Package: nfqueue-bindings Version: 0.4-1 Severity: normal Tags: patch Dear Maintainer,
The CPPFLAGS hardening flags are missing because CMake ignores
them by default. Normally this is handled by debhelper (compat=9)
but it doesn't work for this package because cmake is not called
during dh_auto_configure.
The following patch fixes the issue by adding them to CFLAGS. For
more hardening information please have a look at [1], [2] and
[3].
diff -Nru nfqueue-bindings-0.4/debian/rules nfqueue-bindings-0.4/debian/rules
--- nfqueue-bindings-0.4/debian/rules 2012-04-16 11:48:48.000000000 +0200
+++ nfqueue-bindings-0.4/debian/rules 2012-04-24 12:38:28.000000000 +0200
@@ -6,6 +6,9 @@
PYVERS=$(shell pyversions -vr)
+# CMake doesn't respect CPPFLAGS.
+CFLAGS += $(CPPFLAGS)
+
%:
dh $@ --with-python-support
The attached patch enables verbose builds to make it easy to
(automatically) spot missing hardening flags. Please apply it as
well.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):
$ hardening-check /usr/lib/python2.6/dist-packages/_nfqueue.so
/usr/lib/python2.7/dist-packages/_nfqueue.so /usr/lib/perl5/libnfqueue.so
/usr/lib/python2.6/dist-packages/_nfqueue.so:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/python2.7/dist-packages/_nfqueue.so:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/perl5/libnfqueue.so:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Display compiler commands when building. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-04-24 --- nfqueue-bindings-0.4.orig/Makefile +++ nfqueue-bindings-0.4/Makefile @@ -1,5 +1,5 @@ PREFIX = /usr/local -CMAKE_OPTIONS = -DDEBUG=1 -DCMAKE_VERBOSE_MAKEFILE=0 -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$(PREFIX) +CMAKE_OPTIONS = -DDEBUG=1 -DCMAKE_VERBOSE_MAKEFILE=1 -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$(PREFIX) CMAKE_EXTRA_OPTIONS = BUILD_DIR = build
signature.asc
Description: Digital signature
