Re: [Fedora-packaging] RFC mass bug reporting: checksec failures

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 09/16/2015 11:08 AM, Orion Poplawski wrote:
> On 09/16/2015 10:24 AM, Alexander Todorov wrote:
>> From today's Rawhide snapshot my script counted around 4500 offending
>> packages. You can find links to the script and execution log here:
>> http://atodorov.org/blog/2015/09/16/4000-bugs-in-fedora-checksec-failures/
>>
>>
>> Please let me know which packages need to genuinely be excluded and what
>> should we do with these packages ? Some will probably be fixed once they are
>> rebuilt but that may take a while.
>>
>> Any package maintainers out there - please fix your packages in Rawhide so we
>> don't have to file bugs for all of them.
> 
> I think we may have an issue with libtool throwing away the
> '-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1' option:
> 
> /bin/sh ../libtool  --tag=CC   --mode=link gcc -ansi -pedantic -Wall -W
> -Wundef -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-qual -Wcast-align
> -Wwrite-strings -Wconversion -Waggregate-return -Wstrict-prototypes
> -Wmissing-prototypes -Wmissing-declarations -Wredundant-decls -Wnested-externs
> -Winline -O -fomit-frame-pointer -finline-functions -O2 -g -pipe -Wall
> -Werror=format-s
> ecurity -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
> --param=ssp-buffer-size=4 -grecord-gcc-switches
> -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic
> -version-info 10:1 :0  -Wl,-z,relro
> -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -o libhdf5.la -rpath /usr/lib64
> H5.lo.... H5Ztrans.lo  -lz -ldl -lm
> 
> libtool: link: gcc -shared  -fPIC -DPIC  .libs/H5.o ... .libs/H5Ztrans.o   -lz
> -ldl -lm  -O -O2 -g -fstack-protector-strong -grecord-gcc-switches -m64
> -mtune=generic -Wl,-z -Wl,relro   -Wl,-soname -Wl,libhdf5.so.10 -o
> .libs/libhdf5.so.10.0.1
> 

Looks like this has been known for two years:

Bug 985592 libtool + %global _hardened_build 1 = no full hardening -
https://bugzilla.redhat.com/985592

Reported upstream but no response:

http://lists.gnu.org/archive/html/bug-libtool/2013-10/msg00000.html

Work around would be to use -Wc,-specs=...


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion@xxxxxxxx
Boulder, CO 80301                   http://www.nwra.com
-- 
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux