OpenCPN Build on Debian

[nohal]

Hamish...
Thank you guys, just by accident looked at #538067 - ITP: opencpn -- A concise ChartPlotter/Navigator - Debian Bug report logs today and reminded myself what a job you guys have done

Pavel

[idpnd]

Very pleasing, thanks for your efforts!!

[HamishB]

Hi,

there seems to be a new lintian warning to deal with:

W: opencpn-plugins: hardening-no-fortify-functions usr/lib/opencpn/libdashboard_pi.so
N: 
N:    This package provides an ELF binary that lacks the use of fortified libc
N:    functions. Either there are no potentially unfortified functions called
N:    by any routines, all unfortified calls have already been fully validated
N:    at compile-time, or the package was not built with the default Debian
N:    compiler flags defined by dpkg-buildflags. If built using
N:    dpkg-buildflags directly, be sure to import CPPFLAGS.
N:    
N:    NB: Due to false-positives, Lintian ignores some unprotected functions
N:    (e.g. memcpy).
N:    
N:    Refer to http://wiki.debian.org/Hardening and
N:    http://bugs.debian.org/673112 for details.
N:    
N:    Severity: normal, Certainty: possible
N:    
N:    Check: binaries, Type: binary, udeb
N: 
W: opencpn-plugins: hardening-no-relro usr/lib/opencpn/libdashboard_pi.so
N: 
N:    This package provides an ELF binary that lacks the "read-only
N:    relocation" link flag. This package was likely not built with the
N:    default Debian compiler flags defined by dpkg-buildflags. If built using
N:    dpkg-buildflags directly, be sure to import LDFLAGS.
N:    
N:    Refer to http://wiki.debian.org/Hardening for details.
N:    
N:    Severity: normal, Certainty: certain
N:    
N:    Check: binaries, Type: binary, udeb
N: 
W: opencpn-plugins: hardening-no-fortify-functions usr/lib/opencpn/libgrib_pi.so
W: opencpn-plugins: hardening-no-relro usr/lib/opencpn/libgrib_pi.so
W: opencpn: hardening-no-fortify-functions usr/bin/opencpn
W: opencpn: hardening-no-relro usr/bin/opencpn

see
* http://wiki.debian.org/ReleaseGoals/...ningBuildFlags
* http://wiki.debian.org/Hardening
* http://wiki.debian.org/HardeningWalkthrough
* http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673112

(right now we are using compat level 7)

I quickly tried this patch without success, but as the comment says probably the CMakeLists.txt files need to be patched in some way.

Index: debian/rules
===================================================================
--- debian/rules	(revision 3073)
+++ debian/rules	(working copy)
@@ -7,9 +7,19 @@
 #  DEB_BUILD_OPTIONS's noopt perhaps that should be patched away and that
 #  logic be made to happen here?
 # Specifically, -O3's function inlining is desired.
-CFLAGS=-Wall
-CXXFLAGS=-Wall -O3
+#CFLAGS=-Wall
+#CXXFLAGS=-Wall -O3
 
+include /usr/share/hardening-includes/hardening.make
+DEB_CFLAGS_MAINT_APPEND=-O3
+CFLAGS=$(shell dpkg-buildflags --get CFLAGS)
+CXXFLAGS:=$(shell dpkg-buildflags --get CXXFLAGS)
+LDFLAGS=$(shell dpkg-buildflags --get LDFLAGS)
+CFLAGS+=$(HARDENING_CFLAGS)
+CXXFLAGS+=$(HARDENING_CXXFLAGS)
+LDFLAGS+=$(HARDENING_LDFLAGS)
+
+
 %:
 	dh $@ --parallel

?

thanks,
Hamish

[HamishB]

ok, after removing the ":" in CXXFLAGS and exporting those variables in debian/rules they take, but lead to a build error: (opencpn 2.5.0)

