Package: kvirc Version: 4:4.1.3+20111124.svn5988-1 Severity: normal Tags: patch
Dear Maintainer,
The LDFLAGS hardening flags are missing because they are
overwritten in debian/rules. The other hardening flags are
missing because they are overwritten by the build system.
DEB_*_MAINT_APPEND is the preferred way to set additional flags
(see man dpkg-buildflags for more information). For more
hardening information please have a look at [1], [2] and [3].
The attached patch fixes the overwrite by the build system.
The following patch fixes the LDFLAGS issue:
diff -Nru kvirc-4.1.3+20111124.svn5988/debian/rules
kvirc-4.1.3+20111124.svn5988/debian/rules
--- kvirc-4.1.3+20111124.svn5988/debian/rules 2011-09-29 16:26:40.000000000
+0200
+++ kvirc-4.1.3+20111124.svn5988/debian/rules 2012-04-18 02:28:16.000000000
+0200
@@ -2,6 +2,8 @@
#
DH_ALWAYS_EXCLUDE:=CVS:.svn:.svnignore:.hg:.hgignore
+export DEB_LDFLAGS_MAINT_APPEND = -Wl,--no-undefined -Wl,--as-needed
+
DEBVERSION = $(shell head -n 1 debian/changelog | sed -e
's/^[^(]*(\([^)]*\)).*/\1/')
UPVERSION = $(shell echo $(DEBVERSION) | sed -r -e 's/^.*://' -e
's/-[0-9.]*(\+b[0-9])?$$//' -e 's/.dfsg[0-9]*$$//')
REV = $(shell echo $(UPVERSION) | sed -e 's/^.*svn//' -e 's/\+rc[0-9]$$//')
@@ -21,9 +23,6 @@
dh_auto_configure --parallel -Skde -- -DWANT_COEXISTENCE=OFF \
-DWANT_ESD=OFF -DWANT_OSS=OFF \
-DWANT_STRIP=OFF \
- -DCMAKE_SHARED_LINKER_FLAGS="-Wl,--no-undefined
-Wl,--as-needed" \
- -DCMAKE_MODULE_LINKER_FLAGS="-Wl,--no-undefined
-Wl,--as-needed" \
- -DCMAKE_EXE_LINKER_FLAGS="-Wl,--no-undefined
-Wl,--as-needed" \
-DMANUAL_REVISION=$(REV) \
-DLIB_SUFFIX="/$(DEB_HOST_MULTIARCH)"
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):
$ hardening-check /usr/bin/kvirc
/usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviwindow.so
/usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviuserlist.so ...
/usr/bin/kvirc:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: no, only unprotected functions found!
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviwindow.so:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: no, not found!
Fortify Source functions: no, only unprotected functions found!
Read-only relocations: yes
Immediate binding: no not found!
/usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviuserlist.so:
Position Independent Executable: no, regular shared library (ignored)
Stack protected: no, not found!
Fortify Source functions: unknown, no protectable libc functions used
Read-only relocations: yes
Immediate binding: no not found!
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use build flags from environment (dpkg-buildflags).
Necessary for hardening flags.
Author: Simon Ruderich <si...@ruderich.org>
Last-Update: 2012-04-17
--- kvirc-4.1.3+20111124.svn5988.orig/CMakeLists.txt
+++ kvirc-4.1.3+20111124.svn5988/CMakeLists.txt
@@ -220,8 +220,8 @@ ELSE()
ENDIF()
IF(CMAKE_COMPILER_IS_GNUCXX)
#force gdb options
- SET(CMAKE_CXX_FLAGS "-O3 -fomit-frame-pointer -DNDEBUG --no-enforce-eh-specs -pipe --exec-charset=UTF-8 --input-charset=UTF-8 --no-implement-inlines --unit-at-a-time --fast-math")
- SET(CMAKE_C_FLAGS "-O3 -fomit-frame-pointer -DNDEBUG --no-enforce-eh-specs -pipe --exec-charset=UTF-8 --input-charset=UTF-8 --no-implement-inlines --unit-at-a-time --fast-math")
+ SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -O3 -fomit-frame-pointer -DNDEBUG --no-enforce-eh-specs -pipe --exec-charset=UTF-8 --input-charset=UTF-8 --no-implement-inlines --unit-at-a-time --fast-math")
+ SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O3 -fomit-frame-pointer -DNDEBUG --no-enforce-eh-specs -pipe --exec-charset=UTF-8 --input-charset=UTF-8 --no-implement-inlines --unit-at-a-time --fast-math")
INCLUDE(CheckCXXCompilerFlag)
CHECK_CXX_COMPILER_FLAG("-fvisibility-inlines-hidden" CXX_HAS_VIH_FLAG)
#gcc doesn't support visibility on PE/win32
signature.asc
Description: Digital signature
_______________________________________________ pkg-kde-extras mailing list pkg-kde-extras@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-kde-extras
