mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-07 21:16:57 +02:00
82a9e6cf50
BUG=chromium-os:35605 TEST=emerge-$board chromeos-kernel does not show hardened warnings on debug files. Change-Id: I0396ef9f964ad435602f65db6192429521906de1 Reviewed-on: https://gerrit.chromium.org/gerrit/36397 Tested-by: asharif <asharif@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Commit-Ready: asharif <asharif@chromium.org>
89 lines
1.9 KiB
Bash
Executable File
89 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
check_compiler_flags()
|
|
{
|
|
local binary="$1"
|
|
local flags=false
|
|
local fortify=true
|
|
local stack=true
|
|
${readelf} -p .GCC.command.line "${binary}" | \
|
|
{
|
|
while read flag ; do
|
|
flags=true
|
|
case "${flag}" in
|
|
*"-U_FORTIFY_SOURCE"*)
|
|
fortify=false
|
|
;;
|
|
*"-fno-stack-protector"*)
|
|
stack=false
|
|
;;
|
|
esac
|
|
done
|
|
if ! ${flags}; then
|
|
echo "File not built with -frecord-gcc-switches: ${binary}"
|
|
return
|
|
fi
|
|
${fortify} || echo "File not built with -D_FORTIFY_SOURCE: ${binary}"
|
|
${stack} || echo "File not built with -fstack-protector: ${binary}"
|
|
}
|
|
}
|
|
|
|
check_linker_flags()
|
|
{
|
|
local binary="$1"
|
|
local pie=false
|
|
local relro=false
|
|
local now=false
|
|
local gold=false
|
|
${readelf} -dlSW "${binary}" | \
|
|
{
|
|
while read line ; do
|
|
case "${line}" in
|
|
*".note.gnu.gold-version"*)
|
|
gold=true
|
|
;;
|
|
*"Shared object file"*)
|
|
pie=true
|
|
;;
|
|
*"GNU_RELRO"*)
|
|
relro=true
|
|
;;
|
|
*"BIND_NOW"*)
|
|
now=true
|
|
;;
|
|
esac
|
|
done
|
|
|
|
${pie} || echo "File not PIE: ${binary}"
|
|
${relro} || echo "File not built with -Wl,-z,relro: ${binary}"
|
|
${now} || echo "File not built with -Wl,-z,now: ${binary}"
|
|
${gold} || echo "File not built with gold: ${binary}"
|
|
}
|
|
}
|
|
|
|
check_binaries()
|
|
{
|
|
local CTARGET="${CTARGET:-${CHOST}}"
|
|
local readelf="${CTARGET}-readelf"
|
|
local binary
|
|
scanelf -y -B -F '%F' -R "${D}" | \
|
|
while read binary ; do
|
|
case "${binary}" in
|
|
*.ko)
|
|
;;
|
|
${D}usr/lib/debug/*)
|
|
;;
|
|
*)
|
|
check_compiler_flags "${binary}"
|
|
check_linker_flags "${binary}"
|
|
;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
check_binaries
|