[...]
Linking CXX executable opencpn
/usr/bin/cmake -E cmake_link_script CMakeFiles/opencpn.dir/link.txt --verbose=1
/usr/bin/c++   -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security   -pthread   -Wl,-z,relro  -fPIE -pie  -Wl,-z,relro  -Wl,-z,now  CMakeFiles/opencpn.dir/src/chart1.cpp.o CMakeFiles/opencpn.dir/src/bbox.cpp.o CMakeFiles/opencpn.dir/src/ocpn_pixel.cpp.o CMakeFiles/opencpn.dir/src/chartdb.cpp.o CMakeFiles/opencpn.dir/src/chartdbs.cpp.o CMakeFiles/opencpn.dir/src/chartimg.cpp.o CMakeFiles/opencpn.dir/src/chcanv.cpp.o CMakeFiles/opencpn.dir/src/concanv.cpp.o CMakeFiles/opencpn.dir/src/cutil.c.o CMakeFiles/opencpn.dir/src/georef.c.o CMakeFiles/opencpn.dir/src/navutil.cpp.o CMakeFiles/opencpn.dir/src/routeman.cpp.o CMakeFiles/opencpn.dir/src/routemanagerdialog.cpp.o CMakeFiles/opencpn.dir/src/routeprop.cpp.o CMakeFiles/opencpn.dir/src/statwin.cpp.o CMakeFiles/opencpn.dir/src/tcmgr.cpp.o CMakeFiles/opencpn.dir/src/thumbwin.cpp.o CMakeFiles/opencpn.dir/src/options.cpp.o CMakeFiles/opencpn.dir/src/wvschart.cpp.o CMakeFiles/opencpn.dir/src/about.cpp.o CMakeFiles/opencpn.dir/src/ais.cpp.o CMakeFiles/opencpn.dir/src/pluginmanager.cpp.o CMakeFiles/opencpn.dir/src/gpxdocument.cpp.o CMakeFiles/opencpn.dir/src/scrollingdialog.cpp.o  -o opencpn -rdynamic -L/usr/lib/x86_64-linux-gnu -pthread -L/usr/lib/x86_64-linux-gnu -lwx_baseu-2.8 -lwx_gtk2u_core-2.8 -lwx_baseu_net-2.8 -lwx_baseu_xml-2.8 -lwx_gtk2u_html-2.8 -lwx_gtk2u_adv-2.8 -lwx_gtk2u_aui-2.8 libNMEA0183.a -lfreetype -lglib-2.0 -lgobject-2.0 -lgdk_pixbuf-2.0 -lgdk-x11-2.0 -lgtk-x11-2.0 -lcairo -lpango-1.0 -latk-1.0 libS57ENC.a libGARMINHOST.a -lGLU -lGL -lSM -lICE -lX11 -lXext -lbz2 -lz -ltinyxml -ldl -lgobject-2.0 
/usr/bin/ld: CMakeFiles/opencpn.dir/src/chart1.cpp.o: relocation R_X86_64_32 against `_ZN10GrabberWin12ms_classInfoE' can not be used when making a shared object; recompile with -fPIC
CMakeFiles/opencpn.dir/src/chart1.cpp.o: could not read symbols: Bad value
collect2: error: ld returned 1 exit status
make[3]: *** [opencpn] Error 1

by adding -fPIC in the main CMakeLists.txt,

IF(NOT WIN32)
  ADD_DEFINITIONS( "-Wall -fexceptions -rdynamic" )
  ADD_DEFINITIONS( " -O3 -fno-strict-aliasing -fPIC")
ENDIF(NOT WIN32)

it builds to completion and the main /usr/bin/opencpn hardening warning goes away, but the plugin warnings remain. I suspect these entries in plugins/*_pi/CMakeLists.txt are to blame,

 IF(NOT APPLE)
  SET(CMAKE_SHARED_LINKER_FLAGS "-Wl,-Bsymbolic")

& need to be changed to append instead of 'set', but I'm not sure how to do that with cmake.


?

thanks,
Hamish

[SethDart]

Change this:

  SET(CMAKE_SHARED_LINKER_FLAGS "-Wl,-Bsymbolic")

to this:

SET(CMAKE_SHARED_LINKER_FLAGS ${CMAKE_SHARED_LINKER_FLAGS} "-Wl,-Bsymbolic")

and it should do the job.

[HamishB]

thanks, seems like it's close but a stray ';' gets in there messing it up:

