Package: cfourcc Severity: important Tags: patch Dear Maintainer,
The CPPFLAGS/LDFLAGS hardening flags are missing because the
build system ignores them.
DEB_*_MAINT_APPEND is the preferred way to set additional flags
(see man dpkg-buildflags for more information). For more
hardening information please have a look at [1], [2] and [3].
The three attached patches fix the issue. override_dh_auto_build
is no longer necessary as the patch updates the Makefile to
respect build flags from the environment. buildflags.mk and
exporting the variables is not necessary with compat=9. If
possible the patches should be sent upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/cfourcc
/usr/bin/cfourcc:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
diff -Nru cfourcc-0.1.2/debian/rules cfourcc-0.1.2/debian/rules --- cfourcc-0.1.2/debian/rules 2012-02-11 20:09:14.000000000 +0100 +++ cfourcc-0.1.2/debian/rules 2012-03-22 16:05:56.000000000 +0100 @@ -4,18 +4,13 @@ include debian/debian-vars.mk -include /usr/share/dpkg/buildflags.mk -CFLAGS += -Wall -pedantic -std=c99 -LDFLAGS += -Wl,--as-needed -export CFLAGS LDFLAGS +DEB_CFLAGS_MAINT_APPEND = -Wall -pedantic -std=c99 +DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed man: # target: man -- Convert *.pod to manual page $(MAKE) -C debian -f pod2man.mk PACKAGE=$(PACKAGE) makeman -override_dh_auto_build: - $(MAKE) CFLAGS="$(CFLAGS)" - override_dh_auto_install: man # Upstream Makefile is no good. Use debian/install
Description: Fix build failure with hardening CPPFLAGS. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-03-22 --- cfourcc-0.1.2.orig/cfourcc.c +++ cfourcc-0.1.2/cfourcc.c @@ -33,7 +33,6 @@ #define FLAG_HELP 0x1000 #define FLAG_FORCE 0x10000 typedef char AVIHDR[AVILEN]; -extern char *strdup (const char *); int getDesc (AVIHDR header, char *str)
Description: Use build flags from environment (dpkg-buildflags). Necessary for hardening flags. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-03-22 Index: cfourcc-0.1.2/Makefile =================================================================== --- cfourcc-0.1.2.orig/Makefile 2012-03-22 15:58:44.177363659 +0100 +++ cfourcc-0.1.2/Makefile 2012-03-22 15:59:35.717365623 +0100 @@ -4,14 +4,14 @@ # date : 25 February 2005 # -CC=gcc -CFLAGS=-O2 -pedantic -ansi -Wall -INSTALL=install -PREFIX=/usr/local +CC?=gcc +CFLAGS?=-O2 -pedantic -ansi -Wall +INSTALL?=install +PREFIX?=/usr/local all : - $(CC) $(CFLAGS) cfourcc.c -o cfourcc + $(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) cfourcc.c -o cfourcc install : all $(INSTALL) -m755 cfourcc $(PREFIX)/bin
signature.asc
Description: Digital signature
