git.ipfire.org Git - people/stevee/pakfire.git/log

]> git.ipfire.org Git - people/stevee/pakfire.git/log

projects / people / stevee / pakfire.git / log

commit | commitdiff | tree

Michael Tremer [Sat, 18 Mar 2023 12:14:42 +0000 (12:14 +0000)]

file: Extend RELRO check to check for BIND_NOW

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 18 Mar 2023 12:13:42 +0000 (12:13 +0000)]

file: Pass Dyn tag to the callback function

Some values are not considered to be strings.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 18 Mar 2023 11:24:07 +0000 (11:24 +0000)]

Drop old RPATH check script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 18 Mar 2023 11:23:32 +0000 (11:23 +0000)]

file: Implement RPATH/RUNPATH check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 18 Mar 2023 11:23:12 +0000 (11:23 +0000)]

file: Make fetch more information from ELF sections easier

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 15:45:18 +0000 (15:45 +0000)]

file: Unify fetching ELF sections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 15:30:01 +0000 (15:30 +0000)]

file: Rename NO-* flags to MISSING-*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 15:00:51 +0000 (15:00 +0000)]

build: Do not perform BUILDROOT check on Python bytecode files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:56:28 +0000 (14:56 +0000)]

filelist: Add option to show a progressbar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:33:30 +0000 (14:33 +0000)]

filelist: Add flags argument to walk function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:29:12 +0000 (14:29 +0000)]

FHS: Perform world writable check only for regular files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:09:11 +0000 (14:09 +0000)]

macros: Define tmpfilesdir

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:02:50 +0000 (14:02 +0000)]

FHS: Add /root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 14:00:08 +0000 (14:00 +0000)]

file: Set r if file could not be opened

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:59:39 +0000 (13:59 +0000)]

files: Skip payload check for empty files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:57:33 +0000 (13:57 +0000)]

file: Do not check for ELF status again when dumping issues

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:56:40 +0000 (13:56 +0000)]

build: Move strip check into file check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:46:50 +0000 (13:46 +0000)]

build: Rename hardening check to just check

That way, we can include some checks that are not too closely related to
any hardening issues.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:41:55 +0000 (13:41 +0000)]

build: Move FHS check into hardening checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:29:52 +0000 (13:29 +0000)]

FHS: Check for world-writable files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:24:47 +0000 (13:24 +0000)]

util: Fix path pattern matching with characters after stars

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:14:39 +0000 (13:14 +0000)]

file: Remove forgotten debug statements

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 13:05:21 +0000 (13:05 +0000)]

build: Perform BUILDROOT check in C

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 12:17:31 +0000 (12:17 +0000)]

FHS: Check for correct location and permission of shared objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 12:13:53 +0000 (12:13 +0000)]

tests: Add check for pakfire_path_match with stars in middle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 12:03:03 +0000 (12:03 +0000)]

FHS: Fix indentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 12:00:35 +0000 (12:00 +0000)]

FHS: Do not allow any executable files in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 11:57:33 +0000 (11:57 +0000)]

FHS: Do not allow any executable files in /usr/share

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 11:56:59 +0000 (11:56 +0000)]

FHS: All files in /boot must be owned by root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 11:46:30 +0000 (11:46 +0000)]

FHS: Ensure that firmware files are not executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 11:06:15 +0000 (11:06 +0000)]

FHS: Rearrange the matrix

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:54:40 +0000 (10:54 +0000)]

build: Drop check-include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:53:50 +0000 (10:53 +0000)]

FHS: Check permissions of files in /usr/include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:53:13 +0000 (10:53 +0000)]

FHS: Do not allow any unknown subdirectories in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:49:21 +0000 (10:49 +0000)]

FHS: Enfore that all files in /usr/*bin are executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:40:33 +0000 (10:40 +0000)]

FHS: Do not allow any subdirectories in /usr/bin & /usr/sbin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:37:25 +0000 (10:37 +0000)]

FHS: Implement being able to check for file type

This allows us a more granular filtering

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:23:51 +0000 (10:23 +0000)]

