Log of /hardening-wrapper

---

Revision 118 - Directory Listing
Modified Fri Feb 18 21:34:28 2011 UTC (2 years, 3 months ago) by kees

tagging version 1.32

---

Revision 117 - Directory Listing
Modified Fri Feb 18 21:34:06 2011 UTC (2 years, 3 months ago) by kees

releasing version 1.32

---

Revision 116 - Directory Listing
Modified Fri Feb 18 21:30:16 2011 UTC (2 years, 3 months ago) by kees

hardening.make: provide examples for working around build-time
collisions between "-fPIE" and "-fPIC" (Closes: #596150).

---

Revision 115 - Directory Listing
Modified Fri Feb 18 20:05:40 2011 UTC (2 years, 3 months ago) by kees

hardened-cc: disable -fstack-protector when -ffreestanding used.

---

Revision 114 - Directory Listing
Modified Fri Feb 18 20:02:13 2011 UTC (2 years, 3 months ago) by kees

* hardened-cc, hardening.make: add "--param ssp-buffer-size=4" by
  default to catch smaller character arrays.
* tests/Makefile.common, tests/ssp-buffer-size-{protect,skip}.c:
  add tests for newly added "--param ssp-buffer-size=4" default.
* debian/README.Debian: updated to include newly added options.

---

Revision 113 - Directory Listing
Modified Fri Feb 18 19:27:21 2011 UTC (2 years, 3 months ago) by kees

update copyright to include 2011

---

Revision 112 - Directory Listing
Modified Fri Feb 18 19:21:22 2011 UTC (2 years, 3 months ago) by kees

* debian/rules, debian/hardening-wrapper.{prerm,preinst,postinst}:
  remove gcc-4.1 diversions since it has been removed from unstable.
* hardened-cc, hardening.make: add "-Werror=format-security" by default
  (Closes: #587358).
* tests/Makefile.common, tests/format.c: add test for newly added
  "-Werror=format-security" default option.

---

Revision 111 - Directory Listing
Modified Fri Jan 14 18:28:07 2011 UTC (2 years, 4 months ago) by kees

tagging version 1.31

---

Revision 110 - Directory Listing
Modified Fri Jan 14 18:27:52 2011 UTC (2 years, 4 months ago) by kees

releasing version 1.31

---

Revision 109 - Directory Listing
Modified Fri Jan 14 18:26:09 2011 UTC (2 years, 4 months ago) by kees

* tests/Makefile.common: do not require @@GLIBC suffix for nm tests.
* tests/Makefile.wrapper: include symlink for ld.gold testing.
* hardening-check: improve hardening-check to parse BIND_NOW also from
  the FLAGS dynamic section.

---

Revision 108 - Directory Listing
Modified Tue Jan 11 16:44:00 2011 UTC (2 years, 4 months ago) by kees

tagging version 1.30

---

Revision 107 - Directory Listing
Modified Tue Jan 11 16:43:46 2011 UTC (2 years, 4 months ago) by kees

releasing version 1.30

---

Revision 106 - Directory Listing
Modified Tue Jan 11 16:39:23 2011 UTC (2 years, 4 months ago) by kees

* debian/README.Debian: update for gcc versions, include minimal
  notes on hardening-includes (Closes: 592847, 592846).
* debian/rules, debian/hardening-wrapper.{prerm,postinst}: add gcc-4.6
  to the diversion list.
* debian/control: remove binutils-multiarch conflict now that ld.bfd
  is no longer diverted.

---

Revision 105 - Directory Listing
Modified Tue Jan 11 16:37:22 2011 UTC (2 years, 4 months ago) by kees

tagging version 1.29

---

Revision 104 - Directory Listing
Modified Tue Jan 11 16:37:05 2011 UTC (2 years, 4 months ago) by kees

releasing version 1.29

---

Revision 103 - Directory Listing
Modified Tue Jan 11 16:34:59 2011 UTC (2 years, 4 months ago) by kees

* debian/control: add Conflicts for binutils-multiarch (Closes: 579409,
  LP: #596136).
* debian/hardening-wrapper.postrm: remove attempted diversions on
  installation failure.

---

Revision 102 - Directory Listing
Modified Sun Jun 20 19:49:22 2010 UTC (2 years, 11 months ago) by kees

tagging version 1.28

---

Revision 101 - Directory Listing
Modified Sun Jun 20 19:48:54 2010 UTC (2 years, 11 months ago) by kees

releasing version 1.28

---

Revision 100 - Directory Listing
Modified Sun Jun 20 19:37:18 2010 UTC (2 years, 11 months ago) by kees

hardening.make: enable PIE on hurd (Closes: 586215), thanks to
Samuel Thibault.

---

Revision 99 - Directory Listing
Modified Fri Apr 23 23:17:31 2010 UTC (3 years, 1 month ago) by kees

hardening-check: fix regex to correctly call sed (Closes: 578488).

---

Revision 98 - Directory Listing
Modified Thu Mar 25 06:14:42 2010 UTC (3 years, 2 months ago) by kees

* hardening.make:
  - disable RELRO on avr32.
  - clarify use of CXXFLAGS.

---

Revision 97 - Directory Listing
Modified Wed Mar 24 18:56:36 2010 UTC (3 years, 2 months ago) by kees

add missed copyright to hardening.make file

---

Revision 96 - Directory Listing
Modified Wed Mar 24 18:52:59 2010 UTC (3 years, 2 months ago) by kees

hardening.make: disable RELRO on avr32.

---

Revision 95 - Directory Listing
Modified Sun Mar 21 17:01:40 2010 UTC (3 years, 2 months ago) by kees

tagging version 1.26

---

Revision 94 - Directory Listing
Modified Sun Mar 21 17:01:28 2010 UTC (3 years, 2 months ago) by kees

releasing version 1.26

---

Revision 93 - Directory Listing
Modified Sun Mar 21 16:52:10 2010 UTC (3 years, 2 months ago) by kees

hardening.make: disable PIE on avr32 (Closes: 574716).

---

Revision 92 - Directory Listing
Modified Mon Mar 1 23:20:01 2010 UTC (3 years, 2 months ago) by kees

tagging version 1.25

---

Revision 91 - Directory Listing
Modified Mon Mar 1 23:19:51 2010 UTC (3 years, 2 months ago) by kees

releasing version 1.25

---

Revision 90 - Directory Listing
Modified Mon Mar 1 23:14:12 2010 UTC (3 years, 2 months ago) by kees

* debian/control:
  - bump standards version: no changes needed.
  - should not be considered "experimental".
* hardening-check: use readelf's "-s" instead of "-r" to avoid issues
  with archs that lack sane relocations.
* tests/Makefile.common:
  - adjust tests to include -s output.
  - weaken nm symbol matching.

---

Revision 89 - Directory Listing
Modified Wed Feb 10 00:10:39 2010 UTC (3 years, 3 months ago) by kees

tagging version 1.24

---

Revision 88 - Directory Listing
Modified Wed Feb 10 00:10:24 2010 UTC (3 years, 3 months ago) by kees

releasing version 1.24

---

Revision 87 - Directory Listing
Modified Wed Feb 10 00:10:01 2010 UTC (3 years, 3 months ago) by kees

* hardening-check: handle alternate names for relocation jump slots
  (Closes: 568622)
* tests/Makefile.common: show relocations as well for future debugging.

---

Revision 86 - Directory Listing
Modified Sat Jan 30 22:32:32 2010 UTC (3 years, 3 months ago) by kees

tagging version 1.23

---

Revision 85 - Directory Listing
Modified Sat Jan 30 22:32:23 2010 UTC (3 years, 3 months ago) by kees

releasing version 1.23

---

Revision 84 - Directory Listing
Modified Sat Jan 30 22:31:10 2010 UTC (3 years, 3 months ago) by kees

tests/Makefile.{common,includes}: add HARDENING_DISABLE_* flags tests.

---

Revision 83 - Directory Listing
Modified Sat Jan 30 22:05:20 2010 UTC (3 years, 3 months ago) by kees

* hardening.make: correctly document how to disable PIE on a per-target
  basis (Closes: 567707).
* tests/Makefile.includes: add simple HARDENING_DISABLE_* flags test.

---

Revision 82 - Directory Listing
Modified Tue Jan 12 14:22:42 2010 UTC (3 years, 4 months ago) by kees

tagging version 1.22

---

Revision 81 - Directory Listing
Modified Tue Jan 12 14:22:33 2010 UTC (3 years, 4 months ago) by kees

releasing version 1.22

---

Revision 80 - Directory Listing
Modified Tue Jan 12 14:19:07 2010 UTC (3 years, 4 months ago) by kees

debian/hardening-wrapper.postrm: fix typo in diversion name
(Closes: 564840).

---

Revision 79 - Directory Listing
Modified Sun Jan 10 20:37:22 2010 UTC (3 years, 4 months ago) by kees

tagging version 1.21

---

Revision 78 - Directory Listing
Modified Sun Jan 10 20:37:14 2010 UTC (3 years, 4 months ago) by kees

releasing version 1.21

---

Revision 77 - Directory Listing
Modified Sun Jan 10 18:30:00 2010 UTC (3 years, 4 months ago) by kees

* really handle gcc 4.5 diversion (Closes: 564596).
* handle ld diversion when binutils-gold installed (Closes: 535037).

---

Revision 76 - Directory Listing
Modified Tue Jan 5 20:23:15 2010 UTC (3 years, 4 months ago) by kees

hardening-check: add -q option to only report failures.

---

Revision 75 - Directory Listing
Modified Mon Jan 4 09:27:02 2010 UTC (3 years, 4 months ago) by kees

debian/control: add ${misc:Depends} to control file entries to
keep lintian happy.

---

Revision 74 - Directory Listing
Modified Sun Jan 3 20:44:46 2010 UTC (3 years, 4 months ago) by kees

run PIE build twice, to see if ASLR works in the builder's kernel

---

Revision 73 - Directory Listing
Modified Sat Dec 26 00:42:54 2009 UTC (3 years, 4 months ago) by kees

tagging version 1.20

---

Revision 72 - Directory Listing
Modified Sat Dec 26 00:42:45 2009 UTC (3 years, 4 months ago) by kees

releasing version 1.20

---

Revision 71 - Directory Listing
Modified Sat Dec 26 00:34:43 2009 UTC (3 years, 4 months ago) by kees

* hardening.make:
  - switch to "filter" to avoid having "arm" match "armel" incorrectly.
  - allow PIE for arm/armel, since it's only the kernel that lacks ASLR.
* tests/Makefile: perform builds with -fstack-protector and -fPIE -pie
  on all architectures just to have a record of the success/failure
  in the build logs, even if we are manually selecting the defaults.

---

Revision 70 - Directory Listing
Modified Thu Dec 24 08:03:14 2009 UTC (3 years, 5 months ago) by kees

tagging version 1.19

---

Revision 69 - Directory Listing
Modified Thu Dec 24 08:03:00 2009 UTC (3 years, 5 months ago) by kees

releasing version 1.19

---

Revision 68 - Directory Listing
Modified Thu Dec 24 08:01:55 2009 UTC (3 years, 5 months ago) by kees

hardening-check, debian/{rules,hardening-includes.manpages},
tests/Makefile.common: add helper utility to allow users of
hardening-includes to evaluate the state of a given binary's
resulting hardening features.

---

Revision 67 - Directory Listing
Modified Thu Dec 24 07:12:59 2009 UTC (3 years, 5 months ago) by kees

debian/rules, hardening-check, tests/Makefile.common: add helper
utility to allow users of hardening-includes to evaluate the state
of a given binary's resulting hardening characteristics.

---

Revision 66 - Directory Listing
Modified Mon Dec 21 08:47:20 2009 UTC (3 years, 5 months ago) by kees

debian/rules: add gcc-4.5 to the diversion list.

---

Revision 65 - Directory Listing
Modified Mon Dec 21 02:28:14 2009 UTC (3 years, 5 months ago) by kees

debian/rules, hardening-check: add helper utility to evaluate
the state of a given binary's hardening characteristics.

---

Revision 64 - Directory Listing
Modified Mon Dec 21 02:05:05 2009 UTC (3 years, 5 months ago) by kees

thanks and typo fix

---

Revision 63 - Directory Listing
Modified Sun Dec 20 23:30:09 2009 UTC (3 years, 5 months ago) by kees

debian/rules: fix up arch/arch-indep rules to avoid rebuilding
arch-indep bits repeatedly.

---

Revision 62 - Directory Listing
Modified Sun Dec 20 11:41:42 2009 UTC (3 years, 5 months ago) by kees

tagging version 1.18

---

Revision 61 - Directory Listing
Modified Sun Dec 20 11:41:30 2009 UTC (3 years, 5 months ago) by kees

releasing version 1.18

---

Revision 60 - Directory Listing
Modified Sun Dec 20 11:32:38 2009 UTC (3 years, 5 months ago) by kees

fix up lintian warnings and rules files thinkos

---

Revision 59 - Directory Listing
Modified Sun Dec 20 10:51:17 2009 UTC (3 years, 5 months ago) by kees

* debian/{control,rules}: add "hardening-includes" for use in other
  Debian rules files.
* debian/rules, hardening.make: relocate/enhance architecture logic
  to common makefile include file.
* tests/*: update to test both wrapper and include style.

---

Revision 58 - Directory Listing
Modified Wed Nov 25 19:47:09 2009 UTC (3 years, 5 months ago) by kees

tagging version 1.17

---

Revision 57 - Directory Listing
Modified Wed Nov 25 19:47:01 2009 UTC (3 years, 5 months ago) by kees

releasing version 1.17

---

Revision 56 - Directory Listing
Modified Wed Nov 25 19:46:48 2009 UTC (3 years, 5 months ago) by kees

Add Conflicts on binutils-gold, which also uses diversions against
gcc and friends (Closes: 535037, LP: #442636).

---

Revision 55 - Directory Listing
Modified Fri Oct 30 04:25:48 2009 UTC (3 years, 6 months ago) by kees

tagging version 1.16

---

Revision 54 - Directory Listing
Modified Fri Oct 30 04:25:34 2009 UTC (3 years, 6 months ago) by kees

releasing version 1.16

---

Revision 53 - Directory Listing
Modified Fri Oct 30 04:25:15 2009 UTC (3 years, 6 months ago) by kees

tests/Makefile: exclude relro test on hppa.

---

Revision 52 - Directory Listing
Modified Thu Sep 24 22:36:39 2009 UTC (3 years, 8 months ago) by kees

tagging version 1.15

---

Revision 51 - Directory Listing
Modified Thu Sep 24 22:35:36 2009 UTC (3 years, 8 months ago) by kees

releasing version 1.15

---

Revision 50 - Directory Listing
Modified Thu Sep 24 22:33:01 2009 UTC (3 years, 8 months ago) by kees

debian/rules: disable PIE on mips/mipsel until bug 532821 is solved
(Closes: #548250).

---

Revision 49 - Directory Listing
Modified Thu Jul 23 15:36:21 2009 UTC (3 years, 10 months ago) by kees

tests/Makefile: exclude tests based on architecture (ia64 w/o relro).

---

Revision 48 - Directory Listing
Modified Thu Jul 23 03:43:42 2009 UTC (3 years, 10 months ago) by kees

tagging version 1.14

---

Revision 47 - Directory Listing
Modified Thu Jul 23 03:43:31 2009 UTC (3 years, 10 months ago) by kees

releasing version 1.14

---

Revision 46 - Directory Listing
Modified Thu Jul 23 03:43:13 2009 UTC (3 years, 10 months ago) by kees

* hardened-ld: add ...BINDNOW for -Wl,-z,now ELF markings.
* debian/control: moved to standards version 3.8.2, no changes needed.
* tests/Makefile: add tests for RELRO and BIND_NOW.
* hardening-{cc,ld}.1: document BINDNOW and RELRO, add on to See Also.

---

Revision 44 - Directory Listing
Modified Fri Nov 21 07:34:43 2008 UTC (4 years, 6 months ago) by kees

open 1.14 changelog

---

Revision 43 - Directory Listing
Modified Fri Nov 21 07:33:26 2008 UTC (4 years, 6 months ago) by kees

* hardened-cc: add ...DEBUG_SYMLINKS to visualize symlink resolution.
* hardened-cc: detect uninstalled targets and abort (Closes: #506066).
* debian/{rules,postinst,postrm}: add links for gcc-4.4.
* debian/control: moved to standards version 3.8.0, no changes needed.

---

Revision 42 - Directory Listing
Modified Wed Apr 30 06:27:26 2008 UTC (5 years ago) by keescook-guest

-Werror= was introduced in gcc 4.2.  revert this to stay more compatible

---

Revision 41 - Directory Listing
Modified Tue Apr 29 17:29:11 2008 UTC (5 years ago) by keescook-guest

hardened-cc: made -Wformat-security fatal.

---

Revision 40 - Directory Listing
Modified Mon Apr 28 23:00:27 2008 UTC (5 years ago) by keescook-guest

hardened-{cc,ld}: handle relative symlinks correctly to address issues
  pointed out by Sedat Dilek.

---

Revision 39 - Directory Listing
Modified Mon Apr 28 21:46:35 2008 UTC (5 years ago) by keescook-guest

* hardened-cc: add -nostdlib test missing from older gcc (gcc-4.0, gcc-4.1).
* hardened-{cc,ld}: load system defaults from /etc/hardening-wrapper.conf
* hardened-{cc,ld}.1: updated man pages to mention system-wide config.

---

Revision 38 - Directory Listing
Modified Tue Apr 15 00:53:08 2008 UTC (5 years, 1 month ago) by keescook-guest

drop pie logic from ld -- seems like it causes more problems than it solves; use -B for tests again

---

Revision 37 - Directory Listing
Modified Mon Apr 14 19:57:43 2008 UTC (5 years, 1 month ago) by keescook-guest

more arch disabled

---

Revision 36 - Directory Listing
Modified Mon Apr 14 19:48:44 2008 UTC (5 years, 1 month ago) by keescook-guest

ignores updated

---

Revision 35 - Directory Listing
Modified Mon Apr 14 19:40:09 2008 UTC (5 years, 1 month ago) by keescook-guest

build out harness for compilation tests

---

Revision 34 - Directory Listing
Modified Mon Apr 14 03:07:21 2008 UTC (5 years, 1 month ago) by keescook-guest

dpkg death-match

---

Revision 33 - Directory Listing
Modified Mon Apr 14 01:02:06 2008 UTC (5 years, 1 month ago) by keescook-guest

dak still hates me -- bumping to 1.10

---

Revision 32 - Directory Listing
Modified Sun Apr 13 21:52:11 2008 UTC (5 years, 1 month ago) by keescook-guest

release 1.9 again, since dak ate the last one due to new dpkg format

---

Revision 30 - Directory Listing
Modified Thu Apr 10 18:02:35 2008 UTC (5 years, 1 month ago) by keescook-guest

typo in comments

---

Revision 29 - Directory Listing
Modified Thu Apr 10 18:01:10 2008 UTC (5 years, 1 month ago) by keescook-guest

releasing 1.9

---

Revision 28 - Directory Listing
Modified Thu Apr 10 17:09:17 2008 UTC (5 years, 1 month ago) by keescook-guest

released 1.8

---

Revision 27 - Directory Listing
Modified Sun Mar 23 15:26:28 2008 UTC (5 years, 2 months ago) by keescook-guest

