Bug#657537: Please enable hardened build flags

[Simon Ruderich <simon@ruderich.org>]

reopen #657537
thanks

Dear Maintainer,

The hardening flags are missing in a few places because the build
system ignores them.

The attached patch fixes the issue, if possible it should be sent
upstream.

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):

    $ hardening-check /usr/sbin/ircd-hybrid /usr/lib/ircd-hybrid/modules/autoload/m_accept.so /usr/lib/ircd-hybrid/modules/autoload/m_admin.so /usr/lib/ircd-hybrid/modules/autoload/m_away.so ...
    /usr/sbin/ircd-hybrid:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/ircd-hybrid/modules/autoload/m_accept.so:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: unknown, no protectable libc functions used
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/ircd-hybrid/modules/autoload/m_admin.so:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: unknown, no protectable libc functions used
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/ircd-hybrid/modules/autoload/m_away.so:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: no, only unprotected functions found!
     Read-only relocations: yes
     Immediate binding: no not found!
    ...

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9

#! /bin/sh /usr/share/dpatch/dpatch-run
## Use build flags from environment (dpkg-buildflags).
## Necessary for hardening flags.
##
## All lines beginning with `## DP:' are a description of the patch.

@DPATCH@
Index: ircd-hybrid-7.2.2.dfsg.2/tools/Makefile.in
===================================================================
--- ircd-hybrid-7.2.2.dfsg.2.orig/tools/Makefile.in	2012-04-08 17:15:14.509825884 +0200
+++ ircd-hybrid-7.2.2.dfsg.2/tools/Makefile.in	2012-04-08 17:16:40.729826262 +0200
@@ -31,10 +31,10 @@
 
 # We must link these two against special libs
 encspeed: ../include/setup.h encspeed.c
-	$(CC) $(CFLAGS) $(INCLUDES) $(LDFLAGS) encspeed.c -o encspeed $(SSL_LIBS)
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES) $(LDFLAGS) encspeed.c -o encspeed $(SSL_LIBS)
 
 mkpasswd: ../include/setup.h mkpasswd.c
-	$(CC) $(CFLAGS) $(INCLUDES) $(LDFLAGS) mkpasswd.c -o mkpasswd $(CRYPT_LIB)
+	$(CC) $(CPPFLAGS) $(CFLAGS) $(INCLUDES) $(LDFLAGS) mkpasswd.c -o mkpasswd $(CRYPT_LIB)
 
 # Default rule for everything
 
Index: ircd-hybrid-7.2.2.dfsg.2/contrib/Makefile.in
===================================================================
--- ircd-hybrid-7.2.2.dfsg.2.orig/contrib/Makefile.in	2012-04-08 17:16:40.673826262 +0200
+++ ircd-hybrid-7.2.2.dfsg.2/contrib/Makefile.in	2012-04-08 17:16:58.965826342 +0200
@@ -13,6 +13,7 @@
 LD		= @LD@
 LN		= @LN@
 PICFLAGS	= @PICFLAGS@
+LDFLAGS		= @LDFLAGS@
 MKDEP		= @MKDEP@
 INSTALL		= @INSTALL@
 INSTALL_DATA	= @INSTALL_DATA@
@@ -115,7 +116,7 @@
 .SUFFIXES: .so .sl .o
 
 .c.so:
-	${CC} ${PICFLAGS} ${CPPFLAGS} ${CFLAGS} $< -o $@
+	${CC} ${PICFLAGS} ${CPPFLAGS} ${CFLAGS} ${LDFLAGS} $< -o $@
 
 .c.o:
 	${CC} ${CPPFLAGS} ${CFLAGS} -c $< -o $@
Index: ircd-hybrid-7.2.2.dfsg.2/modules/Makefile.in
===================================================================
--- ircd-hybrid-7.2.2.dfsg.2.orig/modules/Makefile.in	2012-04-08 17:16:40.673826262 +0200
+++ ircd-hybrid-7.2.2.dfsg.2/modules/Makefile.in	2012-04-08 17:16:40.729826262 +0200
@@ -10,6 +10,7 @@
 SEDOBJ		= @SEDOBJ@
 STDOUT		= @STDOUT@
 CFLAGS		= @IRC_CFLAGS@
+LDFLAGS		= @LDFLAGS@
 PICFLAGS	= @PICFLAGS@
 MKDEP		= @MKDEP@
 INSTALL		= @INSTALL@
@@ -178,7 +179,7 @@
 	${CC} ${CPPFLAGS} ${CFLAGS} -c $< -o $@
 
 .c.so:
-	${CC} ${PICFLAGS} ${CPPFLAGS} ${CFLAGS} $< -o $@
+	${CC} ${PICFLAGS} ${LDFLAGS} ${CPPFLAGS} ${CFLAGS} $< -o $@
 
 .so.sl:
 	$(LD) -b $< -o $@
Index: ircd-hybrid-7.2.2.dfsg.2/tools/rsa_respond/Makefile.in
===================================================================
--- ircd-hybrid-7.2.2.dfsg.2.orig/tools/rsa_respond/Makefile.in	2012-04-08 17:15:14.509825884 +0200
+++ ircd-hybrid-7.2.2.dfsg.2/tools/rsa_respond/Makefile.in	2012-04-08 17:16:40.729826262 +0200
@@ -3,12 +3,14 @@
 CC = @CC@
 LIBS = @LIBS@
 CFLAGS = @CFLAGS@
+CPPFLAGS = @CPPFLAGS@
+LDFLAGS = @LDFLAGS@
 INCLUDES = -I@INCLUDES@
 
 all: respond
 
 respond: respond.c
-	$(CC) $(CFLAGS) -o respond respond.c ${INCLUDES} ${LDFLAGS} ${LIBS}
+	$(CC) $(CFLAGS) $(CPPFLAGS) -o respond respond.c ${INCLUDES} ${LDFLAGS} ${LIBS}
 
 clean:
 	rm -f respond *.core *~ *.exe

Attachment: signature.asc
Description: Digital signature