FHS: Do not allow any more files in /usr and /usr/src

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:18:06 +0000 (10:18 +0000)]

FHS: Implement checking file ownerships

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:05:26 +0000 (10:05 +0000)]

build: Drop check-libraries script

This is now covered by the new builtin FHS check.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:03:36 +0000 (10:03 +0000)]

build: Drop old FHS script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 17 Mar 2023 10:00:59 +0000 (10:00 +0000)]

FHS: Implement some simple filesystem checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 19:27:28 +0000 (19:27 +0000)]

util: path_matches: Check if pattern is shorter than string

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 15:54:51 +0000 (15:54 +0000)]

util: Implement a simple path matching function that supports **

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 10:27:19 +0000 (10:27 +0000)]

arch: Drop support for all 32 bit architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 09:10:00 +0000 (09:10 +0000)]

compress: Fix wrong variable in threads code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 09:05:44 +0000 (09:05 +0000)]

packager: Don't initialize an unsigned integer with -1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 09:04:33 +0000 (09:04 +0000)]

compress: Enable parallel compression for Zstandard if available

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 09:04:04 +0000 (09:04 +0000)]

compress: Create a unified function to create archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 08:11:23 +0000 (08:11 +0000)]

snapshots: Call it store/restore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 16 Mar 2023 08:07:57 +0000 (08:07 +0000)]

snapshots: Do not modify an existing snapshot

Instead, the routines will now write the new snapshot to a temporary
location and replace it more or less atomically.

Fixes: #13045 - Multiple concurrent instances can destroy the snapshot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 18:48:55 +0000 (18:48 +0000)]

Revert "snapshots: Pass path instead of file descriptor"

This reverts commit 4667a2ca811f6f2b20c1cfb3223dd8b90af4952c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 18:40:49 +0000 (18:40 +0000)]

compress: Do not overwrite configuration on extraction

This is somewhat experimental and I would need to think a little bit
more about this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 18:29:42 +0000 (18:29 +0000)]

jail: Enable all QEMU CPU features by default

When we are emulating a different architecture, QEMU by default emulates
a very basic processor which might not be able to emulate for example
SIMD instructions.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 16:51:23 +0000 (16:51 +0000)]

file: Mark files as executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 16:43:36 +0000 (16:43 +0000)]

file: Rename extension check to patterns

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 16:33:18 +0000 (16:33 +0000)]

file: Do not check for SSP for runtime linkers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 13:28:46 +0000 (13:28 +0000)]

python: Release and acquire the GIL when we need it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 11:31:07 +0000 (11:31 +0000)]

build: Dump the complete filelist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 11:30:41 +0000 (11:30 +0000)]

compress: Resolve hardlinks when writing archives

Fixes: #13014
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 10:48:20 +0000 (10:48 +0000)]

file: Correctly fail PIE test

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 03:01:46 +0000 (03:01 +0000)]

build: Show build time at the end

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 15 Mar 2023 03:01:30 +0000 (03:01 +0000)]

string: Add function to format elapsed time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Tue, 14 Mar 2023 18:57:01 +0000 (18:57 +0000)]

file: Perform magic check for all files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Tue, 14 Mar 2023 18:56:20 +0000 (18:56 +0000)]

file: Skip hardening checks for firmware files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Tue, 14 Mar 2023 18:55:32 +0000 (18:55 +0000)]

CFLAGS: Move string formatting stuff into an extra variable

That way, we can clear it easily.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Mon, 13 Mar 2023 16:52:44 +0000 (16:52 +0000)]

file: Disable all hardening checks for Relocatable Objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Mon, 13 Mar 2023 15:34:08 +0000 (15:34 +0000)]

file: Skip SSP check for data libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 16:24:08 +0000 (16:24 +0000)]

build: Implement marking configuration files in archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 15:21:59 +0000 (15:21 +0000)]

file: Fix digest comment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 15:21:45 +0000 (15:21 +0000)]

file: Add missing return type

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 15:16:57 +0000 (15:16 +0000)]