[...]
Linking CXX shared library libgrib_pi.so
cd /home/hamish/dev/opencpn/test_build5/opencpn-2.5.0+dfsg/obj-x86_64-linux-gnu/plugins/grib_pi && /usr/bin/cmake -E cmake_link_script CMakeFiles/grib_pi.dir/link.txt --verbose=1
/usr/bin/c++  -fPIC -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security   -pthread -pthread  -Wl,-z,relro  -fPIE -pie  -Wl,-z,relro  -Wl,-z,now ;-Wl,-Bsymbolic -shared -Wl,-soname,libgrib_pi.so -o libgrib_pi.so CMakeFiles/grib_pi.dir/src/grib_pi.cpp.o CMakeFiles/grib_pi.dir/src/grib.cpp.o CMakeFiles/grib_pi.dir/src/icons.cpp.o CMakeFiles/grib_pi.dir/src/GribReader.cpp.o CMakeFiles/grib_pi.dir/src/GribRecord.cpp.o CMakeFiles/grib_pi.dir/src/zuFile.cpp.o CMakeFiles/grib_pi.dir/src/IsoLine.cpp.o -L/usr/lib/x86_64-linux-gnu -pthread -L/usr/lib/x86_64-linux-gnu -lwx_baseu-2.8 -lwx_gtk2u_core-2.8 -lwx_baseu_net-2.8 -lwx_baseu_xml-2.8 -lwx_gtk2u_html-2.8 -lwx_gtk2u_adv-2.8 -lwx_gtk2u_aui-2.8 -lbz2 -lz 
c++: error: ;-Wl,-Bsymbolic: No such file or directory
make[3]: *** [plugins/grib_pi/libgrib_pi.so] Error 1

thanks,
Hamish

[HamishB]

the semicolon was because cmake was making it into a list, putting quotes around the whole thing preserves the whitespace:

SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} \"-Wl,-Bsymbolic\"")

Hamish

[bdbcat]

Hamish...

And so, the complete patch is....?

Dave

[HamishB]

Originally Posted by bdbcat

And so, the complete patch is....?

... still a work in progress.

stand by.

[HamishB]

by the way, these compiler warnings were found in the 2.5.0 source build, not sure if they've been taken care of since or not.

src/garmin/jeeps/gpsusbcommon.c:227:36: warning: array subscript is above array bounds [-Warray-bounds]
src/garmin/jeeps/gpsusbcommon.c:229:32: warning: array subscript is above array bounds [-Warray-bounds]
src/garmin/jeeps/gpsusbcommon.c:227:36: warning: array subscript is above array bounds [-Warray-bounds]
src/garmin/jeeps/gpsusbcommon.c:229:32: warning: array subscript is above array bounds [-Warray-bounds]
src/nmea.cpp:776:73: warning: format '%X' expects argument of type 'unsigned int', but argument 2 has type 'gps_mask_t {aka long unsigned int}' [-Wformat]

Hamish

[HamishB]

patch allowing pass-through & compile with hardening flags:

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0f5e2e3..1f0b36b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -174,7 +174,7 @@ INCLUDE_DIRECTORIES(${CMAKE_SOURCE_DIR}/include ${CMAKE_SOURCE_DIR}/src)
 #  IF NOT DEBUGGING CFLAGS="-O2 -march=native"
 IF(NOT WIN32)
   ADD_DEFINITIONS( "-Wall -Wno-unused -fexceptions -rdynamic" )
-  ADD_DEFINITIONS( " -g -fno-strict-aliasing")
+  ADD_DEFINITIONS( " -g -fno-strict-aliasing -fPIC")
 ENDIF(NOT WIN32)
 
 # Add some definitions to satisfy MS
diff --git a/plugins/dashboard_pi/CMakeLists.txt b/plugins/dashboard_pi/CMakeLists.txt
index 6296d66..a305b9c 100644
--- a/plugins/dashboard_pi/CMakeLists.txt
+++ b/plugins/dashboard_pi/CMakeLists.txt
@@ -47,7 +47,7 @@ IF(NOT WIN32)
  ADD_DEFINITIONS( "-Wall -O3 -fexceptions -fvisibility=hidden" )
 
  IF(NOT APPLE)
-  SET(CMAKE_SHARED_LINKER_FLAGS "-Wl,-Bsymbolic")
+  SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-Bsymbolic")
  ELSE(NOT APPLE)
   SET(CMAKE_SHARED_LINKER_FLAGS "-Wl -undefined dynamic_lookup")
  ENDIF(NOT APPLE)
diff --git a/plugins/demo_pi_sample/CMakeLists.txt b/plugins/demo_pi_sample/CMakeLists.txt
index 15e80ed..7d4aa2a 100644
--- a/plugins/demo_pi_sample/CMakeLists.txt
+++ b/plugins/demo_pi_sample/CMakeLists.txt
@@ -56,7 +56,7 @@ IF(NOT WIN32)
  ADD_DEFINITIONS( "-Wall -g -fexceptions -fvisibility=hidden" )
 
