Path: csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Gregor Riepl Newsgroups: linux.debian.maint.python Subject: Re: Lintian info message "hardening-no-bindnow" with vanilla debian/rules Date: Tue, 30 Aug 2022 19:40:01 +0200 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Tue Aug 30 17:33:35 2022 Old-Return-Path: X-Amavis-Spam-Status: No, score=-7.11 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 X-Gm-Message-State: ACgBeo2UGcaMDyzKznQrJx6LCWGTRJvQuTdfvaDC2dQIyPGxwOGmWRfk HFlDRYfbCrwPAQBk3VnEJbj51Mg9J04= X-Google-SMTP-Source: AA6agR5OsNadBdCOUlMu1eiCIYafSk0uM2sJYafiqO8NHKIOYVqRfrrOMt3p5nG9Ay10KjBQTmddkQ== X-Received: by 2002:a17:907:6d24:b0:731:7720:bb9b with SMTP id sa36-20020a1709076d2400b007317720bb9bmr18034442ejc.717.1661880790599; Tue, 30 Aug 2022 10:33:10 -0700 (PDT) MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.1.2 Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailing-List: archive/latest/20250 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/8db57d64-7cf9-f195-38a5-535715f4c89f@gmail.com Approved: robomod@news.nic.it Lines: 23 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 30 Aug 2022 19:33:07 +0200 X-Original-Message-ID: <8db57d64-7cf9-f195-38a5-535715f4c89f@gmail.com> X-Original-References: Xref: csiph.com linux.debian.maint.python:14412 > I: python3-pyxdameraulevenshtein: hardening-no-bindnow [usr/lib/python3/dist-packages/pyxdameraulevenshtein.cpython-310-x86_64-linux-gnu.so] > > and there is nothing about CFLAGS or the like in the setup.py file. > So if having this hardening flag enabled is a good thing, it should > probably be enabled somewhere within the pybuild system, rather than > every individual package with an extension file doing it. Hardening is generally a good thing, but can break code in subtle ways. I suppose that's why it was decided that enabling it by default in Debian was deemed too risky. Enabling it is quite easy, though: Just add export DEB_BUILD_MAINT_OPTIONS = hardening=+all near the top of your d/rules file. Some build systems may require additional flags, as documented here: https://wiki.debian.org/Hardening Also, note that hardening-no-bindnow is an Informational message, so not strictly something that needs to be acted upon: https://lintian.debian.org/tags/hardening-no-bindnow YMMV.