||<>|| While the DistCompilerFlags spec (and ensuing [[https://wiki.ubuntu.com/DistCompilerFlags|Debian discussion]]) matures, we need a way to test security hardening compiler options (in the hopes of implementing it distro-wide for Intrepid). The [[http://wiki.debian.org/Hardening|hardening-wrapper]] package installs wrappers for ld and gcc/g++ (4.1, 4.2, 4.3 -- 3.x is not included since it seems that it won't be in the archive for Intrepid, though these can be added if someone needs it). These options enable several features that make the resulting binaries more resistant to memory corruption vulnerability exploitation (making targets in the binary harder to find, reducing the number of targets, catching overflows before they happen, and warning about unsafe *printf usage during compile). Since many of the flags were adopted for Intrepid (see [[CompilerFlags]]), the wrapper in Ubuntu is mostly only useful for testing PIE compiles now. To perform package builds with the options enabled, a developer needs to do two things: * install hardening-wrapper (surprise!) * set the environment variable DEB_BUILD_HARDENING=1 (in hardening-wrapper 1.12 and later, /etc/hardening-wrapper.conf can hold system-wide default DEB_BUILD_HARDENING* variables) The hardening features can be individually disabled if there are complications during a build. The most likely build failures will be related to DEB_BUILD_HARDENING_PIE which has the largest impact on the built objects. Some strange packages are known not to work with this wrapper's implementation of the PIE compiler options. When build failures are found that are specific to enabling the hardening features, please open a bug against the failed package with this information and: * attach the build log when built with DEB_BUILD_HARDENING_DEBUG=1 enabled * tag the bug as "hardening-ftbfs" * discuss any tested work-arounds (does it compile with certain options disabled?) When performing compiles, also please keep an eye out for this kind of warning: {{{ foo.c: In function 'bar': foo.c:16: warning: format not a string literal and no format arguments }}} This indicates a (possibly) unsafe use of a *printf function (i.e. printf(strvar) when printf("%s",str) should be used), and should be investigated to make sure the package is not vulnerable to a format string attack. Please open bugs for these as well, and tag them "format-security". To catch libc runtime abort errors, they must be forced to STDERR by setting the environment variable {{{LIBC_FATAL_STDERR_=1}}}. (The trailing underscore is not a typo.) == Enabling == === native build === * install the {{{hardening-wrapper}}} package * {{{export DEB_BUILD_HARDENING=1}}} in your shell === single package === * add "hardening-wrapper" to Build-Depends * add {{{export DEB_BUILD_HARDENING=1}}} to {{{debian/rules}}}. === sbuild === * Set the environment variable "DEB_BUILD_HARDENING=1" * Add {{{-a "PKG: & hardening-wrapper"}}} to the command line, where '''PKG''' is the package you're building e.g.: {{{DEB_BUILD_HARDENING=1 sbuild -q -A -d hardy -b -a "hello: & hardening-wrapper" hello*.dsc}}} === pbuilder === * sudo pbuilder login --save-after-login * apt-get install hardening-wrapper * As you can't directly pass variable variables into pbuilder environment, use an editor (vi is available by default) to edit the wrapper, and set DEB_BUILD_HARDENING=1 by default == Common Failures == As with GccSsp, there will be some packages that do not compile correctly with the hardening-wrapper. As noted above, please try disabling various features to determine the cause of the failure, and document common cases here. Also please note specific package failures in the "Record of problems" section below. * PIE failure * Error looks like: {{{ relocation R_X86_64_32S against `__libc_csu_fini' can not be used when making a shared object; recompile with -fPIC}}} * Try setting {{{DEB_BUILD_HARDENING_PIE=0}}} == Archive Rebuild Logs == All of Hardy "main" was test-rebuilt with the hardening-wrapper. Attempts were made for full hardening, and with PIE disabled. Results: * hardening-wrapper 1.5: http://people.ubuntu.com/~kees/hardening/wrapper-1.5/ * hardening-wrapper 1.11: http://people.ubuntu.com/~kees/hardening/wrapper-1.11/ <> == Early PIE Targets == These candidates were chosen as they are network daemons provided either in tasksel or typical installations: * apache2 * mysql-dfsg-5.0 * bind9 * openldap * postfix * cups * openssh * postgresql-8.3 * samba * dovecot * dhcp3 All but mysq-dfsg-5.0 have been uploaded in Intrepid with PIE enabled. == Record of problems == * mysql fails subselect test during the i386 testsuite (see [https://launchpad.net/bugs/264155]). == How Debian is using the wrapper == * http://wiki.debian.org/Hardening * http://lists.debian.org/debian-devel-announce/2008/01/msg00006.html