Mon 10 Oct 2016 07:58:17 AM UTC, original submission:
Some code files are compiled without hardening flags in the debian build system. This is a result of the lintian warnings:
https://qa.debian.org/bls/packages/p/pspp.html
It seems that the
q2c.c file is compiled without CFLAGS, CPPFLAGS and LDFLAGS which transport the hardening flags.
PSPP.c (which is for PERL?) is compiled without CFLAGS and CPPFLAGS
PSPP.so is linked without LDFLAGS
=======
The blhc check shows the following:
fritz@debian:~/pspp/debian$ blhc --version
blhc 0.07 Copyright (C) 2012-2016 Simon Ruderich
fritz@debian:~/pspp/debian$ blhc pspp_0.10.2-1_amd64.build
CFLAGS missing (-g -O2 -fstack-protector-strong -Wformat -Werror=format-security): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
LDFLAGS missing (-Wl,-z,relro): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
CFLAGS missing (-fstack-protector-strong -Wformat -Werror=format-security): x86_64-linux-gnu-gcc -c -I /home/fritz/pspp/debian/pspp-0.10.2 -I /home/fritz/pspp/debian/pspp-0.10.2/src -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2 -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -DVERSION=\"0.10.2\" -DXS_VERSION=\"0.10.2\" -fPIC "-I/usr/lib/x86_64-linux-gnu/perl/5.22/CORE" PSPP.c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -c -I /home/fritz/pspp/debian/pspp-0.10.2 -I /home/fritz/pspp/debian/pspp-0.10.2/src -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2 -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -DVERSION=\"0.10.2\" -DXS_VERSION=\"0.10.2\" -fPIC "-I/usr/lib/x86_64-linux-gnu/perl/5.22/CORE" PSPP.c
LDFLAGS missing (-Wl,-z,relro): x86_64-linux-gnu-gcc -shared -L/usr/local/lib -fstack-protector-strong PSPP.o -o blib/arch/auto/PSPP/PSPP.so /home/fritz/pspp/debian/pspp-0.10.2/src/.libs/libpspp-core.so \ \
fritz@debian:~/pspp/debian$
=========
The hardening-check shows:
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp
pspp:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp-convert
pspp-convert:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp-dump-sav
pspp-dump-sav:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check psppire
psppire:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$
|