Package: tabix Version: 0.2.5-2 Severity: important Tags: patch Dear Maintainer,
The LDFLAGS hardening flags are missing because the build system ignores them. For more hardening information please have a look at [1], [2] and [3]. The attached patch is a revised version of use-dpkg-buildflags.patch which fixes the issue. If possible it should be sent to upstream. It also fixes the usage of the *FLAGS variables. CFLAGS/CXXFLAGS are compiler flags for C/C++ files, CPPFLAGS are preprocessor flags (gcc -E), LDFLAGS are linker flags (there are some cases where the compiler generates code when linking, thus CFLAGS are also used when linking just to be sure). To check if all flags were correctly enabled you can use `hardening-check` from the hardening-includes package and check the build log (for example with blhc [4]) (hardening-check doesn't catch everything): $ hardening-check /usr/bin/bgzip /usr/bin/tabix /usr/bin/bgzip: Position Independent Executable: no, normal executable! Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! /usr/bin/tabix: Position Independent Executable: no, normal executable! Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: no not found! (Position Independent Executable and Immediate binding is not enabled by default.) Use find -type f \( -executable -o -name \*.so\* \) -exec hardening-check {} + on the build result to check all files. Regards, Simon [1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags [2]: https://wiki.debian.org/HardeningWalkthrough [3]: https://wiki.debian.org/Hardening [4]: http://ruderich.org/simon/blhc/ -- + privacy is necessary + using gnupg http://gnupg.org + public key id: 0x92FEFDB7E44C32F9
Index: tabix-0.2.5/Makefile =================================================================== --- tabix-0.2.5.orig/Makefile 2011-04-10 21:21:59.000000000 +0200 +++ tabix-0.2.5/Makefile 2012-04-28 20:58:45.385133446 +0200 @@ -1,5 +1,8 @@ CC= gcc -CFLAGS= -g -Wall -O2 -fPIC #-m64 #-arch ppc +# Use flags when CFLAGS is not already defined in the environment. +CFLAGS?= -g -Wall -O2 +# But always append special flags we need. +CFLAGS+= -fPIC #-m64 #-arch ppc DFLAGS= -D_FILE_OFFSET_BITS=64 -D_USE_KNETFILE LOBJS= bgzf.o kstring.o knetfile.o index.o bedidx.o AOBJS= main.o @@ -12,7 +15,7 @@ .SUFFIXES:.c .o .c.o: - $(CC) -c $(CFLAGS) $(DFLAGS) $(INCLUDES) $< -o $@ + $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DFLAGS) $(INCLUDES) $< -o $@ all-recur lib-recur clean-recur cleanlocal-recur install-recur: @target=`echo $@ | sed s/-recur//`; \ @@ -29,19 +32,19 @@ lib:libtabix.a libtabix.so.1:$(LOBJS) - $(CC) -shared -Wl,-soname,libtabix.so -o $@ $(LOBJS) -lc -lz + $(CC) $(CFLAGS) $(LDFLAGS) -shared -Wl,-soname,libtabix.so -o $@ $(LOBJS) -lc -lz libtabix.1.dylib:$(LOBJS) - libtool -dynamic $(LOBJS) -o $@ -lc -lz + libtool $(CFLAGS) $(LDFLAGS) -dynamic $(LOBJS) -o $@ -lc -lz libtabix.a:$(LOBJS) $(AR) -cru $@ $(LOBJS) tabix:lib $(AOBJS) - $(CC) $(CFLAGS) -o $@ $(AOBJS) -lm $(LIBPATH) -lz -L. -ltabix + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(AOBJS) -lm $(LIBPATH) -lz -L. -ltabix bgzip:bgzip.o bgzf.o knetfile.o - $(CC) $(CFLAGS) -o $@ bgzip.o bgzf.o knetfile.o -lz + $(CC) $(CFLAGS) $(LDFLAGS) -o $@ bgzip.o bgzf.o knetfile.o -lz TabixReader.class:TabixReader.java javac -cp .:sam.jar TabixReader.java
signature.asc
Description: Digital signature