Rosecheckers Code

These checkers enforce the CERT C Secure Coding rules, and are freely available from Rosecheckers Github project. For questions regarding the CERT ROSE checkers, contact info@sei.cmu.edu.

Running Rosecheckers (the ROSE CERT C Checkers)

Checkers for CERT C secure coding rules/recommendations/guidelines are built into a tool called Rosecheckers, which uses the ROSE compiler. The program is run using all-lowercase 'rosecheckers'.
To run the Rosecheckers program on a C or C++ file, simply pass the file as an argument:

rosecheckers hello.c

If the C file violates some secure coding rules, the Rosecheckers program will print them out. If the Rosecheckers program can not find any violations, it prints nothing.

Rosecheckers actually takes the same arguments as gcc. So if your code has special flags that must be passed to the compiler, such as locations of include files, you can pass them to Rosecheckers in the same manner as gcc. Likewise, if you have a makefile that indicates how your program is to be built, you can run ROSE on your source code merely by instructing to your make command to use Rosecheckers as a drop-in replacement for gcc. One way to do this is:

make CC=rosecheckers

There are three ways to run Rosecheckers. You can run Rosecheckers using a downloadable virtual machine. You can build Rosecheckers, as well as ROSE itself, from source. Finally, Rosecheckers is available on Carnegie Mellon University's Andrew system to students, faculty, and staff.

Getting Rosecheckers code from source or container

You can get the rosecheckers code from source or a container from Rosecheckers Github project.

Follow the instructions on the Readme of that project site.

Secure Coding Rules Enforced by Rosecheckers

The SEI CERT C Secure Coding Standard is freely available.

Here is a breakdown of how thoroughly Rosecheckers enforces the C Secure Coding Rules and Recommendations: