BLHC(1p) | User Contributed Perl Documentation | BLHC(1p) |
blhc - build log hardening check, checks build logs for missing hardening flags
blhc [options] <dpkg-buildpackage build log file>..
blhc is a small tool which checks build logs for missing hardening flags. It's licensed under the GPL 3 or later.
It's designed to check build logs generated by Debian's dpkg-buildpackage (or tools using dpkg-buildpackage like pbuilder or sbuild (which is used for the official buildd build logs)) to help maintainers detect missing hardening flags in their packages.
Only gcc is detected as compiler at the moment. If other compilers support hardening flags as well, please report them.
If there's no output, no flags are missing and the build log is fine.
See README for details about performed checks, auto-detection and limitations.
To suppress false positives you can embed the following string in the build log:
blhc: ignore-line-regexp: REGEXP
All lines fully matching REGEXP (see --ignore-line for details) will be ignored.
Please use this feature sparingly so that missing flags are not overlooked. If you find false positives which affect more packages please report a bug.
To generate this string simply use echo in "debian/rules"; make sure to use @ to suppress the echo command itself as it could also trigger a false positive. If the build process takes a long time edit the ".build" file in place and tweak the ignore string until blhc --all --debian package.build no longer reports any false positives.
Used to prevent false positives. This option can be specified multiple times.
Used to prevent false positives. This option can be specified multiple times.
NOTE: Not the input lines are checked, but the lines which are displayed in warnings (which have line continuation resolved).
Used to prevent false positives. This option can be specified multiple times.
Auto detection for --pie and --bindnow only works if at least one command uses the required hardening flag (e.g. -fPIE). Then it's required for all other commands as well.
Normal usage, parse a single log file.
blhc path/to/log/file
If there's no output, no flags are missing and the build log is fine.
Parse multiple log files. The exit code is ORed over all files.
blhc path/to/directory/with/log/files/*
Don't treat missing "-g" as error:
blhc --ignore-flag -g path/to/log/file
Don't treat missing "-pie" on kfreebsd-amd64 as error:
blhc --ignore-arch-flag kfreebsd-amd64:-pie path/to/log/file
Ignore lines consisting exactly of "./script gcc file" which would cause a false positive.
blhc --ignore-line '\./script gcc file' path/to/log/file
Ignore lines matching "./script gcc file" somewhere in the line.
blhc --ignore-line '.*\./script gcc file.*' path/to/log/file
Use blhc with pbuilder.
pbuilder path/to/package.dsc | tee path/log/file blhc path/to/file || echo flags missing
Assume this build log was created on a Debian system and thus don't warn about missing PIE flags if the current architecture injects them automatically (this is enabled in buildd mode per default). "--arch" is necessary if the build log contains no architecture information as written by dpkg-buildpackage.
blhc --debian --all --arch=amd64 path/to/log/file
The following tags are used in --buildd mode. In braces the additional data which is displayed.
CC test-a.c CC test-b.c CC test-c.c LD test
Most of the time either "export V=1" or "export verbose=1" in debian/rules fixes builds with hidden compiler flags. Sometimes ".SILENT" in a Makefile must be removed. And as last resort the Makefile must be patched to remove the "@"s hiding the real compiler commands.
The exit status is a "bit mask", each listed status is ORed when the error condition occurs to get the result.
Simon Ruderich, <simon@ruderich.org>
Thanks to to Bernhard R. Link <brlink@debian.org> and Jaria Alto <jari.aalto@cante.net> for their valuable input and suggestions.
Copyright (C) 2012-2020 by Simon Ruderich
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
2023-03-17 | perl v5.36.0 |