Package: gentoo Version: 0.19.13-1 Severity: normal Tags: patch Dear Maintainer,
The CFLAGS hardening flags are missing because the build system ignores them. For more hardening information please have a look at [1], [2] and [3]. The following _and_ the attached patch fix the issue. diff -Nru gentoo-0.19.13/debian/control gentoo-0.19.13/debian/control --- gentoo-0.19.13/debian/control 2012-04-15 17:39:07.000000000 +0200 +++ gentoo-0.19.13/debian/control 2012-04-16 23:56:16.000000000 +0200 @@ -2,7 +2,7 @@ Section: x11 Priority: optional Maintainer: Innocent De Marchi <tangram.pe...@gmail.com> -Build-Depends: debhelper (>= 9), libgtk2.0-dev, libglib2.0-dev +Build-Depends: debhelper (>= 9), dh-autoreconf, libgtk2.0-dev, libglib2.0-dev Standards-Version: 3.9.3 Homepage: http://www.obsession.se/gentoo/ diff -Nru gentoo-0.19.13/debian/rules gentoo-0.19.13/debian/rules --- gentoo-0.19.13/debian/rules 2012-04-15 17:44:06.000000000 +0200 +++ gentoo-0.19.13/debian/rules 2012-04-16 23:56:23.000000000 +0200 @@ -14,4 +14,4 @@ export DEB_LDFLAGS_MAINT_PREPEND := -Wl,-z,defs -Wl,--as-needed %: - dh $@ + dh $@ --with autoreconf To check if all flags were correctly enabled you can use `hardening-check` from the hardening-includes package and check the build log (hardening-check doesn't catch everything): $ hardening-check /usr/bin/gentoo /usr/bin/gentoo: Position Independent Executable: no, normal executable! Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! (Position Independent Executable and Immediate binding is not enabled by default.) Use find -type f \( -executable -o -name \*.so\* \) -exec hardening-check {} + on the build result to check all files. Regards, Simon [1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags [2]: https://wiki.debian.org/HardeningWalkthrough [3]: https://wiki.debian.org/Hardening -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9
Description: Use CFLAGS flags from environment (dpkg-buildflags). Necessary for hardening flags. . No idea why the developer disables them like this. . Also needs dh-autoreconf to apply the changes during the build. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-04-16 --- gentoo-0.19.13.orig/configure.in +++ gentoo-0.19.13/configure.in @@ -24,7 +24,7 @@ AC_PROG_CC dnl Don't just call it CFLAGS, since it then gets inherited into intl/, and GNU dnl and I don't exactly code alike. Don't include CFLAGS as set by AC_PROG_CC dnl above, since it includes -g -O2 for gcc, for reasons unknown. -GENTOO_CFLAGS="-Wall -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes -Werror-implicit-function-declaration" +GENTOO_CFLAGS="$CFLAGS -Wall -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes -Werror-implicit-function-declaration" AC_ARG_ENABLE(debug, [ --enable-debug have debug info compiled in],
signature.asc
Description: Digital signature
