Get the sec-hard tests to run correctly.

This fixes the way arguments were passed to security-check, and also
a typo in how BIND_NOW was being searched for in a list.

Also fix how symbol-check is invoked although that script isn't
currently used.

diff --git a/contrib/devtools/security-check.py b/contrib/devtools/security-check.py
index 301fea85c1f6f4e26d51efe1ce70297e350f6a01..84e7fceeacef5a0028e1e54617c544d465397e5d 100755 (executable)
--- a/contrib/devtools/security-check.py
+++ b/contrib/devtools/security-check.py
@@ -94,7 +94,7 @@ def check_ELF_RELRO(executable):
         raise IOError('Error opening file')
     for line in stdout.split(b'\n'):
         tokens = line.split()
-        if len(tokens)>1 and tokens[1] == b'(BIND_NOW)' or (len(tokens)>2 and tokens[1] == b'(FLAGS)' and b'BIND_NOW' in tokens[2]):
+        if len(tokens)>1 and tokens[1] == b'(BIND_NOW)' or (len(tokens)>2 and tokens[1] == b'(FLAGS)' and b'BIND_NOW' in tokens[2:]):
             have_bindnow = True
     return have_gnu_relro and have_bindnow
 

diff --git a/src/Makefile.am b/src/Makefile.am
index ea745a1f7d46e4dbb731e8cca361bb1ef19654a8..1c741d0555299134d731db0dc2e71dbc77d189d5 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -573,13 +573,13 @@ clean-local:
 check-symbols: $(bin_PROGRAMS)
 if GLIBC_BACK_COMPAT
        @echo "Checking glibc back compat of [$(bin_PROGRAMS)]..."
-       $(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(top_srcdir)/contrib/devtools/symbol-check.py < $(bin_PROGRAMS)
+       $(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS)
 endif
 
 check-security: $(bin_PROGRAMS)
 if HARDEN
        @echo "Checking binary security of [$(bin_PROGRAMS)]..."
-       $(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py < $(bin_PROGRAMS)
+       $(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS)
 endif
 
 %.pb.cc %.pb.h: %.proto