Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #14401 > unrolled thread

Lintian info message "hardening-no-bindnow" with vanilla debian/rules

Back to article view | Back to linux.debian.maint.python

Contents

  Lintian info message "hardening-no-bindnow" with vanilla debian/rules Julian Gilbey <jdg@debian.org> - 2022-08-30 10:00 +0200
    Re: Lintian info message "hardening-no-bindnow" with vanilla  debian/rules Gregor Riepl <onitake@gmail.com> - 2022-08-30 19:40 +0200
      Re: Lintian info message "hardening-no-bindnow" with vanilla  debian/rules Julian Gilbey <julian@d-and-j.net> - 2022-08-31 10:20 +0200

#14401 — Lintian info message "hardening-no-bindnow" with vanilla debian/rules

Hi!

A package I maintain within the team (python3-pyxdameraulevenshtein)
gives the following lintian message:

I: python3-pyxdameraulevenshtein: hardening-no-bindnow [usr/lib/python3/dist-packages/pyxdameraulevenshtein.cpython-310-x86_64-linux-gnu.so]

The debian/rules file is very bland, essentially:

%:
        dh $@ --buildsystem=pybuild

and there is nothing about CFLAGS or the like in the setup.py file.
So if having this hardening flag enabled is a good thing, it should
probably be enabled somewhere within the pybuild system, rather than
every individual package with an extension file doing it.

Or have I missed something?

Best wishes,

   Julian

[toc] | [next] | [standalone]

#14412 — Re: Lintian info message "hardening-no-bindnow" with vanilla debian/rules

> I: python3-pyxdameraulevenshtein: hardening-no-bindnow [usr/lib/python3/dist-packages/pyxdameraulevenshtein.cpython-310-x86_64-linux-gnu.so]
> 
> and there is nothing about CFLAGS or the like in the setup.py file.
> So if having this hardening flag enabled is a good thing, it should
> probably be enabled somewhere within the pybuild system, rather than
> every individual package with an extension file doing it.

Hardening is generally a good thing, but can break code in subtle ways.
I suppose that's why it was decided that enabling it by default in 
Debian was deemed too risky.

Enabling it is quite easy, though: Just add

export DEB_BUILD_MAINT_OPTIONS = hardening=+all

near the top of your d/rules file. Some build systems may require 
additional flags, as documented here: https://wiki.debian.org/Hardening

Also, note that hardening-no-bindnow is an Informational message, so not 
strictly something that needs to be acted upon: 
https://lintian.debian.org/tags/hardening-no-bindnow

YMMV.

[toc] | [prev] | [next] | [standalone]

#14415 — Re: Lintian info message "hardening-no-bindnow" with vanilla debian/rules

On Tue, Aug 30, 2022 at 07:33:07PM +0200, Gregor Riepl wrote:
> > I: python3-pyxdameraulevenshtein: hardening-no-bindnow [usr/lib/python3/dist-packages/pyxdameraulevenshtein.cpython-310-x86_64-linux-gnu.so]
> > 
> > and there is nothing about CFLAGS or the like in the setup.py file.
> > So if having this hardening flag enabled is a good thing, it should
> > probably be enabled somewhere within the pybuild system, rather than
> > every individual package with an extension file doing it.
> 
> Hardening is generally a good thing, but can break code in subtle ways.
> I suppose that's why it was decided that enabling it by default in Debian
> was deemed too risky.
> 
> Enabling it is quite easy, though: Just add
> 
> export DEB_BUILD_MAINT_OPTIONS = hardening=+all
> [...]

Thanks Gregor, I'll try that!

> Also, note that hardening-no-bindnow is an Informational message, so not
> strictly something that needs to be acted upon:
> https://lintian.debian.org/tags/hardening-no-bindnow

Indeed, hence the title of this message :-)

Best wishes,

   Julian

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web