Skip to contentSkip to conversation

sudo: fix -fstack-protector detection

PATCH New Vicente Olivert Riera 3 participants 3 messages Oct 30, 2015 – Oct 31, 2015

lore
Share & tools
lore

Vicente Olivert Riera

author
#0 lore raw

PATCH 1/1 sudo: fix -fstack-protector detection

Backport a patch series from upstream to fix the configure check for -fstack-protector.

Fixes:
http://autobuild.buildroot.net/results/bdd3e5352aa283b96717202a794f9762d15cc736/

Signed-off-by Vicente Olivert Riera <[email protected]>
---
 ...etter-configure-test-for-fstack-protector.patch |  415 ++++++++++++++++++++
 ...LDFLAGS-when-checking-for-stack-protector.patch |   81 ++++
 ...program-when-checking-for-stack-protector.patch |  189 +++++++++
 3 files changed, 685 insertions(+), 0 deletions(-)
 create mode 100644 package/sudo/0002-Better-configure-test-for-fstack-protector.patch
 create mode 100644 package/sudo/0003-Preserve-LDFLAGS-when-checking-for-stack-protector.patch
 create mode 100644 package/sudo/0004-Actually-link-the-test-program-when-checking-for-stack-protector.patch
package/sudo/0002-Better-configure-test-for-fstack-protector.patch new file +415 -0
new file mode 100644
index 0000000..b9ec410
@@ -0,0 +1,415 @@
+Better configure test for -fstack-protector. Some gcc installations may
+be missing the ssp library even though the compiler supports it.
+
+Backported from upstream:
+  http://www.sudo.ws/repos/sudo/rev/4ade5d1249f4
+
+Signed-off-by: Vicente Olivert Riera <[email protected]>
+
+# HG changeset patch
+# User Todd C. Miller <[email protected]>
+# Date 1446137469 21600
+# Node ID 4ade5d1249f483c4dd6c579c70b327791094afe8
+# Parent  97ee37d905ceefa433e93a0f552c2a3e5926e2fb
+Better configure test for -fstack-protector.  Some gcc installations
+may be missing the ssp library even though the compiler supports it.
+
+diff -r 97ee37d905ce -r 4ade5d1249f4 configure
+--- a/configure	Sun Oct 25 14:28:38 2015 -0600
++++ b/configure	Thu Oct 29 10:51:09 2015 -0600
+@@ -23916,236 +23916,94 @@
+ fi
+ 
+ if test "$enable_hardening" != "no"; then
+-    if test -n "$GCC"; then
+-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-protector-strong" >&5
+-$as_echo_n "checking whether C compiler accepts -fstack-protector-strong... " >&6; }
+-if ${ax_cv_check_cflags___fstack_protector_strong+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$CFLAGS
+-  CFLAGS="$CFLAGS  -fstack-protector-strong"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_compile "$LINENO"; then :
+-  ax_cv_check_cflags___fstack_protector_strong=yes
+-else
+-  ax_cv_check_cflags___fstack_protector_strong=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+-  CFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_protector_strong" >&5
+-$as_echo "$ax_cv_check_cflags___fstack_protector_strong" >&6; }
+-if test x"$ax_cv_check_cflags___fstack_protector_strong" = xyes; then :
+-
+-	    { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fstack-protector-strong" >&5
+-$as_echo_n "checking whether the linker accepts -fstack-protector-strong... " >&6; }
+-if ${ax_cv_check_ldflags___fstack_protector_strong+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$LDFLAGS
+-  LDFLAGS="$LDFLAGS  -fstack-protector-strong"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_link "$LINENO"; then :
+-  ax_cv_check_ldflags___fstack_protector_strong=yes
+-else
+-  ax_cv_check_ldflags___fstack_protector_strong=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext \
+-    conftest$ac_exeext conftest.$ac_ext
+-  LDFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fstack_protector_strong" >&5
+-$as_echo "$ax_cv_check_ldflags___fstack_protector_strong" >&6; }
+-if test x"$ax_cv_check_ldflags___fstack_protector_strong" = xyes; then :
+-
+-		SSP_CFLAGS="-fstack-protector-strong"
+-		SSP_LDFLAGS="-Wc,-fstack-protector-strong"
+-
+-else
+-  :
+-fi
+-
+-
+-else
+-  :
+-fi
+-
+-	if test -z "$SSP_CFLAGS"; then
+-	    { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-protector-all" >&5
+-$as_echo_n "checking whether C compiler accepts -fstack-protector-all... " >&6; }
+-if ${ax_cv_check_cflags___fstack_protector_all+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$CFLAGS
+-  CFLAGS="$CFLAGS  -fstack-protector-all"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_compile "$LINENO"; then :
+-  ax_cv_check_cflags___fstack_protector_all=yes
+-else
+-  ax_cv_check_cflags___fstack_protector_all=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+-  CFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_protector_all" >&5
+-$as_echo "$ax_cv_check_cflags___fstack_protector_all" >&6; }
+-if test x"$ax_cv_check_cflags___fstack_protector_all" = xyes; then :
+-
+-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fstack-protector-all" >&5
+-$as_echo_n "checking whether the linker accepts -fstack-protector-all... " >&6; }
+-if ${ax_cv_check_ldflags___fstack_protector_all+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$LDFLAGS
+-  LDFLAGS="$LDFLAGS  -fstack-protector-all"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_link "$LINENO"; then :
+-  ax_cv_check_ldflags___fstack_protector_all=yes
+-else
+-  ax_cv_check_ldflags___fstack_protector_all=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext \
+-    conftest$ac_exeext conftest.$ac_ext
+-  LDFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fstack_protector_all" >&5
+-$as_echo "$ax_cv_check_ldflags___fstack_protector_all" >&6; }
+-if test x"$ax_cv_check_ldflags___fstack_protector_all" = xyes; then :
+-
+-		    SSP_CFLAGS="-fstack-protector-all"
+-		    SSP_LDFLAGS="-Wc,-fstack-protector-all"
+-
+-else
+-  :
+-fi
+-
+-
+-else
+-  :
+-fi
+-
+-	    if test -z "$SSP_CFLAGS"; then
+-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fstack-protector" >&5
+-$as_echo_n "checking whether C compiler accepts -fstack-protector... " >&6; }
+-if ${ax_cv_check_cflags___fstack_protector+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$CFLAGS
+-  CFLAGS="$CFLAGS  -fstack-protector"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_compile "$LINENO"; then :
+-  ax_cv_check_cflags___fstack_protector=yes
+-else
+-  ax_cv_check_cflags___fstack_protector=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+-  CFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_cflags___fstack_protector" >&5
+-$as_echo "$ax_cv_check_cflags___fstack_protector" >&6; }
+-if test x"$ax_cv_check_cflags___fstack_protector" = xyes; then :
+-
+-		    { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -fstack-protector" >&5
+-$as_echo_n "checking whether the linker accepts -fstack-protector... " >&6; }
+-if ${ax_cv_check_ldflags___fstack_protector+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-
+-  ax_check_save_flags=$LDFLAGS
+-  LDFLAGS="$LDFLAGS  -fstack-protector"
+-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+-/* end confdefs.h.  */
+-
+-int
+-main ()
+-{
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-if ac_fn_c_try_link "$LINENO"; then :
+-  ax_cv_check_ldflags___fstack_protector=yes
+-else
+-  ax_cv_check_ldflags___fstack_protector=no
+-fi
+-rm -f core conftest.err conftest.$ac_objext \
+-    conftest$ac_exeext conftest.$ac_ext
+-  LDFLAGS=$ax_check_save_flags
+-fi
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_check_ldflags___fstack_protector" >&5
+-$as_echo "$ax_cv_check_ldflags___fstack_protector" >&6; }
+-if test x"$ax_cv_check_ldflags___fstack_protector" = xyes; then :
+-
+-			SSP_CFLAGS="-fstack-protector"
+-			SSP_LDFLAGS="-Wc,-fstack-protector"
+-
+-else
+-  :
+-fi
+-
+-
+-else
+-  :
+-fi
+-
+-	    fi
+-	fi
++    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for compiler stack protector support" >&5
++$as_echo_n "checking for compiler stack protector support... " >&6; }
++if ${sudo_cv_var_stack_protector+:} false; then :
++  $as_echo_n "(cached) " >&6
++else
++
++	    sudo_cv_var_stack_protector=no
++	    _CFLAGS="$CFLAGS"
++	    _LDFLAGS="$LDFLAGS"
++	    CFLAGS="-fstack-protector-strong"
++	    LDFLAGS="-fstack-protector-strong"
++	    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++
