Your message dated Sun, 08 Apr 2012 16:04:47 +0000
with message-id <[email protected]>
and subject line Bug#663355: fixed in picolisp 3.0.9.7-1
has caused the Debian Bug report #663355,
regarding picolisp: Please enable hardening flags
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
663355: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=663355
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: picolisp
Version: 3.0.9.4-1
Severity: important
Tags: patch
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Maintainer,
Please consider enabling hardening flags which are a release goal
for wheezy. For more information please have a look at [1], [2]
and [3].
The attached patch updates the build system to respect the
hardening flags, necessary for CFLAGS and LDFLAGS. If possible
this patch should be sent to upstream.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/picolisp /usr/lib/picolisp/lib/ht
/usr/lib/picolisp/lib/ext
/usr/bin/picolisp:
Position Independent Executable: no, normal executable!
Stack protected: no, not found!
Fortify Source functions: no, only unprotected functions found!
Read-only relocations: yes
Immediate binding: yes
/usr/lib/picolisp/lib/ht:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: yes
/usr/lib/picolisp/lib/ext:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: yes
(Position Independent Executable is not enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
picolisp, ht and ext have an executable stack which might cause
security problems. But I'm not sure if this is required by the
program - if it's not adding -Wl,-z,noexecstack to LDFLAGS fixes
that.
I haven't tested picolisp with these new flags, please test it
before uploading a new package with these changes. Normally
everything works fine, but picolisp uses assembly which might
cause problems.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
- -- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJPW31LAAoJEJL+/bfkTDL5TXwQAIV8ZWFAQ+zgjJDpH//Nr41X
1gM/VB4zxC6V8aDVdshNLQhtkZZOCH4cd3+Cx2bUNSzBofRXgQu6LENgR8r9M1gT
uYMCxozCN5TJmCl1k+TSHYYUSwLvFVpWF+IWiQH5LmGD+ZS4WspXAApDsKY+FeFB
FgS7nmA1w+LcM/jrsyLCJOw44dWyHRmUeV9lJRquc16vWkjqwzEkNw+Nlu86Fagq
RabIpKenLFcMFp2M4rt/BMYppjAR5JSM0KnEGtjGqzTYqMD9QuaRaOKAAxfG2C1Z
ZwNBx9mv6ojKPqmAyp4GbdUlX2isZtLq74shVCEfZBN+wYRGnSR9qHW/s2xl7elQ
66hNtSoiXotU4PY8viUmXQhbIz7FvnzwSe2yRdMNmi4XrL2xnrrv/w9ntlzRywUH
yKRy6evT66hD+B66hOpufQ/tDoucIB/zWVDAqP+hYbVsmZW2Qnzlaex3dEPNJ+fq
ejVP7MwAM3rntwyyS+O2jiN2HVscKy8yLm3kbN69Qru7OPMmjkCx4il1CYjGzOYm
HXLrd/erUKrK3G4Hy3eE7ZjQUaZvNvG1SLLcPvldUTiKh8K8YViGLmOr7aD5JKoH
ssn/MuGs/FwSkpXKDN9WAZ/04/ACPtHPAIw9yZQz/uq43vF0a2VF14bq+KhWkcXU
QadvlQsQqDN1JouGwYVD
=Xe0P
-----END PGP SIGNATURE-----
Description: Always use $CFLAGS and $LDFLAGS.
Necessary for hardening flags and noopt support.
Author: Simon Ruderich <[email protected].
Last-Update: 2012-03-06
Index: picolisp-3.0.9.4/src64/Makefile
===================================================================
--- picolisp-3.0.9.4.orig/src64/Makefile 2012-03-06 16:47:29.000000000 +0100
+++ picolisp-3.0.9.4/src64/Makefile 2012-03-06 16:47:29.000000000 +0100
@@ -34,7 +34,7 @@
MKASM-LIB = -fpic
AS = as
LD-MAIN = -m64 -rdynamic -lc -lm -ldl $(LDFLAGS)
- LD-SHARED = -m64 -shared -export-dynamic
+ LD-SHARED = -m64 -shared -export-dynamic $(LDFLAGS)
STRIP = :
else
ifeq (solaris,$(OS))
@@ -44,7 +44,7 @@
MKASM-LIB = -fpic
AS = as
LD-MAIN = -m64 -lc -lm -ldl -lsocket -lnsl $(LDFLAGS)
- LD-SHARED = -m64 -shared
+ LD-SHARED = -m64 -shared $(LDFLAGS)
STRIP = strip
else
ifeq (kopensolaris,$(OS))
@@ -54,7 +54,7 @@
MKASM-LIB = -fpic
AS = as
LD-MAIN = -m64 -rdynamic -lc -lm $(LDFLAGS)
- LD-SHARED = -m64 -shared
+ LD-SHARED = -m64 -shared $(LDFLAGS)
STRIP = strip
endif
endif
@@ -78,8 +78,8 @@
AS = as -mppc64 -a64
endif
endif
- LD-MAIN = -m64 -rdynamic -lc -lm -ldl
- LD-SHARED = -m64 -shared -export-dynamic
+ LD-MAIN = -m64 -rdynamic -lc -lm -ldl $(LDFLAGS)
+ LD-SHARED = -m64 -shared -export-dynamic $(LDFLAGS)
STRIP = strip
else
ifeq ($(UNAME), SunOS)
@@ -89,8 +89,8 @@
MKASM-BASE =
MKASM-LIB = -fpic
AS = gas --64
- LD-MAIN = -m64 -lc -lm -ldl -lsocket -lnsl
- LD-SHARED = -m64 -shared
+ LD-MAIN = -m64 -lc -lm -ldl -lsocket -lnsl $(LDFLAGS)
+ LD-SHARED = -m64 -shared $(LDFLAGS)
STRIP = strip
endif
endif
Index: picolisp-3.0.9.4/src/Makefile
===================================================================
--- picolisp-3.0.9.4.orig/src/Makefile 2012-03-06 16:47:29.000000000 +0100
+++ picolisp-3.0.9.4/src/Makefile 2012-03-10 16:45:23.228809000 +0100
@@ -19,7 +19,7 @@
LDFLAGS ?=
PICOLISP-FLAGS = -rdynamic
LIB-FLAGS = -lc -lm -ldl $(LDFLAGS)
-DYNAMIC-LIB-FLAGS = -shared -export-dynamic
+DYNAMIC-LIB-FLAGS = -shared -export-dynamic $(LDFLAGS)
STRIP = :
ifeq (amd64,$(CPU))
@@ -33,36 +33,36 @@
ifeq ($(shell uname), Linux)
OS = Linux
PICOLISP-FLAGS = -m32 -rdynamic
- LIB-FLAGS = -lc -lm -ldl
- DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic
+ LIB-FLAGS = -lc -lm -ldl $(LDFLAGS)
+ DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic $(LDFLAGS)
STRIP = strip
else
ifeq ($(shell uname), OpenBSD)
OS = OpenBSD
PICOLISP-FLAGS = -m32 -rdynamic -Wl,-E
- LIB-FLAGS = -lc -lm
- DYNAMIC-LIB-FLAGS = -Wl,-E -Wl,-shared
+ LIB-FLAGS = -lc -lm $(LDFLAGS)
+ DYNAMIC-LIB-FLAGS = -Wl,-E -Wl,-shared $(LDFLAGS)
STRIP = strip
else
ifeq ($(shell uname), FreeBSD)
OS = FreeBSD
PICOLISP-FLAGS = -m32 -rdynamic
- LIB-FLAGS = -lc -lm
- DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic
+ LIB-FLAGS = -lc -lm $(LDFLAGS)
+ DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic $(LDFLAGS)
STRIP = strip
else
ifeq ($(shell uname), NetBSD)
OS = NetBSD
PICOLISP-FLAGS = -m32 -rdynamic
- LIB-FLAGS = -lc -lm
- DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic
+ LIB-FLAGS = -lc -lm $(LDFLAGS)
+ DYNAMIC-LIB-FLAGS = -m32 -shared -export-dynamic $(LDFLAGS)
STRIP = strip
else
ifeq ($(shell uname), Darwin)
OS = Darwin
PICOLISP-FLAGS = -m32
- LIB-FLAGS = -lc -lm -ldl
- DYNAMIC-LIB-FLAGS = -m32 -dynamiclib -undefined dynamic_lookup
+ LIB-FLAGS = -lc -lm -ldl $(LDFLAGS)
+ DYNAMIC-LIB-FLAGS = -m32 -dynamiclib -undefined dynamic_lookup $(LDFLAGS)
STRIP = :
else
ifeq ($(shell uname -o), Cygwin)
@@ -134,27 +134,27 @@
$(bin)/lat1: lat1.c
- gcc -o $(bin)/lat1$(exe) lat1.c
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/lat1$(exe) lat1.c
$(STRIP) $(bin)/lat1$(exe)
$(bin)/utf2: utf2.c
- gcc -o $(bin)/utf2$(exe) utf2.c
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/utf2$(exe) utf2.c
$(STRIP) $(bin)/utf2$(exe)
$(bin)/balance: balance.c
- gcc -o $(bin)/balance$(exe) balance.c
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/balance$(exe) balance.c
$(STRIP) $(bin)/balance$(exe)
$(bin)/ssl: ssl.c
- gcc -o $(bin)/ssl$(exe) ssl.c -lssl -lcrypto
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/ssl$(exe) ssl.c -lssl -lcrypto
$(STRIP) $(bin)/ssl$(exe)
$(bin)/httpGate: httpGate.c
- gcc -o $(bin)/httpGate$(exe) httpGate.c -lssl -lcrypto
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/httpGate$(exe) httpGate.c -lssl -lcrypto
$(STRIP) $(bin)/httpGate$(exe)
$(bin)/z3dClient: z3dClient.c
- gcc -o $(bin)/z3dClient$(exe) z3dClient.c -L/usr/X11R6/lib -lXext -lX11
+ gcc $(CFLAGS) $(LDFLAGS) -o $(bin)/z3dClient$(exe) z3dClient.c -L/usr/X11R6/lib -lXext -lX11
$(STRIP) $(bin)/z3dClient$(exe)
--- End Message ---
--- Begin Message ---
Source: picolisp
Source-Version: 3.0.9.7-1
We believe that the bug you reported is fixed in the latest version of
picolisp, which is due to be installed in the Debian FTP archive:
picolisp_3.0.9.7-1.debian.tar.gz
to main/p/picolisp/picolisp_3.0.9.7-1.debian.tar.gz
picolisp_3.0.9.7-1.dsc
to main/p/picolisp/picolisp_3.0.9.7-1.dsc
picolisp_3.0.9.7-1_amd64.deb
to main/p/picolisp/picolisp_3.0.9.7-1_amd64.deb
picolisp_3.0.9.7.orig.tar.gz
to main/p/picolisp/picolisp_3.0.9.7.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Kan-Ru Chen <[email protected]> (supplier of updated picolisp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 08 Apr 2012 21:31:01 +0800
Source: picolisp
Binary: picolisp
Architecture: source amd64
Version: 3.0.9.7-1
Distribution: unstable
Urgency: low
Maintainer: Kan-Ru Chen <[email protected]>
Changed-By: Kan-Ru Chen <[email protected]>
Description:
picolisp - Lisp interpreter and application server framework
Closes: 663355
Changes:
picolisp (3.0.9.7-1) unstable; urgency=low
.
