bugPSPP - Bugs: bug #49302, debian build system - code is...

 
 

bug #49302: debian build system - code is compiled without hardening flags

Submitted by:  Friedrich Beckmann <beckmanf>
Submitted on:  Mon 10 Oct 2016 07:58:17 AM UTC  
 
Category: Compilation/PortabilitySeverity: 5 - Average
Status: FixedAssigned to: None
Open/Closed: ClosedRelease: None
Effort: 0.00

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 10 Oct 2016 08:41:24 PM UTC, comment #4:

Hi Ben,

i reverted the change for the build of q2c.c with commit:

http://git.savannah.gnu.org/cgit/pspp.git/commit/?id=c86c40a2bb9194203a80f7ddf11cdc7a2e15474e

So we can leave it as is, because it only runs during build time.

Friedrich Beckmann <beckmanf>
Project Member
Mon 10 Oct 2016 08:28:57 PM UTC, comment #3:

This change is incorrect for q2c, because q2c runs on the build system, not on the host. Thus, it will probably break many cross-compilation cases. I suggest reverting the q2c part of the change.

Ben Pfaff <blp>
Project Administrator
Mon 10 Oct 2016 06:24:28 PM UTC, comment #2:

I fixed this with commit:

http://git.savannah.gnu.org/cgit/pspp.git/commit/?id=6bc0a0ff21cff9b9c6c613677daee46c6c0af04c

This adds the compile flags to the build such that the hardening flags are used during compile of q2c.c and PSPP.c

Friedrich Beckmann <beckmanf>
Project Member
Mon 10 Oct 2016 03:34:58 PM UTC, comment #1:

q2c.c should not matter, because it is used at build time only and never installed or linked to a program that is installed.

I guess that the others are real problems. For PSPP.c, the perl module, I would look at how other Debian packages build perl modules, to see how they solve the issue. For PSPP.so, I would look at how other Debian packages build shared libraries.

Ben Pfaff <blp>
Project Administrator
Mon 10 Oct 2016 07:58:17 AM UTC, original submission:

Some code files are compiled without hardening flags in the debian build system. This is a result of the lintian warnings:

https://qa.debian.org/bls/packages/p/pspp.html

It seems that the

q2c.c file is compiled without CFLAGS, CPPFLAGS and LDFLAGS which transport the hardening flags.

PSPP.c (which is for PERL?) is compiled without CFLAGS and CPPFLAGS

PSPP.so is linked without LDFLAGS

=======

The blhc check shows the following:

fritz@debian:~/pspp/debian$ blhc --version
blhc 0.07 Copyright (C) 2012-2016 Simon Ruderich

fritz@debian:~/pspp/debian$ blhc pspp_0.10.2-1_amd64.build
CFLAGS missing (-g -O2 -fstack-protector-strong -Wformat -Werror=format-security): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
LDFLAGS missing (-Wl,-z,relro): gcc ./src/language/lexer/q2c.c -o ./src/language/lexer/q2c
CFLAGS missing (-fstack-protector-strong -Wformat -Werror=format-security): x86_64-linux-gnu-gcc -c -I /home/fritz/pspp/debian/pspp-0.10.2 -I /home/fritz/pspp/debian/pspp-0.10.2/src -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2 -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -DVERSION=\"0.10.2\" -DXS_VERSION=\"0.10.2\" -fPIC "-I/usr/lib/x86_64-linux-gnu/perl/5.22/CORE" PSPP.c
CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -c -I /home/fritz/pspp/debian/pspp-0.10.2 -I /home/fritz/pspp/debian/pspp-0.10.2/src -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2/gl -I /home/fritz/pspp/debian/pspp-0.10.2 -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -DVERSION=\"0.10.2\" -DXS_VERSION=\"0.10.2\" -fPIC "-I/usr/lib/x86_64-linux-gnu/perl/5.22/CORE" PSPP.c
LDFLAGS missing (-Wl,-z,relro): x86_64-linux-gnu-gcc -shared -L/usr/local/lib -fstack-protector-strong PSPP.o -o blib/arch/auto/PSPP/PSPP.so /home/fritz/pspp/debian/pspp-0.10.2/src/.libs/libpspp-core.so \ \
fritz@debian:~/pspp/debian$

=========

The hardening-check shows:

fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp
pspp:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp-convert
pspp-convert:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check pspp-dump-sav
pspp-dump-sav:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$ hardening-check psppire
psppire:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no, not found!
fritz@debian:~/pspp/debian/pspp-0.10.2/debian/pspp/usr/bin$

Friedrich Beckmann <beckmanf>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by blp (Posted a comment)
  • -unavailable- added by beckmanf (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 10 Oct 2016 08:41:24 PM UTCbeckmanfStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Mon 10 Oct 2016 08:28:57 PM UTCblpStatusFixed=>In Progress
      Open/ClosedClosed=>Open
    Mon 10 Oct 2016 06:24:28 PM UTCbeckmanfStatusConfirmed=>Fixed
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1