Hi Charles and all,<div><br></div><div>thanks again: Debian is teaching me how to do these things better.</div><div><br></div><div>I used part of your patch in LASTv199. (I didn't include the "+=" changes, because I think the purpose of those flag variables is to let you override them if you want to. You might consider including "-O3" in your override.)</div>
<div><br></div><div>By the way, in your "rules" file, I think "clean" is no longer needed (now in the upstream makefile), nor is "--directory src" (there is now a top-level makefile).</div><div>
<br></div><div>Please let me know if I misunderstood something.</div><div><br></div><div>Have a nice day,</div><div>Martin</div><div><a href="http://www.cbrc.jp/~martin/">http://www.cbrc.jp/~martin/</a></div><div><br><div class="gmail_quote">
On Mon, Apr 30, 2012 at 11:16 AM, Charles Plessy <span dir="ltr"><<a href="mailto:plessy@debian.org" target="_blank">plessy@debian.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Martin,<br>
<br>
please consider the patch below for the makefile of LAST. It<br>
allows to set the compiler, preprocessor and linker separately,<br>
which is the way Debian follows when passing 'hardening' flags<br>
(see below).<br>
<br>
Cheers,<br>
<br>
-- Charles<br>
<br>
Le Sat, Apr 07, 2012 at 06:47:11PM +0200, Simon Ruderich a écrit :<br>
> Package: last-align<br>
> Version: 198-1<br>
> Severity: important<br>
> Tags: patch<br>
><br>
> Dear Maintainer,<br>
><br>
> The hardening flags are missing because the build system ignores<br>
> them.<br>
><br>
> The attached patch fixes the issue, if possible it should be sent<br>
> to upstream.<br>
><br>
> To check if all flags were correctly enabled you can use<br>
> `hardening-check` from the hardening-includes package and check<br>
> the build log (hardening-check doesn't catch everything):<br>
><br>
> $ hardening-check /usr/bin/lastdb /usr/bin/lastal<br>
> /usr/bin/lastdb:<br>
> Position Independent Executable: no, normal executable!<br>
> Stack protected: yes<br>
> Fortify Source functions: no, only unprotected functions found!<br>
> Read-only relocations: yes<br>
> Immediate binding: no not found!<br>
> /usr/bin/lastal:<br>
> Position Independent Executable: no, normal executable!<br>
> Stack protected: yes<br>
> Fortify Source functions: yes (some protected functions found)<br>
> Read-only relocations: yes<br>
> Immediate binding: no not found!<br>
><br>
> (Position Independent Executable and Immediate binding is not<br>
> enabled by default.)<br>
><br>
> Use find -type f \( -executable -o -name \*.so\* \) -exec<br>
> hardening-check {} + on the build result to check all files.<br>
><br>
> Regards,<br>
> Simon<br>
><br>
> [1]: <a href="https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags" target="_blank">https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags</a><br>
> [2]: <a href="https://wiki.debian.org/HardeningWalkthrough" target="_blank">https://wiki.debian.org/HardeningWalkthrough</a><br>
> [3]: <a href="https://wiki.debian.org/Hardening" target="_blank">https://wiki.debian.org/Hardening</a><br>
> --<br>
> + privacy is necessary<br>
> + using gnupg <a href="http://gnupg.org" target="_blank">http://gnupg.org</a><br>
> + public key id: 0x92FEFDB7E44C32F9<br>
<br>
Description: Use build flags from environment (dpkg-buildflags).<br>
Necessary for hardening flags.<br>
Author: Simon Ruderich <<a href="mailto:simon@ruderich.org">simon@ruderich.org</a>><br>
Last-Update: 2012-04-07<br>
<br>
--- last-align-198.orig/makefile<br>
+++ last-align-198/makefile<br>
@@ -1,4 +1,4 @@<br>
-CXXFLAGS = -O3<br>
+CXXFLAGS += -O3<br>
all:<br>
@cd src && $(MAKE) CXXFLAGS="$(CXXFLAGS)"<br>
<br>
--- last-align-198.orig/src/makefile<br>
+++ last-align-198/src/makefile<br>
@@ -1,12 +1,12 @@<br>
CXX = g++<br>
CC = gcc<br>
<br>
-CXXFLAGS = -O3 -Wall -Wextra -Wcast-qual -Wswitch-enum -Wundef \<br>
+CXXFLAGS += -O3 -Wall -Wextra -Wcast-qual -Wswitch-enum -Wundef \<br>
-Wcast-align -Wno-long-long -ansi -pedantic<br>
# -Wconversion<br>
# -fomit-frame-pointer ?<br>
<br>
-CFLAGS = -Wall<br>
+CFLAGS += -Wall<br>
<br>
DBSRC = Alphabet.cc MultiSequence.cc CyclicSubsetSeed.cc \<br>
SubsetSuffixArray.cc LastdbArguments.cc io.cc fileMap.cc \<br>
@@ -50,16 +50,16 @@ OBJ = lambda_calculator.o<br>
all: lastdb lastal lastex<br>
<br>
lastdb: $(DBSRC) $(DBINC) makefile<br>
- $(CXX) $(CXXFLAGS) -o $@ $(DBSRC)<br>
+ $(CXX) $(CPPFLAGS) $(CXXFLAGS) $(LDFLAGS) -o $@ $(DBSRC)<br>
<br>
lastal: $(ALSRC) $(ALINC) makefile $(OBJ)<br>
- $(CXX) $(CXXFLAGS) -o $@ $(ALSRC) $(OBJ)<br>
+ $(CXX) $(CPPFLAGS) $(CXXFLAGS) $(LDFLAGS) -o $@ $(ALSRC) $(OBJ)<br>
<br>
lastex: $(EXSRC) $(EXINC) makefile<br>
- $(CXX) -Igumbel_params $(CXXFLAGS) -o $@ $(EXSRC)<br>
+ $(CXX) -Igumbel_params $(CPPFLAGS) $(CXXFLAGS) $(LDFLAGS) -o $@ $(EXSRC)<br>
<br>
$(OBJ): CA_code/*.c CA_code/*.h makefile<br>
- $(CC) $(CFLAGS) -c CA_code/lambda_calculator.c<br>
+ $(CC) $(CPPFLAGS) $(CFLAGS) -c CA_code/lambda_calculator.c<br>
<br>
clean:<br>
rm -f lastdb lastal lastex $(OBJ)<br>
</blockquote></div><br></div>