1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
#! /usr/bin/perl
use strict;
use warnings;
use File::Spec qw(rel2abs);
use File::Basename;
my @args = ();
my $enabled = 0;
my $debug = 0;
my $debug_symlinks = 0;
# Set up defaults
my %default;
$default{'DEB_BUILD_HARDENING'}=0;
$default{'DEB_BUILD_HARDENING_DEBUG'}=0;
$default{'DEB_BUILD_HARDENING_DEBUG_SYMLINKS'}=0;
# Architecture settings
# #OS# #CPU#
$default{'DEB_BUILD_HARDENING_STACKPROTECTOR'}=1;
$default{'DEB_BUILD_HARDENING_FORTIFY'}=1;
$default{'DEB_BUILD_HARDENING_FORMAT'}=1;
$default{'DEB_BUILD_HARDENING_PIE'}=1;
# System settings
my $system_conf = '/etc/hardening-wrapper.conf';
if (-r $system_conf) {
open(CONF,$system_conf) || warn "Cannot read $system_conf\n";
while (my $line = <CONF>) {
if ($line =~ /^\s*(DEB_BUILD_HARDENING[_A-Z]*)\s*=\s*(\d)$/) {
$default{$1}=$2+0;
}
}
close(CONF);
}
# Environment settings
$enabled = defined($ENV{'DEB_BUILD_HARDENING'}) ?
$ENV{'DEB_BUILD_HARDENING'} :
$default{'DEB_BUILD_HARDENING'};
$debug = defined($ENV{'DEB_BUILD_HARDENING_DEBUG'}) ?
$ENV{'DEB_BUILD_HARDENING_DEBUG'} :
$default{'DEB_BUILD_HARDENING_DEBUG'};
$debug_symlinks = defined($ENV{'DEB_BUILD_HARDENING_DEBUG_SYMLINKS'}) ?
$ENV{'DEB_BUILD_HARDENING_DEBUG_SYMLINKS'} :
$default{'DEB_BUILD_HARDENING_DEBUG_SYMLINKS'};
my $force_stack = defined($ENV{'DEB_BUILD_HARDENING_STACKPROTECTOR'}) ?
$ENV{'DEB_BUILD_HARDENING_STACKPROTECTOR'} :
$default{'DEB_BUILD_HARDENING_STACKPROTECTOR'};
my $force_fortify = defined($ENV{'DEB_BUILD_HARDENING_FORTIFY'}) ?
$ENV{'DEB_BUILD_HARDENING_FORTIFY'} :
$default{'DEB_BUILD_HARDENING_FORTIFY'};
my $force_format = defined($ENV{'DEB_BUILD_HARDENING_FORMAT'}) ?
$ENV{'DEB_BUILD_HARDENING_FORMAT'} :
$default{'DEB_BUILD_HARDENING_FORMAT'};
my $force_pie = defined($ENV{'DEB_BUILD_HARDENING_PIE'}) ?
$ENV{'DEB_BUILD_HARDENING_PIE'} :
$default{'DEB_BUILD_HARDENING_PIE'};
my $force_fPIE = defined($ENV{'DEB_BUILD_HARDENING_PIE'}) ?
$ENV{'DEB_BUILD_HARDENING_PIE'} :
$default{'DEB_BUILD_HARDENING_PIE'};
if ($enabled) {
# Scan arguments
my $linking = 1;
foreach my $arg (@ARGV) {
if ($arg eq "-fno-PIC" ||
$arg eq "-fno-pic" ||
$arg eq "-fno-PIE" ||
$arg eq "-fno-pie" ||
$arg eq "-nopie" ||
$arg eq "-static" ||
$arg eq "-shared" ||
$arg eq "-D__KERNEL__" ||
$arg eq "-nostdlib" ||
$arg eq "-nostartfiles")
{
# If any PIC or PIE things are explicitly disabled,
# disable all our PIE flags.
$force_fPIE = 0;
$force_pie = 0;
}
if ($arg eq "-fPIC" ||
$arg eq "-fpic")
{
# fPIC is a stricter version of fPIE, so don't use fPIE when
# we encounter fPIC. However, the inclusion of -fPIC does
# not mean we need to block the use of "-pie", which is still
# possible with fPIC.
$force_fPIE = 0;
}
if ($arg eq "-c") {
$linking = 0;
}
if ($arg =~ /^-D_FORTIFY_SOURCE(=|$)/) {
$force_fortify = 0;
}
if ($arg eq "-nostdlib") {
$force_stack = 0;
}
}
# Enable SSP by default
if ($force_stack) {
push(@args,'-fstack-protector');
}
# Enable -fPIE by default
if ($force_fPIE) {
push(@args, '-fPIE');
}
if ($force_pie) {
if ($linking) {
# "-pie" is really only meaningful when calling the linker
push(@args, '-pie');
}
}
# Enable glibc protections by default (-02 should already be defined...)
# (disable with -D_FORTIFY_SOURCE=0)
if ($force_fortify) {
push(@args,'-D_FORTIFY_SOURCE=2');
}
# Enable format string checking
if ($force_format) {
push(@args,'-Wformat','-Wformat-security');
}
}
my $self = "\Qhardened-cc\E";
my $link = "";
my $arg0 = File::Spec->rel2abs(basename($0),dirname($0));
my $tool = $arg0;
if ($tool =~ /$self$/) {
$tool = "/usr/bin/cc";
}
sub resolve_link($)
{
my $origin = $_[0];
my $link = readlink($origin);
return File::Spec->rel2abs($link,dirname($origin));
}
while (-l $tool && ($link = resolve_link($tool)) !~ /$self$/) {
print STDERR "$tool -> $link\n" if ($debug_symlinks);
$tool = $link;
}
if (-x "$tool.real") {
print STDERR "$tool -real> $tool.real\n" if ($debug_symlinks);
$tool = "$tool.real";
}
# Abort if we ended up on a circular symlink resolution
if ($tool eq $arg0) {
print STDERR "$tool: not found (hardened-cc could not find target)\n";
exit(127);
}
my @target = ($tool, @args, @ARGV);
print STDERR join(" ",@target),"\n" if ($debug);
exec @target or die "Unable to exec $target[0]: $!\n";
|