++		$ac_includes_default
++int
++main ()
++{
++char buf[1024]; buf[1023] = '\0';
++  ;
++  return 0;
++}
++
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++
++		sudo_cv_var_stack_protector="-fstack-protector-strong"
++
++else
++
++		CFLAGS="-fstack-protector-all"
++		LDFLAGS="-fstack-protector-all"
++		cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++
++		    $ac_includes_default
++int
++main ()
++{
++char buf[1024]; buf[1023] = '\0';
++  ;
++  return 0;
++}
++
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++
++		    sudo_cv_var_stack_protector="-fstack-protector-all"
++
++else
++
++		    CFLAGS="-fstack-protector"
++		    LDFLAGS="-fstack-protector"
++		    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++
++			$ac_includes_default
++int
++main ()
++{
++char buf[1024]; buf[1023] = '\0';
++  ;
++  return 0;
++}
++
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++
++			sudo_cv_var_stack_protector="-fstack-protector"
++
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
++	    CFLAGS="$_CFLAGS"
++	    LDFLAGS="$_LDFLAGS"
++
++
++fi
++{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $sudo_cv_var_stack_protector" >&5
++$as_echo "$sudo_cv_var_stack_protector" >&6; }
++    if test X"$sudo_cv_var_stack_protector" != X"no"; then
++	SSP_CFLAGS="$sudo_cv_var_stack_protector"
++	SSP_LDFLAGS="-Wc,$sudo_cv_var_stack_protector"
+     fi
+     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts -Wl,-z,relro" >&5
+ $as_echo_n "checking whether the linker accepts -Wl,-z,relro... " >&6; }
+diff -r 97ee37d905ce -r 4ade5d1249f4 configure.ac
+--- a/configure.ac	Sun Oct 25 14:28:38 2015 -0600
++++ b/configure.ac	Thu Oct 29 10:51:09 2015 -0600
+@@ -3978,29 +3978,45 @@
+ dnl This test relies on AC_LANG_WERROR
+ dnl
+ if test "$enable_hardening" != "no"; then
+-    if test -n "$GCC"; then
+-	AX_CHECK_COMPILE_FLAG([-fstack-protector-strong], [
+-	    AX_CHECK_LINK_FLAG([-fstack-protector-strong], [
+-		SSP_CFLAGS="-fstack-protector-strong"
+-		SSP_LDFLAGS="-Wc,-fstack-protector-strong"
+-	    ])
+-	])
+-	if test -z "$SSP_CFLAGS"; then
+-	    AX_CHECK_COMPILE_FLAG([-fstack-protector-all], [
+-		AX_CHECK_LINK_FLAG([-fstack-protector-all], [
+-		    SSP_CFLAGS="-fstack-protector-all"
+-		    SSP_LDFLAGS="-Wc,-fstack-protector-all"
++    AC_CACHE_CHECK([for compiler stack protector support],
++	[sudo_cv_var_stack_protector],
++	[
++	    sudo_cv_var_stack_protector=no
++	    _CFLAGS="$CFLAGS"
++	    _LDFLAGS="$LDFLAGS"
++	    CFLAGS="-fstack-protector-strong"
++	    LDFLAGS="-fstack-protector-strong"
++	    AC_COMPILE_IFELSE([
++		AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
++		[[char buf[1024]; buf[1023] = '\0';]])
++	    ], [
++		sudo_cv_var_stack_protector="-fstack-protector-strong"
++	    ], [
++		CFLAGS="-fstack-protector-all"
++		LDFLAGS="-fstack-protector-all"
++		AC_COMPILE_IFELSE([
++		    AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
++		    [[char buf[1024]; buf[1023] = '\0';]])
++		], [
++		    sudo_cv_var_stack_protector="-fstack-protector-all"
++		], [
++		    CFLAGS="-fstack-protector"
++		    LDFLAGS="-fstack-protector"
++		    AC_COMPILE_IFELSE([
++			AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT],
++			[[char buf[1024]; buf[1023] = '\0';]])
++		    ], [
++			sudo_cv_var_stack_protector="-fstack-protector"
++		    ], [])
+ 		])
+ 	    ])
+-	    if test -z "$SSP_CFLAGS"; then
+-		AX_CHECK_COMPILE_FLAG([-fstack-protector], [
+-		    AX_CHECK_LINK_FLAG([-fstack-protector], [
+-			SSP_CFLAGS="-fstack-protector"
+-			SSP_LDFLAGS="-Wc,-fstack-protector"
+-		    ])
+-		])
+-	    fi
+-	fi
++	    CFLAGS="$_CFLAGS"
++	    LDFLAGS="$_LDFLAGS"
++	]
++    )
++    if test X"$sudo_cv_var_stack_protector" != X"no"; then
++	SSP_CFLAGS="$sudo_cv_var_stack_protector"
++	SSP_LDFLAGS="-Wc,$sudo_cv_var_stack_protector"
+     fi
+     AX_CHECK_LINK_FLAG([-Wl,-z,relro], [LDFLAGS="${LDFLAGS} -Wl,-z,relro"])
+ fi
+
package/sudo/0003-Preserve-LDFLAGS-when-checking-for-stack-protector.patch new file +81 -0

