Your message dated Fri, 18 Jul 2014 14:08:25 +0200 with message-id <1550183.KT03XLEZMd@gyllingar> and subject line Re: Bug#667925: bluedevil: CPPFLAGS hardening flags missing has caused the Debian Bug report #667925, regarding bluedevil: CPPFLAGS hardening flags missing to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 667925: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=667925 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: bluedevil Version: 1.2.2-1 Severity: important Tags: patch Dear Maintainer, The CPPFLAGS hardening flags are missing because CMake ignores them by default. The following patch fixes the issue by adding them to CFLAGS/CXXFLAGS. For more hardening information please have a look at [1], [2] and [3]. diff -Nru bluedevil-1.2.2/debian/rules bluedevil-1.2.2/debian/rules --- bluedevil-1.2.2/debian/rules 2012-03-30 20:36:51.000000000 +0200 +++ bluedevil-1.2.2/debian/rules 2012-04-07 16:49:43.000000000 +0200 @@ -2,5 +2,10 @@ export DEB_LDFLAGS_MAINT_APPEND := -Wl,--as-needed +# CMake doesn't use CPPFLAGS, pass them to CFLAGS/CXXFLAGS to enable the +# missing (hardening) flags. +export DEB_CFLAGS_MAINT_APPEND := $(shell dpkg-buildflags --get CPPFLAGS) +export DEB_CXXFLAGS_MAINT_APPEND := $(shell dpkg-buildflags --get CPPFLAGS) + %: dh $@ --parallel --with kde To check if all flags were correctly enabled you can use `hardening-check` from the hardening-includes package and check the build log (hardening-check doesn't catch everything): $ hardening-check /usr/lib/kde4/bluetoothfiletiemaction.so /usr/lib/kde4/kio_obexftp.so /usr/lib/kde4/kio_bluetooth.so ... /usr/lib/kde4/bluetoothfiletiemaction.so: Position Independent Executable: no, regular shared library (ignored) Stack protected: no, not found! Fortify Source functions: no, only unprotected functions found! Read-only relocations: yes Immediate binding: no not found! /usr/lib/kde4/kio_obexftp.so: Position Independent Executable: no, regular shared library (ignored) Stack protected: no, not found! Fortify Source functions: yes Read-only relocations: yes Immediate binding: no not found! /usr/lib/kde4/kio_bluetooth.so: Position Independent Executable: no, regular shared library (ignored) Stack protected: no, not found! Fortify Source functions: yes Read-only relocations: yes Immediate binding: no not found! ... (Position Independent Executable and Immediate binding is not enabled by default.) Use find -type f \( -executable -o -name \*.so\* \) -exec hardening-check {} + on the build result to check all files. Regards, Simon [1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags [2]: https://wiki.debian.org/HardeningWalkthrough [3]: https://wiki.debian.org/Hardening -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---Version: 2.0~rc1-1 Le samedi, 7 avril 2012 17.02:13, vous avez écrit : > The CPPFLAGS hardening flags are missing because CMake ignores > them by default. > > The following patch fixes the issue by adding them to > CFLAGS/CXXFLAGS. For more hardening information please have a > look at [1], [2] and [3]. As far as I could tell, bluedevil builds from at least 2.0~rc1-1 have used the default C{PP,XX,}FLAGS as provided by dpkg-buildflags through debhelper. Marking as done in this version. Cheers, OdyX
--- End Message ---
_______________________________________________ pkg-kde-extras mailing list pkg-kde-extras@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-kde-extras