Your message dated Fri, 08 Jun 2012 07:17:29 +0000
with message-id <[email protected]>
and subject line Bug#668120: fixed in theseus 1.6.2-2
has caused the Debian Bug report #668120,
regarding theseus: Hardening flags missing
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
668120: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668120
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: theseus
Version: 1.6.2-1
Severity: normal
Tags: patch
Dear Maintainer,
The hardening flags are missing because the build system ignores
them. For more hardening information please have a look at [1],
[2] and [3].
The two attached patches fix the issue. The first one
(21_use_dpkg_buildflags.patch) should be sent to upstream if
possible, the second (22_hardening_compile.patch) is only
necessary for the debian package. The second patch also sets
-Wno-error=unused-result to prevent a build failure - fixing all
those warnings is a lot of work.
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/bin/theseus
/usr/bin/theseus:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
Description: Use build flags from environment (dpkg-buildflags).
Necessary for hardening flags.
.
Also use CPPFLAGS and LDFLAGS where appropriate.
Author: Simon Ruderich <[email protected]>
Last-Update: 2012-04-09
Index: theseus-1.6.2/make.inc
===================================================================
--- theseus-1.6.2.orig/make.inc 2012-04-09 02:09:33.411167605 +0200
+++ theseus-1.6.2/make.inc 2012-04-09 02:10:23.355167827 +0200
@@ -25,7 +25,10 @@
#OPT = -O0 -ggdb
OPT = -O3 -ffast-math -fstrict-aliasing -funroll-loops -fomit-frame-pointer
WARN = -Werror -Wall -pedantic -std=c99 #-Wstrict-aliasing=2
-CFLAGS = $(WARN) #-force_cpusubtype_ALL -mmacosx-version-min=10.4 -arch x86_64 -arch i386 #-DNDEBUG
+CFLAGS += $(WARN) #-force_cpusubtype_ALL -mmacosx-version-min=10.4 -arch x86_64 -arch i386 #-DNDEBUG
+# CPPFLAGS are ignored by the rest of the build system but necessary for
+# hardening flags.
+CFLAGS += $(CPPFLAGS)
CC = /usr/bin/gcc
#
Index: theseus-1.6.2/Makefile
===================================================================
--- theseus-1.6.2.orig/Makefile 2012-04-09 02:09:02.995167470 +0200
+++ theseus-1.6.2/Makefile 2012-04-09 02:09:34.139167608 +0200
@@ -36,12 +36,12 @@
distfitexe:
$(CC) $(OPT) $(CFLAGS) -c distfit.c
- $(CC) $(OPT) $(CFLAGS) $(LIBDIR) $(LAPACKLIBDIR) $(BLASLIBDIR) distfit.o $(LIBS) $(LAPACKLIB) $(BLASLIB) $(SYSLIBS) -o distfit
+ $(CC) $(OPT) $(CFLAGS) $(LDFLAGS) $(LIBDIR) $(LAPACKLIBDIR) $(BLASLIBDIR) distfit.o $(LIBS) $(LAPACKLIB) $(BLASLIB) $(SYSLIBS) -o distfit
# THESEUS-specific files
theseus: theseus.o $(OBJECTS)
- $(CC) $(OPT) $(CFLAGS) $(LIBDIR) $(LAPACKLIBDIR) $(BLASLIBDIR) theseus.o $(OBJECTS) $(LIBS) $(LAPACKLIB) $(BLASLIB) $(SYSLIBS) -o theseus
+ $(CC) $(OPT) $(CFLAGS) $(LDFLAGS) $(LIBDIR) $(LAPACKLIBDIR) $(BLASLIBDIR) theseus.o $(OBJECTS) $(LIBS) $(LAPACKLIB) $(BLASLIB) $(SYSLIBS) -o theseus
CovMat.o: CovMat.c
$(CC) $(OPT) $(CFLAGS) $(INCDIR) -c CovMat.c
Description: Fix compile with dpkg-buildflags.
Use -Wno-error=unused-result to ignore unimportant warnings and filter out
-O2.
