[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#671270: marked as done (wxmaxima: CPPFLAGS hardening flags missing)

Your message dated Tue, 29 Apr 2014 10:04:55 +1200
with message-id <20140428220455.GA2863@gemse>
and subject line Re: Bug#671270: wxmaxima: CPPFLAGS hardening flags missing
has caused the Debian Bug report #671270,
regarding wxmaxima: CPPFLAGS hardening flags missing
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
671270: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=671270
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: wxmaxima
Version: 12.04.0-1
Severity: normal
Tags: patch

Dear Maintainer,

The CPPFLAGS hardening flags are missing because the build system
overwrites them in ./configure. For more hardening information
please have a look at [1], [2] and [3].

The attached patch fixes the issue, if possible it should be sent
to upstream.

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):

    $ hardening-check /usr/bin/wxmaxima
    /usr/bin/wxmaxima:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: no, only unprotected functions found!
     Read-only relocations: yes
     Immediate binding: no not found!

Fortify Source functions is still no, but now the CPPFLAGS are
passed correctly and thus will be used when possible in the
future.

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9

Description: Don't overwrite CPPFLAGS in ./configure.
 Necessary for (hardening) flags from dpkg-buildflags.
.
 $WX_CXXFLAGS contains CPPFLAGS and LDFLAGS. As it's called CXXFLAGS append it
 to CXXFLAGS.
Author: Simon Ruderich <simon@ruderich.org>
Last-Update: 2012-05-02

Index: wxmaxima-12.04.0/configure
===================================================================
--- wxmaxima-12.04.0.orig/configure	2012-05-02 22:19:20.028531219 +0200
+++ wxmaxima-12.04.0/configure	2012-05-02 22:26:09.676533036 +0200
@@ -4399,8 +4399,7 @@
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
    LIBS=$ac_save_LIBS
-   CXXFLAGS=$ac_save_CXXFLAGS
-   CPPFLAGS=$WX_CXXFLAGS
+   CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS"
 fi
 
 if test x"${win32}" = x"true" ; then
Index: wxmaxima-12.04.0/configure.in
===================================================================
--- wxmaxima-12.04.0.orig/configure.in	2012-05-02 22:19:20.028531219 +0200
+++ wxmaxima-12.04.0/configure.in	2012-05-02 22:19:53.996531369 +0200
@@ -130,8 +130,7 @@
                 AC_MSG_ERROR([Failed to compile a test program])])
    AC_LANG_RESTORE
    LIBS=$ac_save_LIBS
-   CXXFLAGS=$ac_save_CXXFLAGS
-   CPPFLAGS=$WX_CXXFLAGS
+   CXXFLAGS="$ac_save_CXXFLAGS $WX_CXXFLAGS"
 fi
 
 dnl

Attachment: signature.asc
Description: Digital signature


--- End Message ---
--- Begin Message --- 
fixed 671270 13.04.2-1
thanks

On Wed, May 02, 2012 at 10:31:08PM +0200, Simon Ruderich wrote:
> The CPPFLAGS hardening flags are missing because the build system
> overwrites them in ./configure. For more hardening information
> please have a look at [1], [2] and [3].
> 
> The attached patch fixes the issue, if possible it should be sent
> to upstream.

Upstream applied essentially the same change in 13.04.2 (or perhaps in
an earlier version not packaged for Debian), and you can see
"-D_FORTIFY_SOURCE=2" in the buildd logs for 13.04.2-1, so closing this
bug:

https://buildd.debian.org/status/fetch.php?pkg=wxmaxima&arch=i386&ver=13.04.2-1&stamp=1371660631

Cheers,
    Olly

--- End Message ---
Reply to: