regex parts are not visible. Also
# stores string values of flag regexps above, see compile_flag_regexp().
my %flag_renames = (
- '-O(?:2|3)' => '-O2',
- '-Wl,(-z,)?relro' => '-Wl,-z,relro',
- '-Wl,(-z,)?now' => '-Wl,-z,now',
+ '-O(?:2|3)' => '-O2',
+ '-Wl,(?:-z,)?relro' => '-Wl,-z,relro',
+ '-Wl,(?:-z,)?now' => '-Wl,-z,now',
+);
+
+my %exit_code = (
+ no_compiler_commands => 1 << 0,
+ # used by POD::Usage => 1 << 1,
+ non_verbose_build => 1 << 2,
+ flags_missing => 1 << 3,
+ hardening_wrapper => 1 << 4,
+ invalid_cmake => 1 << 5,
);
# Statistics of missing flags and non-verbose build commands. Used for
@@ -245,6 +267,14 @@ sub error_non_verbose_build {
error_color(':', 'yellow'),
$line;
}
+sub error_invalid_cmake {
+ my ($version) = @_;
+
+ printf "%s%s %s\n",
+ error_color('INVALID CMAKE', 'red'),
+ error_color(':', 'yellow'),
+ $version;
+}
sub error_hardening_wrapper {
printf "%s%s %s\n",
error_color('HARDENING WRAPPER', 'red'),
@@ -312,13 +342,23 @@ sub is_non_verbose_build {
my ($line, $next_line, $skip_ref) = @_;
if (not ($line =~ /^checking if you want to see long compiling messages\.\.\. no/
- or $line =~ /^\s*\[?(?:CC|CCLD|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
+ or $line =~ /^\s*\[?(?:CC|CCLD|C\+\+|CXX|CXXLD|LD|LINK)\]?\s+(.+?)$/
or $line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/
or $line =~ /^\s*(?:B|b)uilding (?:program|shared library)\s+(.+?)$/
or $line =~ /^\s*\[[\d ]+%\] Building (?:C|CXX) object (.+?)$/)) {
return 0;
}
+ # False positives.
+ #
+ # C++ compiler setting.
+ return 0 if $line =~ /^\s*C\+\+.+?:\s+(?:yes|no)\s*$/;
+ # "Compiling" with no file name.
+ if ($line =~ /^\s*(?:C|c)ompiling\s+(.+?)(?:\.\.\.)?$/) {
+ # $file_extension_regex may need spaces around the filename.
+ return 0 if not " $1 " =~ /$file_extension_regex/o;
+ }
+
my $file = $1;
# On the first pass we only check if this line is verbose or not.
@@ -382,26 +422,32 @@ sub extension_found {
# MAIN
# Parse command line arguments.
-my $option_help = 0;
-my $option_version = 0;
-my $option_pie = 0;
-my $option_bindnow = 0;
-my $option_all = 0;
-my $option_arch = undef;
-my $option_buildd = 0;
- $option_color = 0;
+my $option_help = 0;
+my $option_version = 0;
+my $option_pie = 0;
+my $option_bindnow = 0;
+my @option_ignore_flag = ();
+my @option_ignore_line = ();
+my $option_all = 0;
+my $option_arch = undef;
+my $option_buildd = 0;
+ $option_color = 0;
if (not Getopt::Long::GetOptions(
- 'help|h|?' => \$option_help,
- 'version' => \$option_version,
+ 'help|h|?' => \$option_help,
+ 'version' => \$option_version,
# Hardening options.
- 'pie' => \$option_pie,
- 'bindnow' => \$option_bindnow,
- 'all' => \$option_all,
+ 'pie' => \$option_pie,
+ 'bindnow' => \$option_bindnow,
+ 'all' => \$option_all,
+ # Ignore.
+ 'ignore-flag=s' => \@option_ignore_flag,
+ 'ignore-line=s' => \@option_ignore_line,
# Misc.
- 'color' => \$option_color,
- 'arch=s' => \$option_arch,
- 'buildd' => \$option_buildd,
- )) {
+ 'color' => \$option_color,
+ 'arch=s' => \$option_arch,
+ 'buildd' => \$option_buildd,
+ )
+ or scalar @ARGV == 0) {
require Pod::Usage;
Pod::Usage::pod2usage(2);
}
@@ -428,33 +474,54 @@ along with this program. If not, see .
exit 0;
}
+# Don't load Term::ANSIColor in buildd mode because Term::ANSIColor is not
+# installed on Debian's buildds.
