@@ -1,3 +1,4 @@

+%global security_hardening none

 %define glibc_target_cpu %{_build}

 Summary:	Main C library

@@ -1,3 +1,4 @@

+%global security_hardening none

 %define    OPENVMTOOLS_NAME            open-vm-tools

 %define    OPENVMTOOLS_VERSION         9.10.0

 Summary:        Kernel

@@ -147,13 +147,7 @@ class PackageBuilder(object):

                 self.installPackage(pkg,chrootID,destLogPath,listInstalledPackages)

     def adjustGCCSpecs(self, package, chrootID, logPath):

-        opt = ""

-        # TODO: reading of hardening flag from spec files

-        if package == "linux" or package == "glibc":

-            opt = " clean"

-        elif package.startswith("xf86-") or package.startswith("xorg-server") :

-            opt = " nonow"

-

+        opt = " " + constants.specData.getSecurityHardeningOption(package)

         shutil.copy2(self.adjustGCCSpecScript,  chrootID+"/tmp/"+self.adjustGCCSpecScript)

         cmdUtils=CommandUtils()

         cmd = "/tmp/"+self.adjustGCCSpecScript+opt

@@ -14,6 +14,7 @@ class SerializableSpecObject(object):

         self.specFile=""

         self.listSources=[]

         self.listPatches=[]

+        self.securityHardening=""

 class SerializableSpecObjectsUtils(object):

@@ -38,6 +39,7 @@ class SerializableSpecObjectsUtils(object):

             specObj.release=spec.getRelease()

             specObj.listSources=spec.getSourceNames()

             specObj.listPatches=spec.getPatchNames()

+            specObj.securityHardening=spec.getSecurityHardeningOption()

             for specPkg in specObj.listPackages:

                 specObj.installRequiresPackages[specPkg]=spec.getRequires(specPkg)

                 self.mapPackageToSpec[specPkg]=specName

@@ -97,6 +99,10 @@ class SerializableSpecObjectsUtils(object):

         self.logger.error("Could not able to find "+package+" package from specs")

         raise Exception("Invalid package:"+package)

+    def getSecurityHardeningOption(self, package):

+        specName=self.getSpecName(package)

+        return self.mapSerializableSpecObjects[specName].securityHardening

+

     def printAllObjects(self):

         listSpecs=self.mapSerializableSpecObjects.keys()

         for spec in listSpecs:

@@ -125,5 +131,6 @@ class SerializableSpecObjectsUtils(object):

             self.logger.info(specObj.installRequiresAllPackages)

             self.logger.info(" ")

             self.logger.info(specObj.installRequiresPackages)

+            self.logger.info("security_hardening: " + specObj.securityHardening)

             self.logger.info("------------------------------------------------")

@@ -12,6 +12,7 @@ class SpecParser(object):

         self.checkMacro=rpmMacro().setName("check")

         self.packages={}

         self.specAdditionalContent=""

+        self.globalSecurityHardening=""

     def readPkgNameFromPackageMacro(self,data,basePkgName=None):

@@ -63,6 +64,8 @@ class SpecParser(object):

                     self.packages[packageName].updatePackageMacro(macro)

             elif self.isPackageHeaders(line):

                 self.readPackageHeaders(line, self.packages[currentPkg])

+            elif self.isGlobalSecurityHardening(line):

+                self.readSecurityHardening(line)

             else:

                 self.specAdditionalContent+=line+"\n"

             i=i+1

@@ -187,6 +190,11 @@ class SpecParser(object):

             return True

         return False

+    def isGlobalSecurityHardening(self,line):

+        if re.search('^%global *security_hardening',line,flags=re.IGNORECASE) :

+            return True

+        return False

+

     def readHeader(self,line):

         headerSplitIndex=line.find(":")

         if(headerSplitIndex+1 == len(line) ):

@@ -290,3 +298,16 @@ class SpecParser(object):

             return True

         return False

+

+    def readSecurityHardening(self,line):

+        data = line.lower().strip();

+        words=data.split(" ")

+        nrWords = len(words)

+        if (nrWords != 3):

+            print "Error: Unable to parse line: "+line

+            return False

+        if (words[2] != "none" and words[2] != "nonow") :

+            print "Error: Invalid security_hardening value: " + words[2]

+            return False

+        self.globalSecurityHardening = words[2]

+        return True;

@@ -170,6 +170,9 @@ class Specutils(object):

         pkg = self.spec.packages.get('default')

         return pkg.name

+    def getSecurityHardeningOption(self):

+        return self.spec.globalSecurityHardening

+

 def main():

     spec = Specutils("/workspace1/myrepos/photon/SPECS/docker/docker.spec")

     print "packages",spec.getPackageNames()

@@ -1,6 +1,8 @@

 #! /bin/bash

-if [ $# -eq 1 -a "x$1" = "xclean" ]; then

+echo "Using options:" $@

+

+if [ $# -eq 1 -a "x$1" = "xnone" ]; then

     rm -f `dirname $(gcc --print-libgcc-file-name)`/../specs

     exit 0

 fi