Commit Graph

565 Commits

Author SHA1 Message Date
6feb190125 0common-files.req.list: remove /etc/syslog.d
Since /etc/syslog.d has been moved from syslog-common to filesystem,
there is no need to keep /etc/syslog.d in the list.
2018-08-28 18:05:40 +00:00
Ivan A. Melnikov
c038a07d61 Disable stack verification and elflint on mips*
Most of the binaries on mipsel do not contain the stack section,
so this check is not relevant for that architecture. Morover,
it fails, since it can't find the stack section, which is
(rightfully) not present.

eu-elflint does not understand mipsel binaries currently,
so here we disable that check, too.
2018-07-26 17:44:30 +03:00
Ivan Zakharyaschev
ea7ca90347 verify-elf(get_verify_policy): fix whitespace 2018-05-23 17:02:10 +03:00
Ivan Zakharyaschev
c8d9060245 shell.req.files: include #!/usr/bin/env sh 2018-05-23 17:00:54 +03:00
Ivan Zakharyaschev
67ec541700 verify_rpath(): distinguish grep's failure and a normal valid case
Previously (according to the exit statuses):

0. if something strange was found in $rpath, an error was reported;
1. if nothing strange was found, no error was reported;
2. if grep failed, it looked like the previous case and no error was
reported (as if $rpath was valid).

Now, the pipe (and the whole script) would abort on grep's failure.
2018-05-23 17:00:54 +03:00
Ivan Zakharyaschev
b491c783f6 verify_stack(): distinguish failures and a normal status of grep
Now, if something fails, the pipe (and the function, and the whole
script) will fail.

If the exit codes are normal, they are handled according to our logic.

Previously, a failure (which is an exceptional rare case) would lead to:

1. skipping the further exe_stack check and error_strict STACK "$f" 'STACK entry not found'
2. silently skipping the exe_stack check (which was impossible anyway because of the failure)
2018-05-23 17:00:54 +03:00
Ivan Zakharyaschev
cdefa4ab34 verify-elf(verify_unresolved): correctly treat grep's status, allow standalone use
The pipe (and the function, and the whole script) would fail when the
resulting constructed rpath was empty. But usually at least
$RPM_VERIFY_ELF_LDD_RPATH is not empty, so the bad behavior has not
been observed.

However, when verify-elf is used standalone, $RPM_VERIFY_ELF_LDD_RPATH
is empty indeed, and this improvement becomes important.

Before this improvement:

$ RPM_BUILD_ROOT=/home /usr/lib/rpm/verify-elf /bin/pwd; echo $?
1

After this improvement:

$ VERIFY_ELF_UNRESOLVED=strict RPM_BUILD_ROOT=/home /usr/lib/rpm/verify-elf /bin/pwd; echo $?
0
$ VERIFY_ELF_UNRESOLVED=strict RPM_BUILD_ROOT=/home /usr/lib/rpm/verify-elf /usr/lib64/python3/site-packages/_cffi_backend.cpython-35m.so; echo $?
verify-elf: ERROR: /usr/lib64/python3/site-packages/_cffi_backend.cpython-35m.so: undefined symbol: PyExc_SystemError
....
1
2018-05-23 17:00:54 +03:00
30d9979184 ldd.in: try interpreters listed in /usr/bin/ldd
When the given ELF file doesn't specify PT_INTERP, e.g. if it's a shared
library, we have to guess it.  We used to try the program interpreter
of dump_ld_config, but it doesn't work well enough in multilib
environments, so extend the guess by trying interpreters listed
in RTLDLIST from /usr/bin/ldd script.
2018-05-15 17:26:10 +00:00
Ivan Zakharyaschev
e8c7bc4453 find-package.in: group the pruned packages nicer in the list 2018-05-15 17:26:10 +00:00
2c2a5545e5 brp-check_contents: do not suppress normal grep output
The concerns of grep output were baseless, let grep print lines
matching the pattern.
2017-10-26 14:23:23 +00:00
232c7538e1 brp-check_contents: enable strict error checking
As the test rebuild of all packages in Sisyphus repository has shown
no false positives, it's safe to enable strict error checking.
2017-10-26 14:19:58 +00:00
7a81369647 Introduce brp-check_contents
Add a brp interface for checking contents of files in buildroot.
The initial revision of brp-check_contents scripts checks
for suspicious path names like /var/lib/run, complementing
the change introduced in sisyphus_check-0.8.43-alt1.
2017-10-25 03:16:59 +00:00
696f192aea scripts: ignore ELF shared objects with "no" machine type
When scanning files for deps, debuginfo, fixup, and verify_elf,
ignore files with type that matches "ELF * shared object, no machine, *"
pattern.

