Your message dated Tue, 22 May 2012 15:21:19 +0000
with message-id <[email protected]>
and subject line Bug#665491: fixed in w3m 0.5.3-8
has caused the Debian Bug report #665491,
regarding w3m: CPPFLAGS hardening flags missing
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
665491: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665491
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: w3m
Version: 0.5.3-5
Severity: important
Tags: patch
Dear Maintainer,
The CPPFLAGS hardening flags are missing because they are not set
in debian/rules.
The following patch and the attached patch fixes the issue.
The patch also enables all hardening options (including PIE and
bindnow) because w3m interprets untrusted data [1].
diff -Nru w3m-0.5.3/debian/rules w3m-0.5.3/debian/rules
--- w3m-0.5.3/debian/rules 2011-11-28 17:20:06.000000000 +0100
+++ w3m-0.5.3/debian/rules 2012-03-24 17:38:09.000000000 +0100
@@ -2,8 +2,11 @@
#export DH_VERBOSE=1
-CFLAGS=$(shell dpkg-buildflags --get CFLAGS)
-LDFLAGS=$(shell dpkg-buildflags --get LDFLAGS)
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+dpkg_buildflags = DEB_BUILD_MAINT_OPTIONS=$(DEB_BUILD_MAINT_OPTIONS)
dpkg-buildflags
+CFLAGS=$(shell $(dpkg_buildflags) --get CFLAGS)
+CPPFLAGS=$(shell $(dpkg_buildflags) --get CPPFLAGS)
+LDFLAGS=$(shell $(dpkg_buildflags) --get LDFLAGS)
ifeq ($(DEB_BUILD_GNU_SYSTEM),linux-gnu)
DEVS=x11,fb+s
@@ -28,7 +31,7 @@
build-stamp:
dh_testdir
cd $(builddir) && dh_autotools-dev_updateconfig
- cd $(builddir) && CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" ./configure
$(confargs)
+ cd $(builddir) && CFLAGS="$(CFLAGS)" CPPFLAGS="$(CPPFLAGS)"
LDFLAGS="$(LDFLAGS)" ./configure $(confargs)
cd $(builddir) && LC_ALL=C $(MAKE) OPTS="-Wall -g -DDEBIAN"
cd $(builddir)/po && LC_ALL=C $(MAKE) update-gmo
touch build-stamp
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/w3m /usr/lib/w3m/cgi-bin/w3mhelperpanel
/usr/lib/w3m/cgi-bin/w3mbookmark ...
/usr/bin/w3m:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
/usr/lib/w3m/cgi-bin/w3mhelperpanel:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
/usr/lib/w3m/cgi-bin/w3mbookmark:
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: yes
...
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use CPPFLAGS from environment (dpkg-buildflags).
Necessary for hardening flags.
Author: Simon Ruderich <[email protected]>
Last-Update: 2012-03-24
--- w3m-0.5.3.orig/Makefile.in
+++ w3m-0.5.3/Makefile.in
@@ -150,7 +150,7 @@ parsetagx.o: html.c
funcname.tab: $(DEFUNS)
(echo '#define DEFUN(x,y,z) x y';\
- sed -ne '/^DEFUN/{p;n;/^[ ]/p;}' $(DEFUNS)) | $(CPP) - | \
+ sed -ne '/^DEFUN/{p;n;/^[ ]/p;}' $(DEFUNS)) | $(CPP) $(CPPFLAGS) - | \
awk '$$1 ~ /^[_A-Za-z]/ { \
for (i=2;i<=NF;i++) { print $$i, $$1} \
}' > [email protected]
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: w3m
Source-Version: 0.5.3-8
We believe that the bug you reported is fixed in the latest version of
w3m, which is due to be installed in the Debian FTP archive:
w3m-img_0.5.3-8_i386.deb
to main/w/w3m/w3m-img_0.5.3-8_i386.deb
w3m_0.5.3-8.debian.tar.gz
to main/w/w3m/w3m_0.5.3-8.debian.tar.gz
w3m_0.5.3-8.dsc
to main/w/w3m/w3m_0.5.3-8.dsc
w3m_0.5.3-8_i386.deb
to main/w/w3m/w3m_0.5.3-8_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Tatsuya Kinoshita <[email protected]> (supplier of updated w3m package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 22 May 2012 23:16:58 +0900
Source: w3m
Binary: w3m w3m-img
Architecture: source i386
Version: 0.5.3-8
Distribution: unstable
Urgency: low
Maintainer: Tatsuya Kinoshita <[email protected]>
Changed-By: Tatsuya Kinoshita <[email protected]>
Description:
w3m - WWW browsable pager with excellent tables/frames support
w3m-img - inline image extension support utilities for w3m
Closes: 282784 615843 665491 673123
Changes:
w3m (0.5.3-8) unstable; urgency=low
.
