weaselbot/conflict-set
1
Fork 0
forked from weaselab/conflict-set
Code Pull Requests Activity

CMakeLists.txt: don't require hardening-check --help to exit 0

Browse Source 
hardening-check --help returns exit code 1, so the previous
hardening_check_help_result EQUAL 0 guard skipped parsing the help
output entirely. As a result, architecture-specific flags such as
--nobranchprotection on x86_64 were never added to the test command.

Parse the help output regardless of exit code; the option-string regex
checks are sufficient.
This commit is contained in:
andrew
2026-06-22 13:05:33 -04:00
parent 789ae8cbb9
commit e9c904a86b
1 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+3 -6
View File
@@ -389,12 +389,10 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
COMMAND ${HARDENING_CHECK} --help COMMAND ${HARDENING_CHECK} --help
OUTPUT_VARIABLE hardening_check_help OUTPUT_VARIABLE hardening_check_help
ERROR_VARIABLE hardening_check_help ERROR_VARIABLE hardening_check_help
OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE OUTPUT_STRIP_TRAILING_WHITESPACE ERROR_STRIP_TRAILING_WHITESPACE)
RESULT_VARIABLE hardening_check_help_result)
set(hardening_check_arch_flags "") set(hardening_check_arch_flags "")
if(hardening_check_help_result EQUAL 0) # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
# Control flow integrity (CET) is x86-only and branch protection # is arm64-only, so ignore whichever doesn't apply.
# (PAC/BTI) is arm64-only, so ignore whichever doesn't apply.
if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
STREQUAL arm64) STREQUAL arm64)
if(hardening_check_help MATCHES "nocfprotection") if(hardening_check_help MATCHES "nocfprotection")
@@ -405,7 +403,6 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND BUILD_TESTING)
list(APPEND hardening_check_arch_flags --nobranchprotection) list(APPEND hardening_check_arch_flags --nobranchprotection)
endif() endif()
endif() endif()
endif()
add_test( add_test(
NAME hardening_check NAME hardening_check
COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify