Hello Louis-Philippe,
I found this an interesting topic and as far as I see lintian is
triggered by a read function call in signalhandler.cpp
in SignalHandler::on_socketNotifier_activated.
This line raises currently already a warning "ignoring return value of",
which seems was tried to get silenced by a Q_UNUSED.
For a short test, lintian does not report this tag if the line
containing the read is just commented out.
I am not sure, but isn't the usage of "-D_FORTIFY_SOURCE=2"
expected to get g++ replace the call to "read" by the
buffer length checking "__read_chk"?
Kind regards,
Bernhard
--- /usr/share/lintian/lib/Lintian/Check/Binaries/Hardening.pm.orig 2022-08-08 19:27:26.707334129 +0200
+++ /usr/share/lintian/lib/Lintian/Check/Binaries/Hardening.pm 2022-08-08 18:55:32.695966301 +0200
@@ -105,6 +105,10 @@ sub visit_installed_files {
}
}
+ print "elf_unhardened: @elf_unhardened\n" if @elf_unhardened;
+ print "elf_hardened: @elf_hardened\n" if @elf_hardened;
+ print "built_with_golang: $self->built_with_golang\n" if $self->built_with_golang;
+
$self->pointed_hint('hardening-no-fortify-functions', $item->pointer)
if @elf_unhardened
&& !@elf_hardened
---
$ lintian --pedantic --show-overrides --display-info --verbose qpdfview_0.4.18-8_amd64.deb
elf_unhardened: read
I: qpdfview: hardening-no-fortify-functions [usr/bin/qpdfview]
N: This is not documentation, but help file used by the program. They need to be there.
O: qpdfview: package-contains-documentation-outside-usr-share-doc [usr/share/qpdfview/help.html]
https://sources.debian.org/src/lintian/2.115.2/data/binaries/hardened-functions/?hl=6#L49
$ objdump --disassemble qpdfview | grep -E "read@|^000" | grep read -B10 > qpdfview.txt
00000000000335e0 <read@plt>:
335e0: ff 25 8a 50 0d 00 jmp *0xd508a(%rip) # 108670 <read@GLIBC_2.2.5>
.
00000000000abcb0 <_ZN8qpdfview13SignalHandler27on_socketNotifier_activatedEv>:
abcef: e8 ec 78 f8 ff call 335e0 <read@plt>
.
qpdfview::SignalHandler::on_socketNotifier_activated()
./sources/signalhandler.cpp:74:void SignalHandler::on_socketNotifier_activated()
Q_UNUSED(read(s_sockets[1], &sigNumber, sizeof(int)));
.