* debian/patches/010_upstream.patch: Sync with upstream on 2012-05-22
- Support <meta charset>
* debian/patches/050_entity-h-clean.patch: Removed (meged upstream)
* debian/patches/110_form-input-text.patch:
- Assume "text" if an input type is unknown (closes: #615843)
* debian/patches/100_use-cppflags.patch: Use $(CPPFLAGS) with $(CPP)
* debian/rules:
- Fix CPPFLAGS hardening flags missing (closes: #665491)
- Accept linux-gnueabi for w3m-img (closes: #673123)
* debian/mime: Use charset for mailcap (closes: #282784)
Checksums-Sha1:
26562cc237f084994693470b7beda025429ebb3e 2038 w3m_0.5.3-8.dsc
a67f3f7ddc04ba775dc61dd1804517d1d71c8dfb 33108 w3m_0.5.3-8.debian.tar.gz
943f93cdb5a55cdef76d39eb900d7041a6a1a1d2 1245824 w3m_0.5.3-8_i386.deb
60222ba316e8304a6e80043302306ecac7fb5a24 114564 w3m-img_0.5.3-8_i386.deb
Checksums-Sha256:
df839559748370a500080a13148e634cf60be05c6b7a1df1d29b31c9869e0d91 2038
w3m_0.5.3-8.dsc
825c58907e253fce6219f2dc992e3c38ac7ba0761b1418dd495d4db0d6f1e72f 33108
w3m_0.5.3-8.debian.tar.gz
c6fc088a728ee1d952fb9dfae70b6e9fdd33e1e64324dadc49cfaae8507e7269 1245824
w3m_0.5.3-8_i386.deb
0829c98528db3c77e7332a60d4a0c27c1f047fc576f784b4f54eba9293a7b0ae 114564
w3m-img_0.5.3-8_i386.deb
Files:
c5e0b7e8c880e0c2819ed03da30d6e0e 2038 web standard w3m_0.5.3-8.dsc
2da76159f2adc3c6a2424fec31219fbb 33108 web standard w3m_0.5.3-8.debian.tar.gz
79c9a94484541967f6cc5fbe4347a348 1245824 web standard w3m_0.5.3-8_i386.deb
4cc376b982ac44bc98d397d117ad76cc 114564 web optional w3m-img_0.5.3-8_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJPu6KmAAoJEOXvq5AIDqY8oj4QAIP02fMsUbkHRcjdb/mvFjY7
RQ97LUaUKDehF+vWNG436wImcF7IDkzZbix+1FlczEfbT1BhiZS76qU+s7Unoghq
l5U8NUeAZ0VSWU579hjP8c+qRyFhorz8awkXjVLr7VY3JNCFfNqP5Lf6i8MB1SDs
3c+vxWpSyeO7wb4+RhWHSKrNxO68Q2e4SDo5mcg7iXkgEkwCP5zN30Gc/px45oVc
UWYSVr27l7HcEwgSyBoVUbcxfIs1ycI6rlRU1zNzilf1v2RLmVDiRrpl3u7Z+10S
xqv8dlRh3UNVfq3FojddJCkBlfG1Q7uRxZJaJ8QHucrFhn34Il/786YLPyrkkIqW
WijCCUzGyUePWcWLUCtxz3uTk9gaeBMv0JV7bKVufSlHoNmczb+vu+jbYZxS/O7c
9PrqjFfaf/g22UPFj6dhzwITXkqca7pxK915azt0it4NAkbXwlli9NZ0Z5Di72jB
eCV/HJLKL9UQ7vKMtVI8ZXfAXliNI9MTI1gcF5D9GzRePmHPGcuwdMQjdjuJMTaZ
ZqlCpWn2ojcSEI/gdXQmrR0rVNHYAOqY0SlQ3TKKUX/TqKBaIBiUnSe2QxnirJxu
Wga1HohSEOxUHNISxzH9yXN2DdiaPmr+ptr7wn4cKIhhKZq/3IZRGtq7mZjeNbg9
l58BGkdEN/xy9k0ukC+n
=I6iU
-----END PGP SIGNATURE-----
--- End Message ---
