Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 954347 - dropbear package should be built with PIE flags
Summary: dropbear package should be built with PIE flags
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: dropbear
Version: 19
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Christopher Meng
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 892837
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-22 10:56 UTC by Dhiru Kholia
Modified: 2014-03-25 03:43 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-18 02:02:55 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
this should enable PIE (4.96 KB, text/x-rpm-spec)
2013-05-14 11:00 UTC, Dhiru Kholia 		no flags Details
View All

Description Dhiru Kholia 2013-04-22 10:56:12 UTC 
Description of problem:

http://fedoraproject.org/wiki/Packaging:Guidelines#PIE says that "you MUST
enable the PIE compiler flags if your package is long running ...".

However, currently dropbear is not being built with PIE flags. This is a
clear violation of the packaging guidelines.

This issue (in its wider scope) is being discussed at,

https://fedorahosted.org/fesco/ticket/1104

https://lists.fedoraproject.org/pipermail/devel/2013-March/180827.html

Version-Release number of selected component (if applicable):

dropbear-0.55-5.fc19.x86_64.rpm

How reproducible:

You can use following programs to check if a package is hardened:

http://people.redhat.com/sgrubb/files/rpm-chksec

OR

https://github.com/kholia/checksec

Steps to Reproduce:

Get scanner.py from https://github.com/kholia/checksec

$ ./scanner.py dropbear-0.55-5.fc19.x86_64.rpm
dropbear,dropbear-0.55-5.fc19.x86_64.rpm,/usr/bin/dbclient,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
dropbear,dropbear-0.55-5.fc19.x86_64.rpm,/usr/bin/dropbearconvert,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
dropbear,dropbear-0.55-5.fc19.x86_64.rpm,/usr/bin/dropbearkey,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
dropbear,dropbear-0.55-5.fc19.x86_64.rpm,/usr/sbin/dropbear,NX=Enabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Disabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=network-ip
Comment 1 Dhiru Kholia 2013-05-14 11:00:15 UTC 
Created attachment 747643 [details]
this should enable PIE
Comment 2 Christopher Meng 2013-05-16 09:40:48 UTC 
(In reply to comment #1)
> Created attachment 747643 [details]
> this should enable PIE

Hi,

Like https://bugzilla.redhat.com/show_bug.cgi?id=955147

After hardenbuild koji failed with such logs:

http://koji.fedoraproject.org/koji/getfile?taskID=5387032&name=build.log

I cannot add PIE flag now.
Comment 3 Dhiru Kholia 2013-05-16 10:26:34 UTC 
Christopher,

Please see https://bugzilla.redhat.com/show_bug.cgi?id=892837 (and upvote the fix for #892837).
Comment 4 Christopher Meng 2013-05-18 02:02:55 UTC 
http://koji.fedoraproject.org/koji/taskinfo?taskID=5394334
Note You need to log in before you can comment on or make changes to this bug.