Author: Simon Ruderich <[email protected]>
Last-Update: 2012-04-09
Index: theseus-1.6.2/make.inc
===================================================================
--- theseus-1.6.2.orig/make.inc 2012-04-09 02:10:23.355167827 +0200
+++ theseus-1.6.2/make.inc 2012-04-09 02:11:03.507168001 +0200
@@ -24,11 +24,14 @@
INSTALLDIR = /usr/local/bin
#OPT = -O0 -ggdb
OPT = -O3 -ffast-math -fstrict-aliasing -funroll-loops -fomit-frame-pointer
-WARN = -Werror -Wall -pedantic -std=c99 #-Wstrict-aliasing=2
+WARN = -Werror -Wno-error=unused-result -Wall -pedantic -std=c99 #-Wstrict-aliasing=2
CFLAGS += $(WARN) #-force_cpusubtype_ALL -mmacosx-version-min=10.4 -arch x86_64 -arch i386 #-DNDEBUG
# CPPFLAGS are ignored by the rest of the build system but necessary for
# hardening flags.
CFLAGS += $(CPPFLAGS)
+# Filter out -O2 which overwrites the default -O3 because OPT is used before
+# CFLAGS.
+CFLAGS := $(filter-out -O2,$(CFLAGS))
CC = /usr/bin/gcc
#
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: theseus
Source-Version: 1.6.2-2
We believe that the bug you reported is fixed in the latest version of
theseus, which is due to be installed in the Debian FTP archive:
theseus_1.6.2-2.debian.tar.gz
to main/t/theseus/theseus_1.6.2-2.debian.tar.gz
theseus_1.6.2-2.dsc
to main/t/theseus/theseus_1.6.2-2.dsc
theseus_1.6.2-2_amd64.deb
to main/t/theseus/theseus_1.6.2-2_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Tille <[email protected]> (supplier of updated theseus package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Fri, 08 Jun 2012 08:45:38 +0200
Source: theseus
Binary: theseus
Architecture: source amd64
Version: 1.6.2-2
Distribution: unstable
Urgency: low
Maintainer: Debian Med Packaging Team
<[email protected]>
Changed-By: Andreas Tille <[email protected]>
Description:
theseus - superimpose macromolecules using maximum likelihood
Closes: 668120
Changes:
theseus (1.6.2-2) unstable; urgency=low
.
* debian/upstream: Added missing space, fixed Name
* debian/patches: Two patches from Simon Ruderich
<[email protected]> to enable hardening (thanks to Simon)
Closes: #668120
Checksums-Sha1:
adcf93a867d69c59a2f2d42e5920d17af269a97d 1361 theseus_1.6.2-2.dsc
ec41551d7e556ebd0d5dd9d5bc48a45dccb3b916 14244 theseus_1.6.2-2.debian.tar.gz
76e6e5b76b24737e4cd019b5fa799d2b4c21a415 1506734 theseus_1.6.2-2_amd64.deb
Checksums-Sha256:
11ed6c4416a14a2dca2630f5c290c335fd8c6d8d4dfe275b52eaf582bbbf7411 1361
theseus_1.6.2-2.dsc
f117f409d54ff6f5c37eb72c198f86438fa45baad98736bb3a314c915ff75b2b 14244
theseus_1.6.2-2.debian.tar.gz
d57c79b9f04d034dea23d71aa6901151e62d50a46aba7c64106208cada11afe5 1506734
theseus_1.6.2-2_amd64.deb
Files:
988e04987c93a5e77f672f9d38b8bd5c 1361 science optional theseus_1.6.2-2.dsc
79a0081fdbe41f0cca4b5dd64beea7e6 14244 science optional
theseus_1.6.2-2.debian.tar.gz
6792b429489dc95117f2ad05ab137074 1506734 science optional
theseus_1.6.2-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAk/RovYACgkQYDBbMcCf01o/cACfchALVdbpg81h/6565J8oLHRi
CzEAmwUpOnpkWTdGpOLVKMQT3FUAcg6m
=K4bF
-----END PGP SIGNATURE-----
--- End Message ---
