← Back to branch summary

~ubuntu-branches/ubuntu/trusty/hardening-wrapper/trusty-proposed

« back to all changes in this revision

Viewing changes to tests/Makefile.common

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2011-02-18 10:57:52 UTC
  • Revision ID: james.westby@ubuntu.com-20110218105752-e6wc0gymc73jufua
Tags: 1.32
http://bugs.debian.org/587358
http://bugs.debian.org/596150
* debian/rules, debian/hardening-wrapper.{prerm,preinst,postinst}:
  remove gcc-4.1 diversions since it has been removed from unstable.
* hardened-cc, hardening.make: add "-Werror=format-security" by default
  (Closes: #587358).
* tests/Makefile.common, tests/format.c: add test for newly added
  "-Werror=format-security" default option.
* hardened-cc, hardening.make: add "--param ssp-buffer-size=4" by
  default to catch smaller character arrays.
* tests/Makefile.common, tests/ssp-buffer-size-{protect,skip}.c:
  add tests for newly added "--param ssp-buffer-size=4" default.
* debian/README.Debian: updated to include newly added options.
* hardened-cc: disable -fstack-protector when -ffreestanding used.
* hardening.make: provide examples for working around build-time
  collisions between "-fPIE" and "-fPIC" (Closes: #596150).

Show diffs side-by-side

added added

removed removed

Lines of Context:
tests/Makefile.common
24
24
        $(BUILD_TREE)/$(NAME)-test-linked \
25
25
        $(BUILD_TREE)/$(NAME)-test-fPIC-direct \
26
26
        $(BUILD_TREE)/$(NAME)-test-fPIC \
 
27
        $(BUILD_TREE)/$(NAME)-test-format-security \
 
28
        $(BUILD_TREE)/$(NAME)-test-ssp-buffer-size-protect \
 
29
        $(BUILD_TREE)/$(NAME)-test-ssp-buffer-size-skip \
27
30
        $(BUILD_EXTRA)
28
31
 
29
32
check: $(TESTS)
129
132
        $(CC) -fPIC $(CFLAGS) $(LDFLAGS) -o $@ $<
130
133
        $@
131
134
 
 
135
$(BUILD_TREE)/$(NAME)-test-format-security: format.c $(TEST_REQS)
 
136
        # Make sure build fails due to -Werror=format-security
 
137
        ! $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
 
138
        # Make sure build succeeds with -Wno-format-security
 
139
        $(CC) $(CFLAGS) -Wno-format-security $(LDFLAGS) -o $@ $<
 
140
 
 
141
$(BUILD_TREE)/$(NAME)-test-ssp-buffer-size-protect: ssp-buffer-size-protect.c $(TEST_REQS)
 
142
ifeq (1,$(DEB_BUILD_HARDENING_STACKPROTECTOR))
 
143
        # Make sure build stack-protects a small ssp buffer
 
144
        $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
 
145
        # Test Stack Protector
 
146
        nm $@ | egrep '__stack_chk_fail($$|@@GLIBC)'
 
147
else
 
148
        # Skipped SSP buffer size test
 
149
endif
 
150
 
 
151
$(BUILD_TREE)/$(NAME)-test-ssp-buffer-size-skip: ssp-buffer-size-skip.c $(TEST_REQS)
 
152
ifeq (1,$(DEB_BUILD_HARDENING_STACKPROTECTOR))
 
153
        # Make sure build does not stack-protects a tiny ssp buffer
 
154
        $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
 
155
        # Test Stack Protector is correctly skipped
 
156
        ! nm $@ | egrep '__stack_chk_fail($$|@@GLIBC)'
 
157
else
 
158
        # Skipped SSP buffer size test
 
159
endif