Page History

These checkers enforce the CERT C Secure Coding rules, and are freely available from their SourceForge Rosecheckers Github project.

...

For questions regarding the

...

CERT

...

ROSE checkers, contact info@sei.cmu.edu.

Getting Rosecheckers code from source or container

You can get the rosecheckers code from source or a container from Rosecheckers Github project.

Follow the instructions on the Readme of that project site.

Secure Coding Rules Enforced by Rosecheckers

The SEI CERT C Secure Coding Standard is

The ROSE CERT C Checkers are built into a program called 'rosecheckers'.
To run the rosecheckers program on a C or C++ file, simply pass the file as an argument:

rosecheckers hello.c

If the C file violates some secure coding rules, the rosecheckers program will print them out. If the rosecheckers program can not find any violations, it prints nothing.

Rosecheckers actually takes the same arguments as gcc. So if your code has special flags that must be passed to the compiler, such as locations of include files, you can pass them to rosecheckers in the same manner as gcc. Likewise, if you have a makefile that indicates how your program is to be built, you can run ROSE on your source code merely by instructing to your make command to use rosecheckers as a drop-in replacement for gcc. One way to do this is:

make CC=rosecheckers

There are three ways to run the ROSE CERT C checkers. They are available on CMU's Andrew system. In addition you can run them using a downloadable VM. Finally, you can build the CERT checkers, as well as ROSE itself, from source.

ROSE CERT C Checkers on Andrew

To run these checkers, you must have an Andrew account at CMU. The rosecheckers program is available in:

/afs/andrew/usr/svoboda/public/c_rules

To run rosecheckers, you simply add this directory to your PATH environment variable.

ROSE CERT C Checkers on a Virtual Machine

To run these checkers, you must use a virtualization system such as VMWare. The Sourceforge project provides a free example VM.

Once extracted, the rosebud directory is a VM image that can be powered on by VMWare. After logging in, you'll need to enter your login password again when the system asks for a sudo password. This is so the VM image can generate a unique SSH key.

After that, you should be able to access the VM from your host machine remotely using SSH. You'll need the VM's IP address for this, which you can learn with this command from the VM:

ip addr | grep /24

If it provides multiple IP addresses, select the one that begins
/192.168.../.

In the VM's home directory, there is a README file explaining what software is available there. It includes both ROSE and the CERT Secure Coding rule checkers.

Building Rosecheckers

To build the rosecheckers program from the CERT C Checkers, type:

make pgms

To test rosecheckers on the code samples from the CERT C Secure Coding Rules:

make tests

To build API documentation pages, you must have doxygen installed:

make doc

To clean documentation pages and build files:

make clean

Secure Coding Rules Enforced by Rosecheckers

The C Secure Coding Rules are freely available.

Here is a breakdown of how thoroughly rosecheckers Rosecheckers enforces the C Secure Coding Rules and Recommendations: