dpkg-buildflags: Add support for new hardening flag stackprotectorstrong

This flag is now part of the default set on Debian and derivatives, but
it will fallback to stackprotector when the former is not functional or
disabled by the user.

Based-on-patch-by: Romain Francoise <rfrancoise@debian.org>

debian/changelog

@@ -34,6 +34,10 @@ dpkg (1.17.11) UNRELEASED; urgency=low
     Closes: #7330, #24934, #112131, #134582, #180316
   * On removal check Depends and Pre-Depends for packages in unpacked and
     half-configured states too.
+  * Add support for new hardening build flag stackprotectorstrong in Debian
+    and derivatives, enabled by default. It will fallback to stackprotector
+    when the former is not functional or disabled by the user.
+    Thanks to Romain Francoise <rfrancoise@debian.org>.
 
   [ Updated programs translations ]
   * Danish (Joe Dalton). Closes: #754127

man/dpkg-buildflags.1

@@ -249,8 +249,8 @@ support will be disabled, due to new warnings being issued by
 glibc 2.16 and later.
 .TP
 .B stackprotector
-This setting (enabled by default) adds
-.B \-fstack-protector \-\-param=ssp\-buffer\-size=4
+This setting (enabled by default if stackprotectorstrong is not in use) adds
+.B \-fstack\-protector \-\-param=ssp\-buffer\-size=4
 to \fBCFLAGS\fP, \fBCXXFLAGS\fP, \fBOBJCFLAGS\fP, \fBOBJCXXFLAGS\fP,
 \fBGCJFLAGS\fP, \fBFFLAGS\fP and \fBFCFLAGS\fP.
 This adds safety checks against stack
@@ -264,6 +264,20 @@ This feature requires linking against glibc (or another provider of
 \fB\-nostdlib\fP or \fB\-ffreestanding\fP or similar.
 .
 .TP
+.B stackprotectorstrong
+This setting (enabled by default) adds
+.B \-fstack\-protector\-strong
+to \fBCFLAGS\fP, \fBCXXFLAGS\fP, \fBOBJCFLAGS\fP, \fBOBJCXXFLAGS\fP,
+\fBGCJFLAGS\fP, \fBFFLAGS\fP and \fBFCFLAGS\fP.
+This is a stronger variant of \fBstackprotector\fP, but without significant
+performance penalties.
+
+Disabling \fBstackprotector\fP will also disable this setting.
+
+This feature has the same requirements as \fBstackprotector\fP, and in
+addition also requires gcc 4.9 and later.
+.
+.TP
 .B relro
 This setting (enabled by default) adds
 .B \-Wl,\-z,relro

scripts/Dpkg/Vendor/Debian.pm

@@ -87,6 +87,7 @@ sub add_hardening_flags {
     my %use_feature = (
 	pie => 0,
 	stackprotector => 1,
+	stackprotectorstrong => 1,
 	fortify => 1,
 	format => 1,
 	relro => 1,
@@ -129,6 +130,12 @@ sub add_hardening_flags {
 	#   compiler supports it incorrectly (leads to SEGV)
 	$use_feature{stackprotector} = 0;
     }
+    if ($arch =~ /^(?:m68k|or1k|powerpcspe|sh4|x32)$/) {
+	# "Strong" stack protector disabled on m68k, or1k, powerpcspe, sh4, x32.
+	#   It requires GCC 4.9 and these archs are still using 4.8 as of
+	#   gcc-defaults 1.128.
+	$use_feature{stackprotectorstrong} = 0;
+    }
     if ($cpu =~ /^(?:ia64|hppa|avr32)$/) {
 	# relro not implemented on ia64, hppa, avr32.
 	$use_feature{relro} = 0;
@@ -146,6 +153,10 @@ sub add_hardening_flags {
 	# hardening ability without relro and may incur load penalties.
 	$use_feature{bindnow} = 0;
     }
+    if ($use_feature{stackprotector} == 0) {
+	# Disable stackprotectorstrong if stackprotector is disabled.
+	$use_feature{stackprotectorstrong} = 0;
+    }
 
     # PIE
     if ($use_feature{pie}) {
@@ -160,7 +171,16 @@ sub add_hardening_flags {
     }
 
     # Stack protector
-    if ($use_feature{stackprotector}) {
+    if ($use_feature{stackprotectorstrong}) {
+	my $flag = '-fstack-protector-strong';
+	$flags->append('CFLAGS', $flag);
+	$flags->append('OBJCFLAGS', $flag);
+	$flags->append('OBJCXXFLAGS', $flag);
+	$flags->append('FFLAGS', $flag);
+	$flags->append('FCFLAGS', $flag);
+	$flags->append('CXXFLAGS', $flag);
+	$flags->append('GCJFLAGS', $flag);
+    } elsif ($use_feature{stackprotector}) {
 	$flags->append('CFLAGS', '-fstack-protector --param=ssp-buffer-size=4');
 	$flags->append('OBJCFLAGS', '-fstack-protector --param=ssp-buffer-size=4');
 	$flags->append('OBJCXXFLAGS', '-fstack-protector --param=ssp-buffer-size=4');