+if (not $option_buildd) {
+ require Term::ANSIColor;
+}
+
if ($option_all) {
$option_pie = 1;
$option_bindnow = 1;
}
+# Strip flags which should be ignored.
+if (scalar @option_ignore_flag > 0) {
+ my %ignores = map { $_ => 1 } @option_ignore_flag;
+ foreach my $flags (@flag_refs) {
+ @{$flags} = grep {
+ # Flag found as string.
+ not exists $ignores{$_}
+ # Flag found as string representation of regexp.
+ and (not defined $flag_renames{$_}
+ or not exists $ignores{$flag_renames{$_}})
+ } @{$flags};
+ }
+}
+
# Precompile all flag regexps. any_flags_used(), all_flags_used() get a lot
# faster with this.
-@def_cflags = compile_flag_regexp(\%flag_renames, @def_cflags);
-@def_cflags_format = compile_flag_regexp(\%flag_renames, @def_cflags_format);
-@def_cflags_fortify = compile_flag_regexp(\%flag_renames, @def_cflags_fortify);
-@def_cflags_stack = compile_flag_regexp(\%flag_renames, @def_cflags_stack);
-@def_cflags_pie = compile_flag_regexp(\%flag_renames, @def_cflags_pie);
-@def_cxxflags = compile_flag_regexp(\%flag_renames, @def_cxxflags);
-@def_cppflags = compile_flag_regexp(\%flag_renames, @def_cppflags);
-@def_cppflags_fortify = compile_flag_regexp(\%flag_renames, @def_cppflags_fortify);
-@def_ldflags = compile_flag_regexp(\%flag_renames, @def_ldflags);
-@def_ldflags_relro = compile_flag_regexp(\%flag_renames, @def_ldflags_relro);
-@def_ldflags_bindnow = compile_flag_regexp(\%flag_renames, @def_ldflags_bindnow);
-@def_ldflags_pie = compile_flag_regexp(\%flag_renames, @def_ldflags_pie);
-@def_ldflags_pic = compile_flag_regexp(\%flag_renames, @def_ldflags_pic);
+foreach my $flags (@flag_refs_all) {
+ @{$flags} = compile_flag_regexp(\%flag_renames, @{$flags});
+}
+
+# Precompile ignore line regexps, also anchor at beginning and end of line.
+foreach my $ignore (@option_ignore_line) {
+ $ignore = qr/^$ignore$/;
+}
# Final exit code.
my $exit = 0;
-FILE: foreach my $file (@ARGV) {
+FILE:
+foreach my $file (@ARGV) {
+ print "checking '$file'...\n" if scalar @ARGV > 1;
+
open my $fh, '<', $file or die "$!: $file";
+ # Architecture of this file.
+ my $arch = $option_arch;
+
# Hardening options. Not all architectures support all hardening options.
my $harden_format = 1;
my $harden_fortify = 1;
@@ -472,7 +539,7 @@ FILE: foreach my $file (@ARGV) {
# flags are not checked.
if ($option_buildd and $line =~ /^Toolchain package versions: /) {
require Dpkg::Version;
- if ($line !~ /dpkg-dev_(\S+)/
+ if ($line !~ /\bdpkg-dev_(\S+)/
or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
$harden_format = 0;
$harden_fortify = 0;
@@ -483,6 +550,23 @@ FILE: foreach my $file (@ARGV) {
}
}
+ # The following two versions of CMake in Debian obeyed CPPFLAGS, but
+ # this was later dropped because upstream rejected the patch. Thus
+ # build logs with these versions will have fortify hardening flags
+ # enabled, even though they may be not correctly set and are missing
+ # when build with later CMake versions. Thanks to Aron Xu for letting
+ # me know.