* New upstream release.
* Sync to upstream tip.
* Enable hardening flags on helper binaries. (Closes: #663355)
* debian/control:
- Build-Depends on lib32gcc1 for amd64 to workaround #667519
Checksums-Sha1:
ded7769a42cff41b228abdb0112642e63d97b457 2120 picolisp_3.0.9.7-1.dsc
ec38352fbf04675d92f23f4ca08af70bc5c325cf 815913 picolisp_3.0.9.7.orig.tar.gz
0b052f4f0f2b3dcf457ad6b9c165d5f0476ec195 12257 picolisp_3.0.9.7-1.debian.tar.gz
0aa3a8c1df6a7b5f615f014d499a967153d0c095 896196 picolisp_3.0.9.7-1_amd64.deb
Checksums-Sha256:
3b794bb16f08e3d8ec0eb35bd03f26c9b013587539ed9857087cace23d688285 2120
picolisp_3.0.9.7-1.dsc
bf8261d711a8ca3895b28b9f88a74efd517133dba68779851941ec255929b1d7 815913
picolisp_3.0.9.7.orig.tar.gz
f7b4bff0196825e620f93f8af0d29cbefb0f599931222e89eb55f12634c2a27d 12257
picolisp_3.0.9.7-1.debian.tar.gz
6d4bcc21d8c0f11517d66f190a9ae6b0a9bf72066210715ab863957057b67322 896196
picolisp_3.0.9.7-1_amd64.deb
Files:
a60621bb3f63e1616f704365d8699d61 2120 lisp optional picolisp_3.0.9.7-1.dsc
86ed74e49b11840cf685b247ff306bec 815913 lisp optional
picolisp_3.0.9.7.orig.tar.gz
4895880089173ff7a5ebc653c80f4105 12257 lisp optional
picolisp_3.0.9.7-1.debian.tar.gz
8fd20d433332040d38db5d9d98f73441 896196 lisp optional
picolisp_3.0.9.7-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJPgbKnAAoJEAo5NUq25X3hcg4P/RorhzATx6EVaQS2umeOswQV
WvN2YHDHxbeuUDc/5+qldZVIueOPNpP+LseI1M3h9F7k/UKdIs+Db5FT/ZZIPS1r
gvtn7FcudPX/hopgn2K5YCPeA7pFCJD/YhZVJTWiaVDHcknw2pIJJ0muIbNCWWNL
Gk0YuyccgxPTwL2zZclhPYlu4s5fiuJGLcgwcRD1QaZmfSABRJgk2ZHonA2DcIm7
o95aEG//m+GWEr2FOJ+xsjSfw1PCEOA1KWfwpkPmmK1QqH1hOEDwuLdcbrEG2kgI
1vr1WAiNHgxVMVnX+o2eNuqWADJtQ9lT+5JeADmRu/slw2Jq2uRzNKOkBNwGgMA/
HKPN7qPmyhOX9wGhmUkgGBHbw8y0h0Kg/Svcw1oz9Ke/MoVrP4riYv95ovl0ITlu
TWFPCr8pgFyQMvI6IKDSqmaH8i3m43IAtU4p0TotPCT7G2hSwf/T3zYHzvYwzIQn
SlFq0fmt1a/mwlS9/D3h8+yrAnHr3/TGULew22nOkoJSr2mM9urstD0jQsM0A2gS
MFZK7ysME7f7Ydd/oSffSFxh3fUDBBYOO0sjTxZQP9YLfJ05I4bF81FMspN0NZea
TX3zFU4kovr8EWlag782WlNIXjZIPwD7q4EeD5b2CAXsyFeB0UO6cpk3hYsTR7K1
BsRvfDpdN6bKMML/BVTX
=Q4UG
-----END PGP SIGNATURE-----
--- End Message ---
