Bug#657523: Please enabled hardened build flags

[Simon Ruderich]

Dear Maintainer,

The LDFLAGS hardening flags are still missing in a few places:

    cc -shared -Wl,-soname,libdevmapper.so.1.02.1 [...] -o ioctl/libdevmapper.so.1.02.1
    cc -shared -Wl,-soname,liblvm2cmd.so.2.02 [...] -o liblvm2cmd.so [...]
    cc -shared -Wl,-soname,liblvm2app.so.2.2 [...] -o liblvm2app.so.2.2
    cc -shared -Wl,-soname,libdevmapper.so.1.02.1 [...] -o ioctl/libdevmapper.so.1.02.1

The attached patch fixes the issue by modifying configure.ac. I
found no better way to fix the missing flags, but as autoreconf
is called anyway it shouldn't be too much trouble. If possible
the patch should be sent to upstream to fix the build system.

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):

    $ hardening-check /sbin/lvm /lib/x86_64-linux-gnu/liblvm2cmd.so.2.02 /lib/x86_64-linux-gnu/liblvm2app.so.2.2 /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 ...
    /sbin/lvm:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /lib/x86_64-linux-gnu/liblvm2cmd.so.2.02:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /lib/x86_64-linux-gnu/liblvm2app.so.2.2:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1:
     Position Independent Executable: no, regular shared library (ignored)
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    ...

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
-------------- next part --------------
A non-text attachment was scrubbed...
Name: use-dpkg-buildflags.patch
Type: text/x-diff
Size: 966 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-lvm-maintainers/attachments/20120527/199a88d1/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-lvm-maintainers/attachments/20120527/199a88d1/attachment.pgp>