81 lines not on this page · raw message

package/sudo/0004-Actually-link-the-test-program-when-checking-for-stack-protector.patch new file +189 -0

189 lines not on this page · raw message

Signature · 1 line
1.7.1
#1 lore raw

PATCH 1/1 sudo: fix -fstack-protector detection

Quoted 7 lines · Vicente Olivert Riera

Backport a patch series from upstream to fix the configure check for -fstack-protector.

Fixes:
http://autobuild.buildroot.net/results/bdd3e5352aa283b96717202a794f9762d15cc736/

Signed-off-by Vicente Olivert Riera <[email protected]>
Reviewed-by Arnout Vandecappelle (Essensium/Mind) <[email protected]>

(I haven't looked at the actual changes, just at how the patches are integrated.)

But see below.

Quoted 15 lines
---
 ...etter-configure-test-for-fstack-protector.patch |  415 ++++++++++++++++++++
 ...LDFLAGS-when-checking-for-stack-protector.patch |   81 ++++
 ...program-when-checking-for-stack-protector.patch |  189 +++++++++
 3 files changed, 685 insertions(+), 0 deletions(-)
 create mode 100644 package/sudo/0002-Better-configure-test-for-fstack-protector.patch
 create mode 100644 package/sudo/0003-Preserve-LDFLAGS-when-checking-for-stack-protector.patch
 create mode 100644 package/sudo/0004-Actually-link-the-test-program-when-checking-for-stack-protector.patch
package/sudo/0002-Better-configure-test-for-fstack-protector.patch new file +0 -0
new file mode 100644
index 0000000..b9ec410

package/sudo/0002-Better-configure-test-for-fstack-protector.patch line 2

Quoted 2 lines
package/sudo/0002-Better-configure-test-for-fstack-protector.patch new file +2 -0
@@ -0,0 +1,415 @@
+Better configure test for -fstack-protector. Some gcc installations may
+be missing the ssp library even though the compiler supports it.

Since you have the full HG commit log below, it's not needed to repeat that
here. Perhaps adding a single-line subject is nice though for easier conversion to git patches. But this remark is more for the future, it's OK as it is.

Quoted 7 lines
package/sudo/0002-Better-configure-test-for-fstack-protector.patch new file +7 -0
+
+Backported from upstream:
+  http://www.sudo.ws/repos/sudo/rev/4ade5d1249f4
+
+Signed-off-by: Vicente Olivert Riera <[email protected]>
+
+# HG changeset patch

package/sudo/0002-Better-configure-test-for-fstack-protector.patch line 19

Quoted 10 lines
package/sudo/0002-Better-configure-test-for-fstack-protector.patch new file +10 -0
+# User Todd C. Miller <[email protected]>
+# Date 1446137469 21600
+# Node ID 4ade5d1249f483c4dd6c579c70b327791094afe8
+# Parent  97ee37d905ceefa433e93a0f552c2a3e5926e2fb
+Better configure test for -fstack-protector.  Some gcc installations
+may be missing the ssp library even though the compiler supports it.
+
+diff -r 97ee37d905ce -r 4ade5d1249f4 configure
+--- a/configure	Sun Oct 25 14:28:38 2015 -0600
++++ b/configure	Thu Oct 29 10:51:09 2015 -0600

It's weird that upstream maintains their configure scripts in hg, but since
they do, we indeed don't need to autoreconf.

Regards,
Arnout

[snip]

Signature · 6 lines
Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
#2 lore raw

PATCH 1/1 sudo: fix -fstack-protector detection

In reply to Vicente Olivert Riera
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Vicente" == Vicente Olivert Riera <[email protected]> writes:

Backport a patch series from upstream to fix the configure check for -fstack-protector.

Fixes:
http://autobuild.buildroot.net/results/bdd3e5352aa283b96717202a794f9762d15cc736/

Signed-off-by Vicente Olivert Riera <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard