build: Check if binaries have been built with -fPIC

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/libpakfire/build.c b/src/libpakfire/build.c
index 5a9718171b9c7f3c86271c5fd285675a4c96b7a2..42f30bac4f8008c9015694a50e759ff1842217d5 100644 (file)
--- a/src/libpakfire/build.c
+++ b/src/libpakfire/build.c
@@ -1134,6 +1134,10 @@ static int pakfire_build_post_check_broken_symlinks(
                PAKFIRE_BUILD_ERROR_IF_NOT_EMPTY);
 }
 
+/*
+       Hardening
+*/
+
 static int __pakfire_build_post_check_stack_smashing_protection(
                struct pakfire* pakfire, struct pakfire_file* file, void* data) {
        struct pakfire_filelist* broken = (struct pakfire_filelist*)data;
@@ -1160,6 +1164,32 @@ static int pakfire_build_post_check_stack_smashing_protection(
                PAKFIRE_BUILD_ERROR_IF_NOT_EMPTY);
 }
 
+static int __pakfire_build_post_check_shared_object_type(
+               struct pakfire* pakfire, struct pakfire_file* file, void* data) {
+       struct pakfire_filelist* broken = (struct pakfire_filelist*)data;
+       int r;
+
+       // Skip anything that isn't an ELF file
+       if (!pakfire_file_matches_class(file, PAKFIRE_FILE_ELF))
+               return 0;
+
+       if (!pakfire_file_is_position_independent(file)) {
+               r = pakfire_filelist_add(broken, file);
+               if (r)
+                       return r;
+       }
+
+       return 0;
+}
+
+static int pakfire_build_post_check_shared_object_type(
+               struct pakfire_build* build, struct pakfire_filelist* filelist) {
+       return pakfire_build_post_process_files(build, filelist,
+               "These files have not been built with -fPIC:",
+               __pakfire_build_post_check_shared_object_type,
+               PAKFIRE_BUILD_ERROR_IF_NOT_EMPTY);
+}
+
 static int pakfire_build_post_check_hardening(
                struct pakfire_build* build, struct pakfire_filelist* filelist) {
        int r;
@@ -1169,6 +1199,11 @@ static int pakfire_build_post_check_hardening(
        if (r)
                return r;
 
+       // Check shared object type
+       r = pakfire_build_post_check_shared_object_type(build, filelist);
+       if (r)
+               return r;
+
        return 0;
 }
 

diff --git a/src/libpakfire/file.c b/src/libpakfire/file.c
index a0ed895dd27ed4fa3230d7d203e72e2e3368eb47..8a91a3859837e75959bd9d33062a1cbf851a6257 100644 (file)
--- a/src/libpakfire/file.c
+++ b/src/libpakfire/file.c
@@ -1490,3 +1490,29 @@ static int __pakfire_file_has_stack_smashing_protection(
 int pakfire_file_has_stack_smashing_protection(struct pakfire_file* file) {
        return pakfire_file_open_elf(file, __pakfire_file_has_stack_smashing_protection, NULL);
 }
+
+static int __pakfire_file_is_position_independent(
+               struct pakfire_file* file, Elf* elf, void* data) {
+       GElf_Ehdr eheader;
+
+       // Fetch the ELF header
+       if (!gelf_getehdr(elf, &eheader)) {
+               ERROR(file->pakfire, "Could not parse ELF header: %s\n", elf_errmsg(-1));
+               return -1;
+       }
+
+       // Check for the correct header type
+       switch (eheader.e_type) {
+               case ET_DYN:
+                       return 1;
+
+               default:
+                       break;
+       }
+
+       return 0;
+}
+
+int pakfire_file_is_position_independent(struct pakfire_file* file) {
+       return pakfire_file_open_elf(file, __pakfire_file_is_position_independent, NULL);
+}

diff --git a/src/scripts/check-hardening b/src/scripts/check-hardening
index fe392ea8f429d722b354b4fa6627a290848b2cde..2db5aa7eadbef0983f70daacb8e3224b06fe8ea3 100644 (file)
--- a/src/scripts/check-hardening
+++ b/src/scripts/check-hardening
@@ -33,7 +33,6 @@ main() {
                return 1
        fi
 
-       local no_pie=()
        local exec_stack=()
        local not_relro=()
        local partly_relro=()
@@ -57,11 +56,6 @@ main() {
                        continue
                fi
 
-               # Is this file built with -fPIC?
-               if readelf -h "${file}" 2>/dev/null | grep -qE "Type:[[:space:]]*EXEC"; then
-                       no_pie+=( "${file}" )
-               fi
-
                # Does this file have an executable stack?
                if readelf -l "${file}" 2>/dev/null | grep -A1 "GNU_STACK" | grep -q "RWE"; then
                        exec_stack+=( "${file}" )
@@ -84,16 +78,6 @@ main() {
 
        local r=0
 
-       # Log files without PIE
-       if [ "${#no_pie[@]}" -gt 0 ]; then
-               error "The following files have not been compiled as place-independent executables:"
-               for file in ${no_pie[@]}; do
-                       error "  ${file/${buildroot}/}"
-               done
-
-               r=1
-       fi
-
        # Log files with an executable stack
        if [ "${#exec_stack[@]}" -gt 0 ]; then
                error "The following files have an executable stack:"