  IF(NOT APPLE)
-  SET(CMAKE_SHARED_LINKER_FLAGS "-Wl,-Bsymbolic")
+  SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-Bsymbolic")
  ELSE(NOT APPLE)
   SET(CMAKE_SHARED_LINKER_FLAGS "-Wl")
  ENDIF(NOT APPLE)
diff --git a/plugins/grib_pi/CMakeLists.txt b/plugins/grib_pi/CMakeLists.txt
index 9a10f01..f700c64 100644
--- a/plugins/grib_pi/CMakeLists.txt
+++ b/plugins/grib_pi/CMakeLists.txt
@@ -46,7 +46,7 @@ IF(NOT WIN32)
  ADD_DEFINITIONS( "-Wall -O0 -fexceptions -fvisibility=hidden" )
 
  IF(NOT APPLE)
-  SET(CMAKE_SHARED_LINKER_FLAGS "-Wl,-Bsymbolic")
+  SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,-Bsymbolic")
  ELSE(NOT APPLE)
   SET(CMAKE_SHARED_LINKER_FLAGS "-Wl -undefined dynamic_lookup")
  ENDIF(NOT APPLE)

it didn't want to compile without -fPIC. I don't know if that's generally wanted or just working around some other problem. (which may only show up on a different hardware platform like ARM)

I notice -O3 was removed from the main CMakeLists.txt file, was there a reason for the removal? (just curious)


fyi:

sid$ $ dpkg-buildflags 
CFLAGS=-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security
CPPFLAGS=-D_FORTIFY_SOURCE=2
CXXFLAGS=-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security
FFLAGS=-g -O2
LDFLAGS=-Wl,-z,relro

at the top of debian/rules:

# Optimization and debugging flags are added in CMakeLists.txt. To support
#  DEB_BUILD_OPTIONS's noopt perhaps that should be patched away and that
#  logic be made to happen here?
# Specifically, -O3's function inlining is desired.
#CFLAGS=-Wall
#CXXFLAGS=-Wall -O3

include /usr/share/hardening-includes/hardening.make
DEB_CFLAGS_MAINT_APPEND=-O3
CFLAGS=$(shell dpkg-buildflags --get CFLAGS)
CPPFLAGS=$(shell dpkg-buildflags --get CPPFLAGS)
CXXFLAGS=$(shell dpkg-buildflags --get CXXFLAGS)
LDFLAGS=$(shell dpkg-buildflags --get LDFLAGS)
CFLAGS+=$(HARDENING_CFLAGS)
CXXFLAGS+=$(HARDENING_CXXFLAGS)
LDFLAGS+=$(HARDENING_LDFLAGS)
export DEB_CFLAGS_MAINT_APPEND CFLAGS CPPFLAGS CXXFLAGS LDFLAGS

I'm currently scratching my header over this one:

Now running lintian...
W: opencpn-plugins: hardening-no-fortify-functions usr/lib/opencpn/libdashboard_pi.so
N: 
N:    This package provides an ELF binary that lacks the use of fortified libc
N:    functions. Either there are no potentially unfortified functions called
N:    by any routines, all unfortified calls have already been fully validated
N:    at compile-time, or the package was not built with the default Debian
N:    compiler flags defined by dpkg-buildflags. If built using
N:    dpkg-buildflags directly, be sure to import CPPFLAGS.
N:    
N:    NB: Due to false-positives, Lintian ignores some unprotected functions
N:    (e.g. memcpy).
N:    
N:    Refer to http://wiki.debian.org/Hardening and
N:    http://bugs.debian.org/673112 for details.
N:    
N:    Severity: normal, Certainty: possible
N:    
N:    Check: binaries, Type: binary, udeb
N: 
W: opencpn-plugins: hardening-no-fortify-functions usr/lib/opencpn/libgrib_pi.so
Finished running lintian.

even if I force CPPLAGS (-D_FORTIFY_SOURCE=2) into the cmake build/linking flags.


Hamish

[MichaelIP]

Hello,
Newly registered to this forum, I was looking for some information on OpenCpn under Debian. This thread seems to be very interesting.

I look for an OpenCpn package but did not find it, so that, I compile it on a newly installed Debian computer (2.6.32.5 under GNOME) and using the tips indicated on the OpenCpn website for compiling it on Linux side. OpenCpn runs well on, this computer, exept when trying to use OpenGL. Therfore, latest Debian distrib seems to be ok for compiling OpenCpn.

I came to this site because I whould like to run OpenCpn on RaspBian distrib, which is a Debian distribution dedicated to the Raspberry PI computer. I'm following this thread for gathering information to success with my objective.

Not sure this will help, but this is still an information.

Regards.