Bug#657523: Please enabled hardened build flags

[Simon Ruderich]

On Sun, May 27, 2012 at 11:56:24AM +0100, Alasdair G Kergon wrote:
> On Sun, May 27, 2012 at 02:42:14AM +0200, Simon Ruderich wrote:
>> -            CLDFLAGS="$CLDFLAGS -Wl,--version-script,.export.sym"
>> +            CLDFLAGS="$LDFLAGS $CLDFLAGS -Wl,--version-script,.export.sym"
>
> What are typical contents of the LDFLAGS environment variable in Debian?

This command prints the (current) value of LDFLAGS (on a current
sid/wheezy):

    dpkg-buildflags --get LDFLAGS

But $LDFLAGS already contains the correct value (and it shouldn't
be hardcoded in debian/rules).

> - Which cmdline parameters are getting lost?

All flags from LDFLAGS.

> - Which lines are 'losing' the enviroment LDFLAGS but actually need it?

The lines I pasted in my original patch. The LDFLAGS are missing
when building those libraries (use hardening-check to detect the
missing flags).

>> +AC_SUBST(LDFLAGS)
>
> Existing inconsistency/bug?
>  - make.tmpl.in has LDFLAGS += @LDFLAGS@

Yes, but it's not exported from ./configure without my change.

But I think the following (complete) patch is better than my
original one, it fixes LDFLAGS but passes CLDFLAGS via
debian/rules - thus removing the inconsistency:

diff -Nru lvm2-2.02.95/debian/rules lvm2-2.02.95/debian/rules
--- lvm2-2.02.95/debian/rules   2012-05-03 12:19:33.000000000 +0200
+++ lvm2-2.02.95/debian/rules   2012-05-27 14:45:24.000000000 +0200
@@ -71,7 +71,7 @@
        rm -rf $(DIR)
        cp -a '$(SOURCE_DIR)' '$(DIR)'
        cd $(DIR); \
-       ./configure CFLAGS="$(CPPFLAGS) $(CFLAGS)" LDFLAGS="$(LDFLAGS)" \
+       ./configure CFLAGS="$(CPPFLAGS) $(CFLAGS)" LDFLAGS="$(LDFLAGS)" 
CLDFLAGS="$(LDFLAGS)" \
                $(CONFIGURE_FLAGS) \
                --libdir=\$${exec_prefix}/lib/$(DEB_HOST_MULTIARCH) \
                --with-optimisation="$(CFLAGS_OPT_DEB)" \
@@ -95,7 +95,7 @@
        rm -rf $(DIR)
        cp -a '$(SOURCE_DIR)' '$(DIR)'
        cd $(DIR); \
-       ./configure CFLAGS="$(CPPFLAGS) $(CFLAGS)" LDFLAGS="$(LDFLAGS)" \
+       ./configure CFLAGS="$(CPPFLAGS) $(CFLAGS)" LDFLAGS="$(LDFLAGS)" 
CLDFLAGS="$(LDFLAGS)" \
                $(CONFIGURE_FLAGS) \
                --with-optimisation="$(CFLAGS_OPT_UDEB)" \
                --with-cluster=none \

--- lvm2-2.02.95.orig/configure.in
+++ lvm2-2.02.95/configure.in
@@ -1333,6 +1333,7 @@ AC_SUBST(BUILD_DMEVENTD)
 AC_SUBST(BUILD_LVMETAD)
 AC_SUBST(CFLAGS)
 AC_SUBST(CFLOW_CMD)
+AC_SUBST(LDFLAGS)
 AC_SUBST(CLDFLAGS)
 AC_SUBST(CLDNOWHOLEARCHIVE)
 AC_SUBST(CLDWHOLEARCHIVE)

Regards,
Simon
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9

pgpqFOfLFi2Vz.pgp
Description: PGP signature