Dear Maintainer, The LDFLAGS hardening flags are still missing in a few places:
cc -shared -Wl,-soname,libdevmapper.so.1.02.1 [...] -o ioctl/libdevmapper.so.1.02.1 cc -shared -Wl,-soname,liblvm2cmd.so.2.02 [...] -o liblvm2cmd.so [...] cc -shared -Wl,-soname,liblvm2app.so.2.2 [...] -o liblvm2app.so.2.2 cc -shared -Wl,-soname,libdevmapper.so.1.02.1 [...] -o ioctl/libdevmapper.so.1.02.1 The attached patch fixes the issue by modifying configure.ac. I found no better way to fix the missing flags, but as autoreconf is called anyway it shouldn't be too much trouble. If possible the patch should be sent to upstream to fix the build system. To check if all flags were correctly enabled you can use `hardening-check` from the hardening-includes package and check the build log (for example with blhc [4]) (hardening-check doesn't catch everything): $ hardening-check /sbin/lvm /lib/x86_64-linux-gnu/liblvm2cmd.so.2.02 /lib/x86_64-linux-gnu/liblvm2app.so.2.2 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 ... /sbin/lvm: Position Independent Executable: no, normal executable! Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! /lib/x86_64-linux-gnu/liblvm2cmd.so.2.02: Position Independent Executable: no, regular shared library (ignored) Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! /lib/x86_64-linux-gnu/liblvm2app.so.2.2: Position Independent Executable: no, regular shared library (ignored) Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1: Position Independent Executable: no, regular shared library (ignored) Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! ... (Position Independent Executable and Immediate binding is not enabled by default.) Use find -type f \( -executable -o -name \*.so\* \) -exec hardening-check {} + on the build result to check all files. Regards, Simon [1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags [2]: https://wiki.debian.org/HardeningWalkthrough [3]: https://wiki.debian.org/Hardening [4]: http://ruderich.org/simon/blhc/ -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9
Description: Use build flags from environment (dpkg-buildflags). Necessary for hardening flags. . Just passing LDFLAGS as CLDFLAGS doesn't work. Author: Simon Ruderich <si...@ruderich.org> Last-Update: 2012-05-27 Index: lvm2-2.02.95/configure.in =================================================================== --- lvm2-2.02.95.orig/configure.in 2012-05-27 02:06:18.695308609 +0200 +++ lvm2-2.02.95/configure.in 2012-05-27 02:06:18.771308607 +0200 @@ -30,7 +30,7 @@ linux*) CFLAGS="$CFLAGS" COPTIMISE_FLAG="-O2" - CLDFLAGS="$CLDFLAGS -Wl,--version-script,.export.sym" + CLDFLAGS="$LDFLAGS $CLDFLAGS -Wl,--version-script,.export.sym" ELDFLAGS="-Wl,--export-dynamic" # FIXME Generate list and use --dynamic-list=.dlopen.sym CLDWHOLEARCHIVE="-Wl,-whole-archive" @@ -1333,6 +1333,7 @@ AC_SUBST(BUILD_LVMETAD) AC_SUBST(CFLAGS) AC_SUBST(CFLOW_CMD) +AC_SUBST(LDFLAGS) AC_SUBST(CLDFLAGS) AC_SUBST(CLDNOWHOLEARCHIVE) AC_SUBST(CLDWHOLEARCHIVE)
signature.asc
Description: Digital signature