Package: visitors Version: 0.7-8 Severity: important Tags: patch Dear Maintainer,
The CPPFLAGS/LDFLAGS hardening flags are missing because the
build system ignores them.
The attached patch fixes the issue, if possible it should be sent
to upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/visitors
/usr/bin/visitors:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use build flags from environment (dpkg-buildflags). Necessary for hardening flags. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-03-24 --- visitors-0.7.orig/Makefile +++ visitors-0.7/Makefile @@ -5,7 +5,7 @@ DEBUG?= -g CFLAGS?= -O2 -Wall -W -CCOPT= $(CFLAGS) +CCOPT= $(CFLAGS) $(CPPFLAGS) OBJ = visitors.o aht.o antigetopt.o tail.o PRGNAME = visitors @@ -14,7 +14,7 @@ all: visitors visitors.o: visitors.c blacklist.h visitors: $(OBJ) - $(CC) -o $(PRGNAME) $(CCOPT) $(DEBUG) $(OBJ) + $(CC) -o $(PRGNAME) $(LDFLAGS) $(CCOPT) $(DEBUG) $(OBJ) .c.o: $(CC) -c $(CCOPT) $(DEBUG) $(COMPILE_TIME) $<
signature.asc
Description: Digital signature
