Nice. Concept ACK.

ASLR/PIE check on OSX can be done with otool -hv <file>. Not sure how we would execute otools in gitian. NX checks can be done over a vmmap check. For Travis we should create a native osx build (which could run otools to check the executable).

Nice! So testing this would be:
Recompile with --disable-hardening (or subsets of those flags) and making sure security-check.py complains?

How to check security for Windows ?

@gavinandresen Right, to speed up testing you could use any C file:

cat >  test1.c << EOF
#include <stdio.h>

int main()
{
    printf("the quick brown fox jumps over the lazy god\n");
    return 0;
}
EOF
gcc test1.c -o test1 -Wl,-zexecstack;
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all -pie -fPIE
contrib/devtools/security-check.py test1; echo $?
gcc test1.c -o test1 -fstack-protector-all -pie -fPIE -Wl,-zrelro  -Wl,-z,now
contrib/devtools/security-check.py test1; echo $?

Output:

test1: failed PIE NX RELRO Canary
1
test1: failed PIE RELRO Canary
1
test1: failed PIE RELRO
1
test1: failed RELRO
1
0

@LongShao007 yes, how? (readelf doesn't, but objdump -x does in fact work for PE files, but I wouldn't know what flags to look for)

On windows:

NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP):

-DllCharacteristics     00000100
+DllCharacteristics     00000000

PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR):

+DllCharacteristics     00000000
-DllCharacteristics     00000040

Not sure whether there is a RELRO equivalent, Canary is there but difficult to check from the outside as the mingw library is linked statically.

Edit: Ok, added the windows checks above for PE executables, and converted the above test to a test script test-security-check.py.

@theuni paths to tools like READELF, OBJDUMP can now be overridden

concept ACK

Looks good other than the comment above. Something to note:
The libevent brought in a dependency on clock_gettime, which is a glibc compat issue. Once we bump to a newer gcc, we'll have to work that out for releases.

As discussed on IRC, this should also be hooked up to a make target for easier testing w/ travis and gitian. That can be done as a next step.