/hardening/master

To get this branch, use:
bzr branch https://alioth.debian.org/scm/loggerhead/hardening/master
132 by Kees Cook
Makefile, debian/*: convert to dh(1).
1
#!/usr/bin/make -f
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
2
#
132 by Kees Cook
Makefile, debian/*: convert to dh(1).
3
# Copyright (C) 2009-2012 Kees Cook <kees@debian.org>
97 by kees
add missed copyright to hardening.make file
4
# License: GPLv2 or newer
5
#
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
6
# This file is intended to be included in a Debian rules file so that the
7
# the calculated HARDENING_CFLAGS and HARDENING_LDFLAGS from this makefile
98 by kees
* hardening.make:
8
# can by used in the package's CFLAGS (and/or CXXFLAGS) and LDFLAGS to
106 by kees
* debian/README.Debian: update for gcc versions, include minimal
9
# harden the security of a package's resulting binaries. For example:
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
10
#
11
#   include /usr/share/hardening-includes/hardening.make
12
#   CFLAGS += $(HARDENING_CFLAGS)
13
#   LDFLAGS += $(HARDENING_LDFLAGS)
14
#
98 by kees
* hardening.make:
15
# and if you need it for C++ compilations:
16
#
17
#   CXXFLAGS += $(HARDENING_CFLAGS)
18
#
19
#
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
20
# By default, all hardening options that are valid for a given architecture
106 by kees
* debian/README.Debian: update for gcc versions, include minimal
21
# are enabled. The following can be set before or after including this
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
22
# makefile:
23
#   To disable all hardening:        DEB_BUILD_HARDENING:=0
24
#   To disable PIE:                  DEB_BUILD_HARDENING_PIE:=0
25
#   To disable stack protector:      DEB_BUILD_HARDENING_STACKPROTECTOR:=0
26
#   To disable Fortify Source:       DEB_BUILD_HARDENING_FORTIFY:=0
27
#   To disable format string checks: DEB_BUILD_HARDENING_FORMAT:=0
64 by kees
thanks and typo fix
28
#   To disable readonly relocations: DEB_BUILD_HARDENING_RELRO:=0
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
29
#   To disable BIND_NOW:             DEB_BUILD_HARDENING_BINDNOW:=0
30
#
31
# For more details, see https://wiki.debian.org/Hardening
63 by kees
debian/rules: fix up arch/arch-indep rules to avoid rebuilding
32
#
64 by kees
thanks and typo fix
33
# Thanks to Ryan Niebur for help with the Makefile magicks.
34
#
63 by kees
debian/rules: fix up arch/arch-indep rules to avoid rebuilding
35
# -- Kees Cook <kees@debian.org>
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
36
123 by Kees Cook
hardened-{cc,ld}, hardening.make, debian/rules: use DEB_HOST_ARCH instead
37
DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH 2>/dev/null)
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
38
DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS 2>/dev/null)
39
40
DEB_BUILD_HARDENING ?= 1
41
100 by kees
hardening.make: enable PIE on hurd (Closes: 586215), thanks to
42
ifneq (,$(filter $(DEB_HOST_ARCH_OS), linux knetbsd hurd ))
43
  # PIE enabled only on linux, knetbsd, and hurd (bugs 430455 and 586215)
123 by Kees Cook
hardened-{cc,ld}, hardening.make, debian/rules: use DEB_HOST_ARCH instead
44
  ifeq (,$(filter $(DEB_HOST_ARCH), hppa m68k mips mipsel avr32 ))
93 by kees
hardening.make: disable PIE on avr32 (Closes: 574716).
45
    # disabled on hppa (bug number needed)
46
    # disabled on m68k (bug 451192)
71 by kees
* hardening.make:
47
    # disabled on mips/mipsel (toolchain bug 532821)
93 by kees
hardening.make: disable PIE on avr32 (Closes: 574716).
48
    # disabled on avr32 (bug 574716)
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
49
    DEB_BUILD_HARDENING_PIE ?= 1
50
  endif
51
endif
52
DEB_BUILD_HARDENING_PIE ?= 0
53
150 by Kees Cook
* hardened-ld: detect symlink loops, like done for hardened-cc already
54
ifneq (,$(filter $(DEB_HOST_ARCH), ia64 alpha mips mipsel hppa arm arm64))
55
  # Stack protector disabled on ia64, alpha, mips, mipsel, hppa, arm64.
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
56
  #   "warning: -fstack-protector not supported for this target"
71 by kees
* hardening.make:
57
  # Stack protector disabled on arm (ok on armel).
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
58
  #   compiler supports it incorrectly (leads to SEGV)
150 by Kees Cook
* hardened-ld: detect symlink loops, like done for hardened-cc already
59
  # Stack protector support missing in glibc for arm64.
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
60
  DEB_BUILD_HARDENING_STACKPROTECTOR ?= 0
61
endif
62
DEB_BUILD_HARDENING_STACKPROTECTOR ?= 1
63
123 by Kees Cook
hardened-{cc,ld}, hardening.make, debian/rules: use DEB_HOST_ARCH instead
64
ifneq (,$(filter $(DEB_HOST_ARCH), ia64 hppa avr32 ))
84 by kees
tests/Makefile.{common,includes}: add HARDENING_DISABLE_* flags tests.
65
  DEB_BUILD_HARDENING_RELRO ?= 0
66
endif
67
DEB_BUILD_HARDENING_RELRO ?= 1
68
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
69
DEB_BUILD_HARDENING_FORTIFY ?= 1
70
DEB_BUILD_HARDENING_FORMAT ?= 1
71
DEB_BUILD_HARDENING_BINDNOW ?= 1
72
73
_HARDENED_PIE_CFLAGS  := -fPIE
74
_HARDENED_PIE_LDFLAGS := -fPIE -pie
75
114 by kees
* hardened-cc, hardening.make: add "--param ssp-buffer-size=4" by
76
_HARDENED_STACKPROTECTOR_CFLAGS := -fstack-protector --param ssp-buffer-size=4
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
77
122 by Kees Cook
* debian/control: update VCS tags for bzr.
