Source: amanda Severity: normal Tags: patch User: debian...@lists.debian.org Usertags: hardening
Hardening options is a proposed release goal for Wheezy [1]. Having important package, interpreters and daemons compiled with the hardening options will add various protections against issues such as stack smashing, predictable locations of values in memory, etc. I have rebuilt the package with hardening options enabled and there was no error (during build, or at runtime). The attached patch adds a minimal modification to the debian/rules file to add support for hardening flags (other methods are available). Note that PIE and bindnow are not enabled by default, and that you can decide to enable this options for additional features (see the following link for details). You can control and enable/disable each hardening flag independently, see http://lists.debian.org/debian-devel-announce/2011/09/msg00001.html for details. Thanks, Pierre [1] http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
diff -ruN amanda-3.3.0.orig/debian/rules amanda-3.3.0/debian/rules --- amanda-3.3.0.orig/debian/rules 2011-09-13 23:13:04.000000000 +0200 +++ amanda-3.3.0/debian/rules 2011-10-05 21:45:44.225039861 +0200 @@ -3,6 +3,9 @@ export DH_VERBOSE=1 +DPKG_EXPORT_BUILDFLAGS = 1 +-include /usr/share/dpkg/buildflags.mk + r=$(shell pwd)/debian/amanda-common s=$(shell pwd)/debian/amanda-server c=$(shell pwd)/debian/amanda-client @@ -51,7 +54,7 @@ build-indep: build-stamp build-stamp: configure-stamp dh_testdir - MAILER=/usr/bin/mail $(MAKE) CFLAGS="-O2 -g -Wall \ + MAILER=/usr/bin/mail $(MAKE) CFLAGS="$(CFLAGS) -O2 -g -Wall \ -DAMANDATES_FILE='\"/var/lib/amanda/amandates\"' \ -DIGNORE_TAR_ERRORS " touch build-stamp
