[Evolution] Bug#665278: gtkhtml4.0: Hardening flags missing

[Simon Ruderich]

Package: gtkhtml4.0
Version: 4.2.2-1
Severity: important
Tags: patch

Dear Maintainer,

The hardening flags are missing because CDBS can't use
DEB_*_MAINT_APPEND and DEB_BUILD_MAINT_OPTIONS directly but needs
buildflags.mk.

The following patch fixes that, it also uses +all to
automatically enable (possible) future hardening flags.

diff -Nru gtkhtml4.0-4.2.2/debian/rules gtkhtml4.0-4.2.2/debian/rules
--- gtkhtml4.0-4.2.2/debian/rules	2011-12-16 19:50:12.000000000 +0100
+++ gtkhtml4.0-4.2.2/debian/rules	2012-03-22 20:15:07.000000000 +0100
@@ -9,7 +9,10 @@
 GNOME_MODULE := gtkhtml
 
 export DEB_LDFLAGS_MAINT_APPEND=-Wl,-z,defs -Wl,--as-needed -Wl,-O1
-export DEB_BUILD_MAINT_OPTIONS=hardening=+pie,+bindnow
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all
+# CDBS only supports DEB_*_MAINT_APPEND and DEB_BUILD_MAINT_OPTIONS via
+# buildflags.mk.
+include /usr/share/dpkg/buildflags.mk
 
 DEB_CONFIGURE_EXTRA_FLAGS += --enable-static
 

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):

    $ hardening-check /usr/lib/libgtkhtml-editor-4.0.so.0.0.0 /usr/lib/debug/usr/lib/libgtkhtml-4.0.so.0.0.0 /usr/lib/debug/usr/lib/libgtkhtml-editor-4.0.so.0.0.0 /usr/lib/libgtkhtml-4.0.so.0.0.0
    /usr/lib/libgtkhtml-editor-4.0.so.0.0.0:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: unknown, no protectable libc functions used
     Read-only relocations: yes
     Immediate binding: yes
    /usr/lib/debug/usr/lib/libgtkhtml-4.0.so.0.0.0:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: unknown, not linked against libc
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/debug/usr/lib/libgtkhtml-editor-4.0.so.0.0.0:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: no, not found!
     Fortify Source functions: unknown, not linked against libc
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/lib/libgtkhtml-4.0.so.0.0.0:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: yes

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-evolution-maintainers/attachments/20120322/3e61e574/attachment.pgp>