archive: Store MIME type of files

This is going to be helpful in the build service and generally some
useful metadata.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 15:14:27 +0000 (15:14 +0000)]

files: Fix iterating over extended attributes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 14:07:09 +0000 (14:07 +0000)]

build: Check if ELF files contain debug information

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 13:23:04 +0000 (13:23 +0000)]

file: Show error when the hardening check fails

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 13:20:41 +0000 (13:20 +0000)]

file: Show error when a file has no symbol table

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Sat, 11 Mar 2023 13:20:04 +0000 (13:20 +0000)]

file: Show tags for failed execstack/partly RELRO check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 16:34:48 +0000 (16:34 +0000)]

archive: Be more efficient when reading single files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 16:25:54 +0000 (16:25 +0000)]

archive: Fix reading files from archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 16:10:02 +0000 (16:10 +0000)]

compress: Swap PAKFIRE_WALK_DONE and *_END for semantic reasons

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 15:59:53 +0000 (15:59 +0000)]

archive: Fix reading filelists/extraction on newer formats

Fixes: #12995 - pakfire extracts meta files in archives
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 15:17:38 +0000 (15:17 +0000)]

archive: Drop support for legacy package formats

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 09:31:23 +0000 (09:31 +0000)]

archive: Fix progress bar on extraction

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 14:58:54 +0000 (14:58 +0000)]

macros: Use CET on x86_64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 14:58:35 +0000 (14:58 +0000)]

macros: Enable libstcd++ assertions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Fri, 10 Mar 2023 09:27:11 +0000 (09:27 +0000)]

hub: Change how we append arguments to the request

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 14:13:33 +0000 (14:13 +0000)]

daemon: Do not send DEBUG messages to the build service and log file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 20:34:58 +0000 (20:34 +0000)]

repositories: Refactor how we are reading metadata

This is a large rewrite of how we are discovering and reading any
repository metadata.

It first of all makes the code a little bit more straight forward by
breaking steps into their own function.

Those functions will now do "the right thing" depending whether we are
dealing with a local or remote repository and will try to read
repository metdata for local repositories, too.

If that fails, we will of course fall back and scan.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 18:39:56 +0000 (18:39 +0000)]

pakfire: Allow setting a custom cache path through the configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 18:39:31 +0000 (18:39 +0000)]

downloader: Read proxy settings from the general section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 15:34:35 +0000 (15:34 +0000)]

repo: compose: Ensure that the destination path always exists

realpath() fails if the destination does not exist, so we will try to
create it before.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 13:43:51 +0000 (13:43 +0000)]

repo: Store the real path on stack to avoid it being altered later

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 13:33:12 +0000 (13:33 +0000)]

repos: Try to hardlink packages when possible

Since we no longer change any packages when composing a repository (no
embedded signatures), we can try to hardlink to save disk space and IO.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 13:30:47 +0000 (13:30 +0000)]

repo: Handle relative paths on compose

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 13:14:52 +0000 (13:14 +0000)]

file: Check files for being RELRO

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Tue, 7 Mar 2023 11:40:42 +0000 (11:40 +0000)]

file: Check if ELF files have an executable stack

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Tue, 7 Mar 2023 11:05:00 +0000 (11:05 +0000)]

build: Refactor hardening checks

Instead of calling many different checks, this will now check once
and store any issues that have been identified.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 8 Mar 2023 11:48:18 +0000 (11:48 +0000)]

repo: Compress the SOLV database using Zstandard

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Wed, 8 Mar 2023 11:46:16 +0000 (11:46 +0000)]

repo: Ensure to close the file descriptor after reading the database

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit | commitdiff | tree

Michael Tremer [Thu, 9 Mar 2023 11:12:04 +0000 (11:12 +0000)]

CFLAGS: Use -fstack-protector-all over -strong

Although -fstack-protector-strong will omit inserting any canary checks
on functions that cannot possibly overflow their stack, we will need all
functions to be protected in order to run our check.

It is more benefitial to us to have the check than optimise for
performance. We also expect LTO to inline all those functions that
possibly do not have a stack.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Stefan's tree of pakfire.

RSS Atom