[Pkg-citadel-devel] Bug#664518: webcit: LDFLAGS hardening flags missing

[Simon Ruderich]

Package: webcit
Version: 8.05-dfsg-1
Severity: important
Tags: patch

Dear Maintainer,

The LDFLAGS hardening flags are missing because they are not set
in debian/rules.

The following patch fixes the issue.

diff -u webcit-8.05-dfsg/debian/rules webcit-8.05-dfsg/debian/rules
--- webcit-8.05-dfsg/debian/rules
+++ webcit-8.05-dfsg/debian/rules
@@ -41,7 +41,7 @@
 ifneq "$(wildcard /usr/share/misc/config.guess)" ""
        cp -f /usr/share/misc/config.guess config.guess
 endif
-       CFLAGS="$(CFLAGS)" ./configure \
+       CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" ./configure \
                --host=$(DEB_HOST_GNU_TYPE) \
                --build=$(DEB_BUILD_GNU_TYPE) \
                --prefix=/usr/sbin/ \

The following patch disables the non-verbose build to make it
easy to (automatically) spot missing (hardening) flags. Please
apply it as well.

--- webcit-8.05-dfsg.orig/Makefile.in
+++ webcit-8.05-dfsg/Makefile.in
@@ -28,7 +28,7 @@
 mkdir-init:
        mkdir locale
 
-.SILENT:
+#.SILENT:
 
 .SUFFIXES: .cpp .c .o

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):

    $ hardening-check /usr/sbin/webcit
    /usr/sbin/webcit:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-citadel-devel/attachments/20120318/4284b1a6/attachment.pgp>