These are ELF files generated by GNU Guile, ignore them for now.
2017-04-18 16:42:41 +00:00
a95f23ef1a verify-elf: fix passing of LD_PRELOAD in verify_unresolved
In verify_unresolved(), do not preload requested objects to $elf_ldd
directly because the latter is not an ELF interpreter but a shell
script.  Instead, pass the list of objects that have to be preloaded
to $elf_ldd script which in turn assigns it to LD_PRELOAD variable
in the ELF interpreter invocation.
2017-01-14 13:42:53 +00:00
e8c780c2b0 Disable build and install of unpackaged files
These are no longer packaged anyway, so no need to bother.
2017-01-14 13:42:53 +00:00
Gleb Fotengauer-Malinovskiy
6409cf5038 Relax check for gcc package name in {cpp,pkgconfiglib}.req generators 2016-12-20 17:49:07 +03:00
Gleb Fotengauer-Malinovskiy
cec71f3fbf verify-elf: make verify_lfs check libraries too
Previously, verify_lfs checked if object has valid interpreter, but it
doesn't make sense in case of shared objects.  verify_lfs check is valid
for all ELFs linked with libraries supporting both LFS and non-LFS API
(libc.so and libz.so in our case).
2016-12-20 15:31:10 +03:00
Gleb Fotengauer-Malinovskiy
2781e0f2af Disable sisyphus_check dirlist test for /usr/lib/rpm
This directory now belongs to both librpm and librpm7.
2016-12-08 19:24:36 +03:00
a4fb4d42e7 verify-elf (verify_unresolved): treat PIEs as executables 2016-12-07 11:30:44 +00:00
8c1f9d589b Move "is this ELF shared object an executable" check to a separate script
* configure.ac (AC_OUTPUT): Add scripts/fixup-libraries.
* rpm-4_0.spec (%files build): Add %_rpmlibdir/is_elf_so_executable.
* scripts/is_elf_so_executable: New file.
* scripts/Makefile.am (EXTRA_DIST, config_SCRIPTS): Add it.
* scripts/fixup-libraries: Rename to scripts/fixup-libraries.in,
use is_elf_so_executable.
2016-12-07 11:30:42 +00:00
a51ea574e9 scripts/fixup-libraries: fix recognition of PIEs 2016-12-07 11:30:25 +00:00
Ivan Zakharyaschev
d362bae600 verify-elf made a bit safer: pipes or command substitutions make it fail
1. set -o pipefail
2. don't use command substitutions inside other complex expressions; just assign to a var -- then it would make the script fail
2016-11-30 17:49:59 +03:00
Ivan Zakharyaschev
00b00565ea verify-elf: don't call verify_rpath() under a pipe because the errors are saved in a var
(A pipe makes a subshell and the var is modified there.)
2016-11-30 17:48:24 +03:00
Ivan Zakharyaschev
c0f11587a5 verify-elf: don't confuse verify_rpath() in case of two RUNPATH/RPATHs (ALT#32826) 2016-11-30 17:30:49 +03:00
Ivan Zakharyaschev
91c923f251 verify-elf: tiny cleanup: unify the awk expression for RPATH extraction
Rewritten equivalently, like in lib.req.
2016-11-30 17:09:09 +03:00
Ivan Zakharyaschev
70369c1a8e verify-elf: tiny cleanup: local var declaration moved to the place of use
The other occurence of "rpath" is in the second part of a pipe and is
local to that subshell anyway.
2016-11-30 17:08:09 +03:00
Ivan Zakharyaschev
3172abb8c1 %%distribution: ALT Linux --> ALT (ALT#32707) and some minor corrections of old @altlinux.ru addresses 2016-11-29 15:12:34 +03:00
Ivan Zakharyaschev
66f1a4cb8d verify-elf: RUNPATH overrides RPATH for verify_unresolved
From ld.so's documentation about the search order:

