Package: w3m Version: 0.5.3-5 Severity: important Tags: patch Dear Maintainer,
The CPPFLAGS hardening flags are missing because they are not set
in debian/rules.
The following patch and the attached patch fixes the issue.
The patch also enables all hardening options (including PIE and
bindnow) because w3m interprets untrusted data [1].
diff -Nru w3m-0.5.3/debian/rules w3m-0.5.3/debian/rules
--- w3m-0.5.3/debian/rules 2011-11-28 17:20:06.000000000 +0100
+++ w3m-0.5.3/debian/rules 2012-03-24 17:38:09.000000000 +0100
@@ -2,8 +2,11 @@
#export DH_VERBOSE=1
-CFLAGS=$(shell dpkg-buildflags --get CFLAGS)
-LDFLAGS=$(shell dpkg-buildflags --get LDFLAGS)
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+dpkg_buildflags = DEB_BUILD_MAINT_OPTIONS=$(DEB_BUILD_MAINT_OPTIONS)
dpkg-buildflags
+CFLAGS=$(shell $(dpkg_buildflags) --get CFLAGS)
+CPPFLAGS=$(shell $(dpkg_buildflags) --get CPPFLAGS)
+LDFLAGS=$(shell $(dpkg_buildflags) --get LDFLAGS)
ifeq ($(DEB_BUILD_GNU_SYSTEM),linux-gnu)
DEVS=x11,fb+s
@@ -28,7 +31,7 @@
build-stamp:
dh_testdir
cd $(builddir) && dh_autotools-dev_updateconfig
- cd $(builddir) && CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" ./configure
$(confargs)
+ cd $(builddir) && CFLAGS="$(CFLAGS)" CPPFLAGS="$(CPPFLAGS)"
LDFLAGS="$(LDFLAGS)" ./configure $(confargs)
cd $(builddir) && LC_ALL=C $(MAKE) OPTS="-Wall -g -DDEBIAN"
cd $(builddir)/po && LC_ALL=C $(MAKE) update-gmo
touch build-stamp
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/w3m /usr/lib/w3m/cgi-bin/w3mhelperpanel
/usr/lib/w3m/cgi-bin/w3mbookmark ...
/usr/bin/w3m:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
/usr/lib/w3m/cgi-bin/w3mhelperpanel:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
/usr/lib/w3m/cgi-bin/w3mbookmark:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use CPPFLAGS from environment (dpkg-buildflags). Necessary for hardening flags. Author: Simon Ruderich <[email protected]> Last-Update: 2012-03-24 --- w3m-0.5.3.orig/Makefile.in +++ w3m-0.5.3/Makefile.in @@ -150,7 +150,7 @@ parsetagx.o: html.c funcname.tab: $(DEFUNS) (echo '#define DEFUN(x,y,z) x y';\ - sed -ne '/^DEFUN/{p;n;/^[ ]/p;}' $(DEFUNS)) | $(CPP) - | \ + sed -ne '/^DEFUN/{p;n;/^[ ]/p;}' $(DEFUNS)) | $(CPP) $(CPPFLAGS) - | \ awk '$$1 ~ /^[_A-Za-z]/ { \ for (i=2;i<=NF;i++) { print $$i, $$1} \ }' > [email protected]
signature.asc
Description: Digital signature
