[Pkg-kde-extras] Bug#669189: kvirc: Hardening flags missing

[Simon Ruderich]

Package: kvirc
Version: 4:4.1.3+20111124.svn5988-1
Severity: normal
Tags: patch

Dear Maintainer,

The LDFLAGS hardening flags are missing because they are
overwritten in debian/rules. The other hardening flags are
missing because they are overwritten by the build system.

DEB_*_MAINT_APPEND is the preferred way to set additional flags
(see man dpkg-buildflags for more information). For more
hardening information please have a look at [1], [2] and [3].

The attached patch fixes the overwrite by the build system.

The following patch fixes the LDFLAGS issue:

diff -Nru kvirc-4.1.3+20111124.svn5988/debian/rules kvirc-4.1.3+20111124.svn5988/debian/rules
--- kvirc-4.1.3+20111124.svn5988/debian/rules	2011-09-29 16:26:40.000000000 +0200
+++ kvirc-4.1.3+20111124.svn5988/debian/rules	2012-04-18 02:28:16.000000000 +0200
@@ -2,6 +2,8 @@
 #
 DH_ALWAYS_EXCLUDE:=CVS:.svn:.svnignore:.hg:.hgignore
 
+export DEB_LDFLAGS_MAINT_APPEND = -Wl,--no-undefined -Wl,--as-needed
+
 DEBVERSION = $(shell head -n 1 debian/changelog | sed -e 's/^[^(]*(\([^)]*\)).*/\1/')
 UPVERSION = $(shell echo $(DEBVERSION) | sed -r -e 's/^.*://' -e 's/-[0-9.]*(\+b[0-9])?$$//' -e 's/.dfsg[0-9]*$$//')
 REV = $(shell echo $(UPVERSION) | sed -e 's/^.*svn//' -e 's/\+rc[0-9]$$//')
@@ -21,9 +23,6 @@
 	dh_auto_configure --parallel -Skde -- -DWANT_COEXISTENCE=OFF \
 			-DWANT_ESD=OFF -DWANT_OSS=OFF \
 			-DWANT_STRIP=OFF \
-			-DCMAKE_SHARED_LINKER_FLAGS="-Wl,--no-undefined -Wl,--as-needed" \
-			-DCMAKE_MODULE_LINKER_FLAGS="-Wl,--no-undefined -Wl,--as-needed" \
-			-DCMAKE_EXE_LINKER_FLAGS="-Wl,--no-undefined -Wl,--as-needed" \
 			-DMANUAL_REVISION=$(REV) \
 			-DLIB_SUFFIX="/$(DEB_HOST_MULTIARCH)"
 

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):

    $ hardening-check /usr/bin/kvirc /usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviwindow.so /usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviuserlist.so ...
    /usr/bin/kvirc:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: no, only unprotected functions found!
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviwindow.so:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: no, only unprotected functions found!
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/x86_64-linux-gnu/kvirc/4.1/modules/libkviuserlist.so:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: unknown, no protectable libc functions used
     Read-only relocations: yes
     Immediate binding: no not found!
    ...

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 30_use_dpkg_buildflags.patch
Type: text/x-diff
Size: 1286 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-kde-extras/attachments/20120418/99ac6031/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-kde-extras/attachments/20120418/99ac6031/attachment.pgp>