Using the directories specified in the DT_RPATH dynamic section
attribute of the binary if present and DT_RUNPATH attribute does not
exist. Use of DT_RPATH is deprecated.
2016-11-29 15:11:46 +03:00
Ivan Zakharyaschev
65509e2763 verify-elf: honor RUNPATH, too (like in lib.req.in:95 and debuginfo.req.in:76)
in addition to RPATH
2016-11-28 22:37:18 +03:00
Ivan Zakharyaschev
e2810bda5c added me to "Copyright (C)" 2016-11-28 22:37:13 +03:00
Ivan Zakharyaschev
d2e5d7dce7 shell.req: generalize the shebang regexp w.r.t. other locations of env
No need to be too strict here: shebang.req would (or should) catch bad
locations. It's not our work.
2016-05-27 16:02:37 +03:00
Ivan Zakharyaschev
ef66de16d5 shell.req: more idiomatic regexp for reading the shebang (use ?)
Compared with a similar regexp in Emacs sources --
http://git.altlinux.org/gears/e/emacs24.git?p=emacs24.git;a=blob;f=lisp/progmodes/sh-script.el;h=4700324d376db79e27d05e5352fff2f7e841a603;hb=HEAD#l1637
: "#![ \t]?\\([^ \t\n]*/bin/env[ \t]\\)?\\([^ \t\n]+\\)"

Conclusion: mostly identical meaning, with the exception of a more
liberal path of env in Emacs.

But ALT Sisyphus has /usr/bin/env only, so I don't see a good reason
to make the regexp more general. (If a different path is written
there, it won't work in ALT Sisyphus.)
2016-05-27 15:19:10 +03:00
Ivan Zakharyaschev
f9bf39c2aa shell.req: use the version of (ba|)sh from the shebang 2016-05-24 23:08:04 +03:00
Ivan Zakharyaschev
4d23ad4702 percolate: removed loop optimization (for code clarity), result won't change 2016-04-06 03:26:17 +03:00
Ivan Zakharyaschev
5630438416 debuginfo.req.files: ignore everything under /usr/lib/debug/.build-id/
The special directory structure there doesn't correspond to the
directory structure where debuginfo.req expects to find and process
*.debug files.
2016-04-05 22:57:42 +03:00
Ivan Zakharyaschev
dc0def4a3b percolate: hopefully, it will work just with /bin/sh (not to create an extra dep)
Conflicts:
	scripts/percolate
2016-04-05 22:57:42 +03:00
Ivan Zakharyaschev
0f969acf44 percolate: register it in Makefile etc. 2016-04-05 22:57:42 +03:00
Ivan Zakharyaschev
70bf25fc08 percolate: a helper script (will be used to follow symlinks only through known files) 2016-04-05 22:57:35 +03:00
Ivan Zakharyaschev
c024ff3ce7 brp-verify_elf: set -o pipefail -- just in case 2016-03-31 21:23:29 +03:00
Ivan Zakharyaschev
e124ef0b4c brp-verify_elf: handle all rules for setting LD_PRELOAD in the form of pairs of RPM_LD_PRELOAD_@ and RPM_FILES_TO_LD_PRELOAD_@ env vars 2016-03-31 21:23:29 +03:00
Ivan Zakharyaschev
9d2611ea44 verify-elf: substitute LD_PRELOAD before ldd (with what is passed on stdin after \t)
Of course, this will clean any externally set LD_PRELOAD.
2016-03-31 21:23:22 +03:00
b78cc75d12 lib.req: make "no symbol bindings" condition fatal 2016-03-10 15:30:27 +00:00
864001eba2 Revert "ldd.in: pass --list to rtld"
ld.so --list option is incompatible with LD_TRACE_LOADED_OBJECTS.

This reverts commit da9e6dfaab.
2016-03-10 16:10:54 +00:00
42eacfcc82 brp-bytecompile_python: exclude paths listed in $RPM_PYTHON3_COMPILE_INCLUDE (ALT#28606)
$RPM_PYTHON3_COMPILE_INCLUDE is usually a subset of
$RPM_PYTHON_COMPILE_INCLUDE, so add the former to the exclude list.
2016-03-09 15:02:22 +00:00
da9e6dfaab ldd.in: pass --list to rtld 2016-01-11 18:19:19 +00:00
Gleb Fotengauer-Malinovskiy
ae81f541b9 compress_files: change default method to xz 2015-12-02 21:46:44 +03:00
Gleb Fotengauer-Malinovskiy
39018f9f32 find-package: add support for newer naming of gcc and libstdc++-devel 2015-05-21 18:07:37 +03:00
6ad3a37cb9 verify-elf: fix regression in verify_lfs 2015-01-28 13:41:37 +00:00
a44f6ae523 verify-elf: make verify_stack work again 2015-01-23 14:56:29 +00:00
213af284d9 fixup-binconfig: strip rpaths
Extend library search path stripping algorithm to handle rpaths.
2014-02-25 12:25:51 +00:00