DragonX/hush3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auto merge of #2752 - syd0:fix-sec-hard-tests, r=daira

Browse Source 
Get the sec-hard tests to run correctly.

This fixes the way arguments were passed to security-check, and also
a typo in how BIND_NOW was being searched for in a list.

Also fix how symbol-check is invoked although that script isn't
currently used.
This commit is contained in:
Homu
2017-11-22 15:22:10 -08:00
parent 3092ba0a42 2d342736dc
commit df1c3debcc
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/devtools/security-check.py
View File

@@ -94,7 +94,7 @@ def check_ELF_RELRO(executable):
raise IOError('Error opening file') raise IOError('Error opening file')
for line in stdout.split(b'\n'): for line in stdout.split(b'\n'):
tokens = line.split() tokens = line.split()
if len(tokens)>1 and tokens[1] == b'(BIND_NOW)' or (len(tokens)>2 and tokens[1] == b'(FLAGS)' and b'BIND_NOW' in tokens[2]): if len(tokens)>1 and tokens[1] == b'(BIND_NOW)' or (len(tokens)>2 and tokens[1] == b'(FLAGS)' and b'BIND_NOW' in tokens[2:]):
have_bindnow = True have_bindnow = True
return have_gnu_relro and have_bindnow return have_gnu_relro and have_bindnow

4
src/Makefile.am
View File

@@ -573,13 +573,13 @@ clean-local:
check-symbols: $(bin_PROGRAMS) check-symbols: $(bin_PROGRAMS)
if GLIBC_BACK_COMPAT if GLIBC_BACK_COMPAT
@echo "Checking glibc back compat of [$(bin_PROGRAMS)]..." @echo "Checking glibc back compat of [$(bin_PROGRAMS)]..."
$(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(top_srcdir)/contrib/devtools/symbol-check.py < $(bin_PROGRAMS) $(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS)
endif endif
check-security: $(bin_PROGRAMS) check-security: $(bin_PROGRAMS)
if HARDEN if HARDEN
@echo "Checking binary security of [$(bin_PROGRAMS)]..." @echo "Checking binary security of [$(bin_PROGRAMS)]..."
$(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py < $(bin_PROGRAMS) $(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS)
endif endif
%.pb.cc %.pb.h: %.proto %.pb.cc %.pb.h: %.proto