Ticket 47968 - Fix for format string in syslog.

Bug Description:  There is a format string error in log.c's usage of syslog (3).
This was detected in the RPM build which applies different settings.

Fix Description:  Fix the format string to be safe. Add the format string check
to the gcc-security check so that we can test for this.

https://fedorahosted.org/389/ticket/47968

Author: wibrown

Review by: One line rule.

configure

@@ -17737,9 +17737,9 @@ if test "${enable_gcc_security+set}" = set; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
   if test -z "$RPM_HARDEND_CC_TRUE"; then :
-   gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 "
+   gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -Werror=format-security -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 "
 else
-   gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches"
+   gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -Werror=format-security"
 
 fi
 

configure.ac

@@ -95,8 +95,8 @@ AC_ARG_ENABLE(gcc-security, AS_HELP_STRING([--enable-gcc-security], [Enable gcc
 [
   AC_MSG_RESULT(yes)
   AM_COND_IF([RPM_HARDEND_CC],
-  [ gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 " ],
-  [ gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches" ]
+  [ gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -Werror=format-security -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 " ],
+  [ gccsec_defs="-Wall -Wp,-D_FORITY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -Werror=format-security" ]
   )
 ],
 [

ldap/servers/slapd/log.c

@@ -1981,7 +1981,7 @@ slapd_log_audit (
     }
     if (lbackend & LOGGING_BACKEND_SYSLOG) {
         /* This returns void, so we hope it worked */
-        syslog(LOG_NOTICE, buffer);
+        syslog(LOG_NOTICE, "%s", buffer);
     }
 #ifdef WITH_SYSTEMD
     if (lbackend & LOGGING_BACKEND_JOURNALD) {
@@ -2040,7 +2040,7 @@ slapd_log_auditfail (
     }
     if (lbackend & LOGGING_BACKEND_SYSLOG) {
         /* This returns void, so we hope it worked */
-        syslog(LOG_NOTICE, buffer);
+        syslog(LOG_NOTICE, "%s", buffer);
     }
 #ifdef WITH_SYSTEMD
     if (lbackend & LOGGING_BACKEND_JOURNALD) {