78
# Fortify Source requires that -O1 or higher is used, but that should be
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
79
# handled outside of this include file.
80
_HARDENED_FORTIFY_CFLAGS  := -D_FORTIFY_SOURCE=2
81
112 by kees
* debian/rules, debian/hardening-wrapper.{prerm,preinst,postinst}:
82
_HARDENED_FORMAT_CFLAGS   := -Wformat -Wformat-security -Werror=format-security
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
83
84
_HARDENED_RELRO_LDFLAGS   := -Wl,-z,relro
85
86
_HARDENED_BINDNOW_LDFLAGS := -Wl,-z,now
87
88
_hardening_enabled = $(if $(filter $(DEB_BUILD_HARDENING), yes 1 on true),\
89
$(if $(filter $(1), yes 1 on true),$(2),),)
90
91
HARDENING_CFLAGS ?= \
92
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_PIE),$(_HARDENED_PIE_CFLAGS)) \
93
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_STACKPROTECTOR),$(_HARDENED_STACKPROTECTOR_CFLAGS)) \
94
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_FORTIFY),$(_HARDENED_FORTIFY_CFLAGS)) \
95
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_FORMAT),$(_HARDENED_FORMAT_CFLAGS)) \
96
97
HARDENING_LDFLAGS ?= \
98
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_PIE),$(_HARDENED_PIE_LDFLAGS)) \
99
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_RELRO),$(_HARDENED_RELRO_LDFLAGS)) \
100
$(call _hardening_enabled,$(DEB_BUILD_HARDENING_BINDNOW),$(_HARDENED_BINDNOW_LDFLAGS)) \
101
102
# Utility macros designed to allow package maintainer to force a given
103
# hardening feature off in certain areas of a build without disabling
106 by kees
* debian/README.Debian: update for gcc versions, include minimal
104
# the option for the entire build. For example:
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
105
#   CFLAGS += $(HARDENING_CFLAGS)
106
#   monkey.o: monkey.c
83 by kees
* hardening.make: correctly document how to disable PIE on a per-target
107
#       $(CC) $(CFLAGS) $(HARDENING_DISABLE_STACKPROTECTOR_CFLAGS) $< -o $@
108
HARDENING_DISABLE_STACKPROTECTOR_CFLAGS:=-fno-stack-protector
59 by kees
* debian/{control,rules}: add "hardening-includes" for use in other
109
HARDENING_DISABLE_FORTIFY_CFLAGS:=-U_FORTIFY_SOURCE
110
HARDENING_DISABLE_FORMAT_CFLAGS:=-Wno-format-security
111
HARDENING_DISABLE_RELRO_LDFLAGS:=-Wl,-z,norelro
112
HARDENING_DISABLE_BINDNOW_LDFLAGS:=-Wl,-z,lazy
116 by kees
hardening.make: provide examples for working around build-time
113
# Note: GCC does not have a way to just turn off pie (there is no "-nopie")
83 by kees
* hardening.make: correctly document how to disable PIE on a per-target
114
# so if PIE needs to be disabled for a specific target, the CFLAGS and LDFLAGS
106 by kees
* debian/README.Debian: update for gcc versions, include minimal
115
# need to be filtered. For example:
83 by kees
* hardening.make: correctly document how to disable PIE on a per-target
116
#   monkey: monkey.c
117
#       $(CC) $(filter-out $(HARDENING_DISABLE_PIE_CFLAGS_FILTER),$(CFLAGS)) \
118
#             $(filter-out $(HARDENING_DISABLE_PIE_LDFLAGS_FILTER),$(LDFLAGS)) \
119
#             $< -o $@
116 by kees
hardening.make: provide examples for working around build-time
120
#
121
# Note: when building shared libraries, or with some build frameworks (e.g.
122
# cmake) that pass "-fPIC" to everything, the "-fPIE" option must be filtered
123
# out to avoid building shared objects that need PIC but end up only with PIE.
124
# This is usually indicated by errors at link time that look like this:
125
#  relocation R_X86_64_PC32 against symbol `foo' can not be used when making a shared object; recompile with -fPIC
126
# In these cases, the CFLAGS can be filtered to exclude "-fPIE" until this
127
# is fixed in gcc correctly. For example, on one target:
128
#   monkey.o: monkey.c
129
#       $(CC) $(filter-out $(HARDENING_DISABLE_PIE_CFLAGS_FILTER),$(CFLAGS)) \
130
#             $< -c -o $@
131
# In cases where mixed shared objects and executable objects are being built,
132
# "-fPIC" needs to actually replace "-fPIE", since gcc won't distinguish
133
# between them yet. For example:
134
#   export CFLAGS=$(shell dpkg-buildflags --get CFLAGS)
135
#   CFLAGS += $(HARDENING_CFLAGS_PIC) \
136
#             $(filter-out $(HARDENING_DISABLE_PIE_CFLAGS_FILTER),$(HARDENING_CFLAGS))
137
#
83 by kees
* hardening.make: correctly document how to disable PIE on a per-target
138
HARDENING_DISABLE_PIE_CFLAGS_FILTER:=$(_HARDENED_PIE_CFLAGS)
139
HARDENING_DISABLE_PIE_LDFLAGS_FILTER:=$(_HARDENED_PIE_LDFLAGS)
116 by kees
hardening.make: provide examples for working around build-time
140
HARDENING_CFLAGS_PIC:=-fPIC