fix up debian/rules for arch target

---

Revision 26 - Directory Listing
Modified Fri Mar 21 20:11:24 2008 UTC (5 years, 2 months ago) by keescook-guest

wrong email address :P

---

Revision 25 - Directory Listing
Modified Fri Mar 21 20:05:21 2008 UTC (5 years, 2 months ago) by keescook-guest

switch to arch build so arch-specific defaults can be set

---

Revision 21 - Directory Listing
Modified Mon Jan 28 11:24:37 2008 UTC (5 years, 3 months ago) by keescook-guest

fix bug 462682: typo in self-check regex

---

Revision 20 - Directory Listing
Modified Wed Jan 23 18:13:30 2008 UTC (5 years, 4 months ago) by keescook-guest

"Other keywords are ignored for Solaris compatibility."

---

Revision 18 - Directory Listing
Modified Wed Jan 23 11:33:59 2008 UTC (5 years, 4 months ago) by keescook-guest

fix typos, add example "bad code"

---

Revision 17 - Directory Listing
Modified Wed Jan 23 03:08:36 2008 UTC (5 years, 4 months ago) by keescook-guest

clean up and better dirversions

---

Revision 16 - Directory Listing
Modified Thu Jan 10 17:26:03 2008 UTC (5 years, 4 months ago) by keescook-guest

update maintainer role address to public mailing list for the project; stress its experimental nature

---

Revision 15 - Directory Listing
Modified Wed Jan 9 00:18:29 2008 UTC (5 years, 4 months ago) by keescook-guest

disable debug by default

---

Revision 14 - Directory Listing
Modified Wed Jan 9 00:14:38 2008 UTC (5 years, 4 months ago) by keescook-guest

tweak description

---

Revision 13 - Directory Listing
Modified Wed Jan 9 00:12:24 2008 UTC (5 years, 4 months ago) by keescook-guest

dump changelog in favor of 1.0 version for initial upload

---

Revision 12 - Directory Listing
Modified Wed Jan 9 00:10:00 2008 UTC (5 years, 4 months ago) by keescook-guest

final tweaks for 0.5

---

Revision 11 - Directory Listing
Modified Wed Jan 9 00:02:34 2008 UTC (5 years, 4 months ago) by keescook-guest

prepare to upload first official release

---

Revision 10 - Directory Listing
Modified Sun Oct 28 06:44:22 2007 UTC (5 years, 6 months ago) by keescook-guest

compat level 5, general cleanups

---

Revision 9 - Directory Listing
Modified Sun Oct 28 06:32:13 2007 UTC (5 years, 6 months ago) by keescook-guest
Copied from: override-builder revision 7

rename top-level directory to match new pkg name

---

Revision 7 - Directory Listing
Modified Fri Oct 26 21:22:13 2007 UTC (5 years, 6 months ago) by jmm
Original Path: override-builder

rename to hardening-wrapper to use a less generic name

---

Revision 6 - Directory Listing
Modified Fri Oct 26 21:20:42 2007 UTC (5 years, 6 months ago) by jmm
Original Path: override-builder

manpages

---

Revision 5 - Directory Listing
Modified Fri Oct 26 21:20:04 2007 UTC (5 years, 6 months ago) by jmm
Original Path: override-builder

remove, no longer needed

---

Revision 4 - Directory Listing
Modified Fri Oct 26 21:19:29 2007 UTC (5 years, 6 months ago) by jmm
Original Path: override-builder

add documentation

---

Revision 3 - Directory Listing
Modified Tue Oct 23 00:49:51 2007 UTC (5 years, 7 months ago) by keescook-guest
Original Path: override-builder

correctly add "svn:ignore" property; add TODO list

---

Revision 2 - Directory Listing
Modified Tue Oct 23 00:45:47 2007 UTC (5 years, 7 months ago) by keescook-guest
Original Path: override-builder

fix typo in env var handlers; add .svnignore files

---

Revision 1 - Directory Listing
Added Mon Oct 22 01:14:50 2007 UTC (5 years, 7 months ago) by keescook-guest
Original Path: override-builder

initial import