+ if ($line =~ /^Package versions: /
+ and $line =~ /\bcmake_(\S+)/
+ and ($1 eq '2.8.7-1' or $1 eq '2.8.7-2')) {
+ if (not $option_buildd) {
+ error_invalid_cmake($1);
+ } else {
+ print "W-invalid-cmake-used $1\n";
+ }
+ $exit |= $exit_code{invalid_cmake};
+ }
+
# If hardening wrapper is used (wraps calls to gcc and adds hardening
# flags automatically) we can't perform any checks, abort.
if ($line =~ /^Build-Depends: .*\bhardening-wrapper\b/) {
@@ -491,7 +575,7 @@ FILE: foreach my $file (@ARGV) {
} else {
print "I-hardening-wrapper-used\n";
}
- $exit |= 1 << 4;
+ $exit |= $exit_code{hardening_wrapper};
next FILE;
}
@@ -512,15 +596,15 @@ FILE: foreach my $file (@ARGV) {
last if $line =~ /^Build finished at \d{8}-\d{4}$/;
# Detect architecture automatically unless overridden.
- if (not $option_arch
+ if (not $arch
and $line =~ /^dpkg-buildpackage: host architecture (.+)$/) {
- $option_arch = $1;
+ $arch = $1;
}
# Ignore compiler warnings for now.
next if $line =~ /$warning_regex/o;
- if ($line =~ /\033/) { # esc
+ if (not $option_buildd and $line =~ /\033/) { # esc
# Remove all ANSI color sequences which are sometimes used in
# non-verbose builds.
$line = Term::ANSIColor::colorstrip($line);
@@ -564,39 +648,38 @@ FILE: foreach my $file (@ARGV) {
next;
}
- if (not $continuation) {
- # Use the complete line if a line continuation occurred.
- if (defined $complete_line) {
- $line = $complete_line;
- $complete_line = undef;
- }
-
- # Ignore lines with no compiler commands.
- next if $line !~ /\b$cc_regex(?:\s|\\)/o and not $non_verbose;
-
- # Ignore false positives.
- #
- # `./configure` output.
- next if not $non_verbose
- and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
- next if $line =~ /^\s*(?:Host\s+)?(?:C\s+)?
- (?:C|c)ompiler[\s.]*:?\s+
- $cc_regex_full
- (?:\s-std=[a-z0-9:+]+)?\s*$
- /xo
- or $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o
- or $line =~ /^\s*-- Check for working (?:C|CXX) compiler: /
- or $line =~ /^\s*(?:echo )?Using [A-Z_]+\s*=\s*/;
- # `make` output.
- next if $line =~ /^Making [a-z]+ in \S+/; # e.g. "[...] in c++"
-
- # Check if additional hardening options were used. Used to
- # ensure they are used for the complete build.
- $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie);
- $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow);
-
- push @input, $line;
+ # Use the complete line if a line continuation occurred.
+ if (defined $complete_line) {
+ $line = $complete_line;
+ $complete_line = undef;
}
+
+ # Ignore lines with no compiler commands.
+ next if not $non_verbose
+ and not $line =~ /\b$cc_regex(?:\s|\\)/o;
+ # Ignore lines with no filenames with extensions. May miss some
+ # non-verbose builds (e.g. "gcc -o test" [sic!]), but shouldn't be
+ # a problem as the log will most likely contain other non-verbose
+ # commands which are detected.
+ next if not $non_verbose
+ and not $line =~ /$file_extension_regex/o;
+
+ # Ignore false positives.
+ #
+ # `./configure` output.
+ next if not $non_verbose
+ and $line =~ /^(?:checking|(?:C|c)onfigure:) /;
+ next if $line =~ /^\s*(?:Host\s+)?(?:C(?:\+\+)?\s+)?
+ (?:C|c)ompiler[\s.]*:?\s+
+ /xo;
+ next if $line =~ /^\s*(?:- )?(?:HOST_)?(?:CC|CXX)\s*=\s*$cc_regex_full\s*$/o;
+
+ # Check if additional hardening options were used. Used to ensure
+ # they are used for the complete build.
+ $harden_pie = 1 if any_flags_used($line, @def_cflags_pie, @def_ldflags_pie);
+ $harden_bindnow = 1 if any_flags_used($line, @def_ldflags_bindnow);
+
+ push @input, $line;
}
}
@@ -608,7 +691,7 @@ FILE: foreach my $file (@ARGV) {
} else {
print "W-no-compiler-commands\n";
}
- $exit |= 1;
+ $exit |= $exit_code{no_compiler_commands};
next FILE;
}
@@ -617,7 +700,7 @@ FILE: foreach my $file (@ARGV) {
}
# Option or auto detected.
- if ($option_arch) {
+ if ($arch) {
# The following was partially copied from dpkg-dev 1.16.1.2
# (/usr/share/perl5/Dpkg/Vendor/Debian.pm, add_hardening_flags()),
# copyright Raphaël Hertzog , Kees Cook
@@ -625,10 +708,10 @@ FILE: foreach my $file (@ARGV) {
# later. Keep it in sync.
require Dpkg::Arch;
- my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($option_arch);
+ my ($abi, $os, $cpu) = Dpkg::Arch::debarch_to_debtriplet($arch);
# Disable unsupported hardening options.
- if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $option_arch eq 'arm') {
+ if ($cpu =~ /^(ia64|alpha|mips|mipsel|hppa)$/ or $arch eq 'arm') {
$harden_stack = 0;
}
if ($cpu =~ /^(ia64|hppa|avr32)$/) {
@@ -668,9 +751,15 @@ FILE: foreach my $file (@ARGV) {
@ldflags = (@ldflags, @def_ldflags_bindnow);
}
+LINE:
for (my $i = 0; $i < scalar @input; $i++) {
my $line = $input[$i];
+ # Ignore line if requested.
+ foreach my $ignore (@option_ignore_line) {
+ next LINE if $line =~ /$ignore/;
+ }
+
my $skip = 0;
if (is_non_verbose_build($line, $input[$i + 1], \$skip)) {
if (not $option_buildd) {
@@ -678,7 +767,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{commands_nonverbose}++;
}
- $exit |= 1 << 2;
+ $exit |= $exit_code{non_verbose_build};
next;
}
# Even if it's a verbose build, we might have to skip this line.
@@ -694,6 +783,7 @@ FILE: foreach my $file (@ARGV) {
# Skip unnecessary tests when only preprocessing.
my $flag_preprocess = 0;
+ my $dependency = 0;
my $preprocess = 0;
my $compile = 0;
my $link = 0;
@@ -703,11 +793,25 @@ FILE: foreach my $file (@ARGV) {
$preprocess = 1;
$flag_preprocess = 1 if $1 eq '-E';
$compile = 1 if $1 eq '-S' or $1 eq '-c';
+ # Dependency generation for Makefiles. The other flags (-MF -MG -MP
+ # -MT -MQ) are always used with -M/-MM.
+ } elsif ($line =~ /\s(?:-M|-MM)\b/) {
+ $dependency = 1;
# Otherwise assume we are linking.
} else {
$link = 1;
}
+ # -MD/-MMD also cause dependency generation, but they don't imply -E!
+ if ($line =~ /\s(?:-MD|-MMD)\b/) {
+ $dependency = 0;
+ $flag_preprocess = 0;
+ }
+
+ # Dependency generation for Makefiles, no preprocessing or other flags
+ # needed.
+ next if $dependency;
+
# Get all file extensions on this line.
my @extensions = $line =~ /$file_extension_regex/go;
# Ignore all unknown extensions to speedup the search below.
@@ -767,7 +871,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{compile_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
} elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
# Libraries linked with -fPIC don't have to (and can't) be
# linked with -fPIE as well. It's no error if only PIE flags
@@ -780,7 +884,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{compile_cpp_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
# Assume dpkg-buildflags returns the correct flags.
@@ -790,7 +894,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{preprocess_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
if ($link and not all_flags_used($line, \@missing, @ldflags)
# Same here, -fPIC conflicts with -fPIE.
@@ -802,7 +906,7 @@ FILE: foreach my $file (@ARGV) {
} else {
$statistics{link_missing}++;
}
- $exit |= 1 << 3;
+ $exit |= $exit_code{flags_missing};
}
}
}
@@ -859,8 +963,12 @@ B [I] Idpkg-buildpackage build log fileE..>
=head1 DESCRIPTION
-blhc is a small tool which checks build logs for missing hardening flags and
-other important warnings. It's licensed under the GPL 3 or later.
+blhc is a small tool which checks build logs for missing hardening flags. It's
+licensed under the GPL 3 or later.
+
+It's designed to check build logs generated by Debian's dpkg-buildpackage (or
+tools using dpkg-buildpackage like pbuilder or the official buildd build logs)
+to help maintainers detect missing hardening flags in their packages.
=head1 OPTIONS
@@ -890,15 +998,41 @@ changes are in effect:
=item
+Print tags instead of normal warnings, see L"BUILDD TAGS"> for a list of
+possible tags.
+
+=item
+
Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
detected).
+=item
+
+Don't require Term::ANSIColor.
+
=back
=item B<--color>
Use colored (ANSI) output for warning messages.
+=item B<--ignore-flag> I
+
+Don't print an error when the specific flag is missing in a compiler line.
+I is a string.
+
+Used to prevent false positives. This option can be specified multiple times.
+
+=item B<--ignore-line> I
+
+Ignore lines matching the given Perl regex. I is automatically anchored
+at the beginning and end of the line to prevent false negatives.
+
+B: Not the input lines are checked, but the lines which are displayed in
+warnings (which have line continuation resolved).
+
+Used to prevent false positives. This option can be specified multiple times.
+
=item B<--pie>
Force check for all +pie hardening flags. By default it's auto detected.
@@ -917,6 +1051,84 @@ Auto detection for B<--pie> and B<--bindnow> only works if at least one
command uses the required hardening flag (e.g. -fPIE). Then it's required for
all other commands as well.
+=head1 EXAMPLES
+
+Normal usage, parse a single log file.
+
+ blhc path/to/log/file
+
+Parse multiple log files. The exit code is ORed over all files.
+
+ blhc path/to/directory/with/log/files/*
+
+Don't treat missing C<-g> as error:
+
+ blhc --ignore-flag -g path/to/log/file
+
+Ignore lines consisting exactly of C<./script gcc file> which would cause a
+false positive.
+
+ blhc --ignore-line '\./script gcc file' path/to/log/file
+
+Ignore lines matching C<./script gcc file> somewhere in the line.
+
+ blhc --ignore-line '.*\./script gcc file.*' path/to/log/file
+
+Use blhc with pbuilder.
+
+ pbuilder path/to/package.dsc | tee path/log/file
+ blhc path/to/file || echo flags missing
+
+=head1 BUILDD TAGS
+
+The following tags are used in I<--buildd> mode. In braces the additional data
+which is displayed.
+
+=over 2
+
+=item
+
+B
+
+The package uses hardening-wrapper which intercepts calls to gcc and adds
+hardening flags. The build log doesn't contain any hardening flags and thus
+can't be checked by blhc.
+
+=item
+
+B (summary of hidden lines)
+
+Build log contains lines which hide the real compiler flags. For example:
+
+ CC test-a.c
+ CC test-b.c
+ CC test-c.c
+ LD test
+
+Most of the time either C or C in
+F fixes builds with hidden compiler flags. Sometimes C<.SILENT>
+in a F must be removed. And as last resort the F must be
+patched to remove the C<@>s hiding the real compiler commands.
+
+=item
+
+B (summary of missing flags)
+
+CPPFLAGS, CFLAGS, CXXFLAGS, LDFLAGS missing.
+
+=item
+
+B (version)
+
+=item
+
+B
+
+No compiler commands were detected. Either the log contains none or they were
+not correctly detected by blhc (please report the bug in this case).
+
+=back
+
=head1 EXIT STATUS
The exit status is a "bit mask", each listed status is ORed when the error
@@ -954,6 +1166,9 @@ Hardening wrapper detected, no tests performed.
Simon Ruderich, Esimon@ruderich.orgE
+Thanks to to Bernhard R. Link Ebrlink@debian.orgE and Jaria Alto
+Ejari.aalto@cante.netE for their valuable input and suggestions.
+
=head1 COPYRIGHT AND LICENSE
Copyright (C) 2012 by Simon Ruderich
@@ -971,4 +1186,8 @@ GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
+=head1 SEE ALSO
+
+L, L
+
=cut