#1015905 src: qpdfview: please fix "hardening-no-fortify-functions" Lintian tag

Package:
src:qpdfview
Source:
qpdfview
Submitter:
Louis-Philippe Véronneau
Date:
2022-08-08 19:57:04 UTC
Severity:
normal
#1015905#5
Date:
2022-07-23 15:39:40 UTC
From:
To:
I have tried to fix the "hardening-no-fortify-functions" Lintian tag on
/usr/bin/qpdfview without success:

I have tried to use what this package does:

https://sources.debian.org/src/kcheckers/0.8.1-6/debian/rules/?hl=15#L15

This seems to be in-line with what the Hardening wiki asks for:

https://wiki.debian.org/Hardening#Notes_for_packages_using_QMake

Sadly, nothing changed? Tobias Frost says it might be a false positive,
but I'm not sure how to check this...

Help welcome!

#1015905#10
Date:
2022-08-08 19:55:14 UTC
From:
To:
Hello Louis-Philippe,
I found this an interesting topic and as far as I see lintian is
triggered by a read function call in signalhandler.cpp
in SignalHandler::on_socketNotifier_activated.

This line raises currently already a warning "ignoring return value of",
which seems was tried to get silenced by a Q_UNUSED.

For a short test, lintian does not report this tag if the line
containing the read is just commented out.

I am not sure, but isn't the usage of "-D_FORTIFY_SOURCE=2"
expected to get g++ replace the call to "read" by the
buffer length checking "__read_chk"?

Kind regards,
Bernhard
--- /usr/share/lintian/lib/Lintian/Check/Binaries/Hardening.pm.orig 2022-08-08 19:27:26.707334129 +0200 +++ /usr/share/lintian/lib/Lintian/Check/Binaries/Hardening.pm 2022-08-08 18:55:32.695966301 +0200 @@ -105,6 +105,10 @@ sub visit_installed_files { } } + print "elf_unhardened: @elf_unhardened\n" if @elf_unhardened; + print "elf_hardened: @elf_hardened\n" if @elf_hardened; + print "built_with_golang: $self->built_with_golang\n" if $self->built_with_golang; + $self->pointed_hint('hardening-no-fortify-functions', $item->pointer) if @elf_unhardened && !@elf_hardened --- $ lintian --pedantic --show-overrides --display-info --verbose qpdfview_0.4.18-8_amd64.deb elf_unhardened: read I: qpdfview: hardening-no-fortify-functions [usr/bin/qpdfview] N: This is not documentation, but help file used by the program. They need to be there. O: qpdfview: package-contains-documentation-outside-usr-share-doc [usr/share/qpdfview/help.html] https://sources.debian.org/src/lintian/2.115.2/data/binaries/hardened-functions/?hl=6#L49 $ objdump --disassemble qpdfview | grep -E "read@|^000" | grep read -B10 > qpdfview.txt 00000000000335e0 <read@plt>: 335e0: ff 25 8a 50 0d 00 jmp *0xd508a(%rip) # 108670 <read@GLIBC_2.2.5> . 00000000000abcb0 <_ZN8qpdfview13SignalHandler27on_socketNotifier_activatedEv>: abcef: e8 ec 78 f8 ff call 335e0 <read@plt> . qpdfview::SignalHandler::on_socketNotifier_activated() ./sources/signalhandler.cpp:74:void SignalHandler::on_socketNotifier_activated() Q_UNUSED(read(s_sockets[1], &sigNumber, sizeof(int))); .