reopen 657518 thanks Dear Maintainer,
The hardening flags are missing for jay and binfmt-detector-cli
because the build system ignores them.
The attached patch fixes the issue. If possible it should be sent
upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/jay /usr/lib/cli/binfmt-detector-cli
/usr/bin/jay:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/cli/binfmt-detector-cli:
Position Independent Executable: no, normal executable!
Stack protected: no, not found!
Fortify Source functions: no, only unprotected functions found!
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
diff -Nru mono-2.10.8.1/debian/detector/Makefile mono-2.10.8.1/debian/detector/Makefile --- mono-2.10.8.1/debian/detector/Makefile 2012-03-22 22:00:49.000000000 +0100 +++ mono-2.10.8.1/debian/detector/Makefile 2012-03-23 15:20:46.000000000 +0100 @@ -1,5 +1,5 @@ binfmt-detector-cli: binfmt-detector-cli.c cil-coff.h - $(CC) binfmt-detector-cli.c -o binfmt-detector-cli + $(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) binfmt-detector-cli.c -o binfmt-detector-cli strip binfmt-detector-cli clean: diff -Nru mono-2.10.8.1/debian/patches/debian-changes mono-2.10.8.1/debian/patches/debian-changes --- mono-2.10.8.1/debian/patches/debian-changes 2012-03-23 04:31:05.000000000 +0100 +++ mono-2.10.8.1/debian/patches/debian-changes 2012-03-23 15:21:37.000000000 +0100 @@ -722,3 +711,25 @@ MonoMethod *m = ((MonoReflectionMethod*)ctor)->method; idx = GPOINTER_TO_UINT (g_hash_table_lookup (assembly->method_to_table_idx, m)); values [MONO_CUSTOM_ATTR_TYPE] = (idx << MONO_CUSTOM_ATTR_TYPE_BITS) | MONO_CUSTOM_ATTR_TYPE_METHODDEF; +--- mono-2.10.8.1.orig/mcs/build/rules.make ++++ mono-2.10.8.1/mcs/build/rules.make +@@ -26,7 +26,7 @@ Q_MCS=$(if $(V),,@echo "MCS [$(PROFI + + USE_MCS_FLAGS = /codepage:$(CODEPAGE) $(LOCAL_MCS_FLAGS) $(PLATFORM_MCS_FLAGS) $(PROFILE_MCS_FLAGS) $(MCS_FLAGS) + USE_MBAS_FLAGS = /codepage:$(CODEPAGE) $(LOCAL_MBAS_FLAGS) $(PLATFORM_MBAS_FLAGS) $(PROFILE_MBAS_FLAGS) $(MBAS_FLAGS) +-USE_CFLAGS = $(LOCAL_CFLAGS) $(CFLAGS) ++USE_CFLAGS = $(LOCAL_CFLAGS) $(CFLAGS) $(CPPFLAGS) + CSCOMPILE = $(Q_MCS) $(MCS) $(USE_MCS_FLAGS) + BASCOMPILE = $(MBAS) $(USE_MBAS_FLAGS) + CCOMPILE = $(CC) $(USE_CFLAGS) +--- mono-2.10.8.1.orig/mcs/jay/Makefile ++++ mono-2.10.8.1/mcs/jay/Makefile +@@ -46,7 +46,7 @@ dist-local: dist-default + test-local run-test-local run-test-ondotnet-local doc-update-local: + + jay: $(sources:.c=.o) +- $(CCOMPILE) -o $@ $^ ++ $(CCOMPILE) $(LDFLAGS) -o $@ $^ + + %.o: %.c + $(CCOMPILE) -c -o $@ $^
signature.asc
Description: Digital signature
