[Pkg-kde-extras] Bug#663524: ktorrent: CPPFLAGS hardening flags missing

[Simon Ruderich]

Package: ktorrent
Version: 4.2.0-1
Severity: important
Tags: patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Dear Maintainer,

The CPPFLAGS hardening flags are missing because CMake ignores
them by default.

The following patch fixes the issue by adding them to
CFLAGS/CXXFLAGS. For more hardening information please have a
look at [1], [2] and [3].

    diff -Nru ktorrent-4.2.0/debian/rules ktorrent-4.2.0/debian/rules
    --- ktorrent-4.2.0/debian/rules 2012-03-10 22:04:39.000000000 +0100
    +++ ktorrent-4.2.0/debian/rules 2012-03-12 00:36:29.000000000 +0100
    @@ -1,5 +1,10 @@
     #!/usr/bin/make -f
     
    +# CMake doesn't use CPPFLAGS, pass them to CFLAGS/CXXFLAGS to enable the
    +# missing (hardening) flags.
    +export DEB_CFLAGS_MAINT_APPEND   = $(shell dpkg-buildflags --get CPPFLAGS)
    +export DEB_CXXFLAGS_MAINT_APPEND = $(shell dpkg-buildflags --get CPPFLAGS)
    +
     #DEB_KDE_LINK_WITH_AS_NEEDED := yes
     
     override_dh_auto_configure:

To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):

    $ hardening-check /usr/bin/ktupnptest /usr/bin/ktorrent /usr/bin/ktmagnetdownloader ...
    /usr/bin/ktupnptest:
     Position Independent Executable: no, normal executable!
     Stack protected: no, not found!
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/bin/ktorrent:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    /usr/bin/ktmagnetdownloader:
     Position Independent Executable: no, normal executable!
     Stack protected: yes
     Fortify Source functions: yes (some protected functions found)
     Read-only relocations: yes
     Immediate binding: no not found!
    ...

(Position Independent Executable and Immediate binding is not
enabled by default.)

Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening

- -- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-2-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJPXTeIAAoJEJL+/bfkTDL58U4P/jy8Unvmsn3OivuICxI5H6P1
2z6llYfn3NsG9Jsd4IA574rzlced6/XU6RURJwXv+diXyZBnPNoW1aMj9P6tkO/V
mp7KfZxkWaY9S/KklR+Lw/smP+VlaxK14VBNJQoas7LucxAHQHT2OHFk+zHPQu3Y
NFB3/qJ6EoauQiaEqTbNXJi2luFTXeqFeWV7WB9r7kFawUA4kT+pcf+HlKFZZ4WG
QXekKzNsoEEf3IhBd+EOC0Q4JZmASvAhqtasoZmw71KnVypP50m+9/cbKNIloP+Y
4IdGXsuqaMEnLKaLM0+UIsZoKLklO6awEvmDpgefzoI/ttHO2iKiwp4ns9XaZwt5
01gFQCsXM+iXgC4wjMQ7JkY/ZfMDDxYuS4q21AoPp0+La9ow690KKQmL3EV3yyUI
HyFHKVIaUfSRl59LgP4w88mSwZMmjY5DAYc1LT0g9hxJlmzQVOtXttaP05zEFKIx
JVuOcM6fdewwGkss361pyRa1ox9VUS6Sy7x3yej3d3E02j181xz0A3fJq2wIcnRi
wOtkr4E6NslQqTFyTE9QNFSTBHgfvTHkWmXYriJnryGDctolxSKBFhbCE2iglxM/
BIwbBgoAMBIGWCsalSw6LDsenDS11FA/tWN6qhUTg4xzryWm1C5tzSxh8pYNuVOC
WOohdkjSf4IYK6vo/cnt
=cbfg
-----END PGP SIGNATURE-----