From patchwork Sun Mar 12 08:27:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Schantl X-Patchwork-Id: 6691 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4PZCZd57KJz3x2l for ; Sun, 12 Mar 2023 08:27:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4PZCZZ6R8zz12X; Sun, 12 Mar 2023 08:27:18 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4PZCZZ4NGnz2ydF; Sun, 12 Mar 2023 08:27:18 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4PZCZY1h4kz2xQl for ; Sun, 12 Mar 2023 08:27:17 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4PZCZX0XtVz9Q; Sun, 12 Mar 2023 08:27:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1678609636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=BsrRCcA9lATuhs9SHu9XWKMF802HvdQQiVekppOKLNY=; b=DcBMZunRKFig1TD+F4FldBxw6NmDlortRM2PBvLhrUf+By/lnj1WoYXIqWVurPesjodP0w KkE8L0Do4F285TRm8oHsdMUIHS3V3qQzvjr45rBIluMng9QR5L49UxV8zJrgpmjNj0axXi kN+hsm3IO45vxJ7+33oU0TcFDbFoV7Oi9M5VteEZkow8OaG3UEBAmJniLA43f/KEs9Q1LZ WRyhfTKKFPK+qtgKu7nlcg8VtYvXUBx2Zy3RQbQlOOgvw47bwC5Yx4O+mUi6K0mHSJDBiH qRev0eKLn5c3FPOXM/1NYytBgdSatbPFT7e+hM/VcDByLHLV6wSRHf96NiCqWg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1678609636; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=BsrRCcA9lATuhs9SHu9XWKMF802HvdQQiVekppOKLNY=; b=hGQgfPTSIZ9+YAUqFR9e0bpNQ5FhCxeQkCkUNbFsB5riK+UEEUz8hFkYy42KiIiPz9rOjx qS7SzjuXB20MUvAg== From: Stefan Schantl To: development@lists.ipfire.org Subject: [PATCH] netpbm: Fix hardening Date: Sun, 12 Mar 2023 09:27:06 +0100 Message-Id: <20230312082706.86717-1-stefan.schantl@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" * Add some additional CFLAGS to workaround a gcc bug with enabled SSP. * Add patch to proper use our LDFLAGS when linking libnetpbm. * Disable stripping the binaries during install. Signed-off-by: Stefan Schantl --- netpbm/netpbm.nm | 9 ++++++++- netpbm/patches/netpbm-libnetpbm-use-ldflags.patch | 12 ++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 netpbm/patches/netpbm-libnetpbm-use-ldflags.patch diff --git a/netpbm/netpbm.nm b/netpbm/netpbm.nm index 49488e5fa..cbafb517c 100644 --- a/netpbm/netpbm.nm +++ b/netpbm/netpbm.nm @@ -5,7 +5,7 @@ name = netpbm version = 10.73.42 -release = 1 +release = 2 groups = System/Libraries url = https://netpbm.sourceforge.net/ @@ -37,6 +37,10 @@ build perl(English) end + CFLAGS += \ + -fno-builtin-exit \ + -D__noreturn__= + prepare_cmds # Create config file. cp -avf config.mk.in config.mk @@ -58,6 +62,9 @@ build echo 'JPEGHDR_DIR = %{includedir}' >> config.mk echo 'PNGHDR_DIR = %{includedir}' >> config.mk echo 'ZHDR_DIR = %{includedir}' >> config.mk + + # Do not strip the binaries during install. + echo 'STRIPFLAG =' >> config.mk end build diff --git a/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch new file mode 100644 index 000000000..21384cb26 --- /dev/null +++ b/netpbm/patches/netpbm-libnetpbm-use-ldflags.patch @@ -0,0 +1,12 @@ +diff -Nur a/lib/Makefile b/lib/Makefile +--- a/lib/Makefile 2019-06-29 01:07:55.000000000 +0200 ++++ b/lib/Makefile 2023-03-12 09:21:25.558949353 +0100 +@@ -128,7 +128,7 @@ + rm -f $@ + $(SYMLINK) $< $@ + libnetpbm.$(NETPBMLIBSUFFIX).$(MAJ).$(MIN): $(LIBOBJECTS) $(LIBOBJECTS_X) +- $(LD) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \ ++ $(LD) $(LDFLAGS) $(LDSHLIB) -o $@ $(LIBOBJECTS) $(LIBOBJECTS_X) \ + $(SHLIB_CLIB) -lm $(LADD) + endif +