Nick Clifton [Mon, 3 Sep 2018 15:18:54 +0000 (16:18 +0100)]
Hardened:
Add test for ET_EXEC binaries.
Skip gap test if not built by gcc.
Document how to add new tests.
Annocheck:
Document how to add new tools.
Document --report-unknown option.
Change version number to 8.32.
Nick Clifton [Wed, 29 Aug 2018 16:39:10 +0000 (17:39 +0100)]
Fix bugs in section-size tool:
The "--section-size FOO" option will now work, (ie without the = sign).
The tool will notice and report sections that exist but which are empty.
Nick Clifton [Thu, 23 Aug 2018 10:27:17 +0000 (11:27 +0100)]
Demangle c++ mangled function names when reporting gaps.
Ignore small gaps.
Merge ranges when one is wholly covered by another.
Ignore gaps covered by _savegpr* or __x86.get_pc_thunk symbols.
Nick Clifton [Wed, 8 Aug 2018 12:35:16 +0000 (13:35 +0100)]
Quote rpm names when invoking system() as they may contain shell filename expansion characters.
Skip PIC checks for special functions.
Add __stack_chk_local_fail to the list of special functions.
Nick Clifton [Wed, 8 Aug 2018 08:20:36 +0000 (09:20 +0100)]
Change annobin plugin to only report an incompatibility if the major gcc version numbers differ.
Fix hardened checker to ignore compilation flag tests if the binary was not built with gcc.
Fix builtby tool to only report each kind of builder once.
Nick Clifton [Tue, 7 Aug 2018 14:11:30 +0000 (15:11 +0100)]
Fix bug in annobin plugin which would generate bogus assembler symbol names if static notes were not being generated.
Add new tool to annocheck = a section size calculator.
Add tests and documentation for the new tool.
Nick Clifton [Mon, 23 Jul 2018 14:36:42 +0000 (15:36 +0100)]
Record absence of FORTIFY_SOURCE and GLIBCXX_ASSERTIONS in the notes.
Count passes and fails for each component and report if some components pass but others do not.
Nick Clifton [Mon, 25 Jun 2018 15:18:45 +0000 (16:18 +0100)]
Add --debug-rpm=<file> option to annocheck.
Skip known glibc startup files when performing some hardening checks.
Look in symbol table in separate debug info files for even better symbol lookup
In annobin plugin make the initial symbol offset target specific, and only a value of 2 for PowerPC.
Nick Clifton [Wed, 6 Jun 2018 11:36:51 +0000 (12:36 +0100)]
Import eu-checksec program into annobin.
Rename to annocheck.
Add documentation.
Update testsuite to use it.
Fix minor bugs exposed by using annocheck.
Fix exit codes for scripts.
Nick Clifton [Tue, 20 Mar 2018 11:18:42 +0000 (11:18 +0000)]
Add function-verbose option to print messages when function notes are created.
Handle dwarf_version being -1.
Put the end-of-function symbol in the same section as the function itself.
Add function-sections-test.
Nick Clifton [Thu, 4 Jan 2018 08:53:23 +0000 (08:53 +0000)]
Update PowerPC and AArch64 plugins to use new version of annobin_output_note function.
Add checking of operator[] range and -fstack-clash-protection status to hardened.sh script.
Tweak test harness.
Nick Clifton [Wed, 3 Jan 2018 15:24:06 +0000 (15:24 +0000)]
Fix tests to work with enhanced scripts.
Enhance scripts so that they do not complain about not being able to parse notes if the notes are note needed.
Add support for recording _GLIBCXX_ASSERTIONS.
Add support for recording -fstack-clash-protection.