Przeglądaj źródła

dpkg-buildflags(1): Add missing flags affected by hardening options

Guillem Jover 12 lat temu
rodzic
commit
d82f11f1e7
2 zmienionych plików z 6 dodań i 3 usunięć
  1. 1 0
      debian/changelog
  2. 5 3
      man/dpkg-buildflags.1

+ 1 - 0
debian/changelog

@@ -10,6 +10,7 @@ dpkg (1.17.7) UNRELEASED; urgency=low
     - Fix indentation of “Extract options (with -x)” title in dpkg-source(1).
     - Fix indentation of “Extract options (with -x)” title in dpkg-source(1).
     - Improve symlink <-> directory switch information in
     - Improve symlink <-> directory switch information in
       dpkg-maintscript-helper(1). Closes: #739388
       dpkg-maintscript-helper(1). Closes: #739388
+    - Add missing flags affected by hardening options to dpkg-buildflags(1).
   * Use exit instead of return to exit a subshell in dpkg-maintscript-helper.
   * Use exit instead of return to exit a subshell in dpkg-maintscript-helper.
     Thanks to Richard Levitte <richard@levitte.org>. Closes: #738957
     Thanks to Richard Levitte <richard@levitte.org>. Closes: #738957
   * Localize $_ in Perl functions with while (<$fh>) style loops.
   * Localize $_ in Perl functions with while (<$fh>) style loops.

+ 5 - 3
man/dpkg-buildflags.1

@@ -241,7 +241,8 @@ glibc 2.16 and later.
 .B stackprotector
 .B stackprotector
 This setting (enabled by default) adds
 This setting (enabled by default) adds
 .B \-fstack-protector \-\-param=ssp\-buffer\-size=4
 .B \-fstack-protector \-\-param=ssp\-buffer\-size=4
-to \fBCFLAGS\fP and \fBCXXFLAGS\fP. This adds safety checks against stack
+to \fBCFLAGS\fP, \fBCXXFLAGS\fP, \fBGCJFLAGS\fP and \fBFFLAGS\fP.
+This adds safety checks against stack
 overwrites. This renders many potential code injection attacks into
 overwrites. This renders many potential code injection attacks into
 aborting situations. In the best case this turns code injection
 aborting situations. In the best case this turns code injection
 vulnerabilities into denial of service or into non-issues (depending on
 vulnerabilities into denial of service or into non-issues (depending on
@@ -271,8 +272,9 @@ above). The option cannot become enabled if \fBrelro\fP is not enabled.
 .
 .
 .TP
 .TP
 .B pie
 .B pie
-This setting (disabled by default) adds \fB\-fPIE\fP to \fBCFLAGS\fP and
-\fBCXXFLAGS\fP, and \fB\-fPIE \-pie\fP to \fBLDFLAGS\fP. Position Independent
+This setting (disabled by default) adds \fB\-fPIE\fP to \fBCFLAGS\fP,
+\fBCXXFLAGS\fP, \fBGCJFLAGS\fP and \fBFFLAGS\fP,
+and \fB\-fPIE \-pie\fP to \fBLDFLAGS\fP. Position Independent
 Executable are needed to take advantage of Address Space Layout
 Executable are needed to take advantage of Address Space Layout
 Randomization, supported by some kernel versions. While ASLR can already
 Randomization, supported by some kernel versions. While ASLR can already
 be enforced for data areas in the stack and heap (brk and mmap), the code
 be enforced for data areas in the stack and heap (brk and mmap), the code