configure.ac ldap/admin Makefile.am rpm/389-ds-base.spec.in wrappers/systemd.template.asan.service.in

[William Brown]

 Makefile.am                               |   18 ++++++++++++-
 configure.ac                              |    3 +-
 ldap/admin/src/scripts/start-dirsrv.in    |   25 ++++++++++++------
 rpm/389-ds-base.spec.in                   |   41 +++++++++++++++++++++++++++---
 wrappers/systemd.template.asan.service.in |   35 +++++++++++++++++++++++++
 5 files changed, 108 insertions(+), 14 deletions(-)

New commits:
commit c9e49213f816ddef19bc0bda8727ddf5576f7368
Author: William Brown <firstyear(a)redhat.com&gt;
Date:   Thu Apr 28 14:35:42 2016 +1000

    Ticket 48350 - Integrate ASAN into our rpm build process
    
    Bug Description:  To improve our QE, we need to be more aggresive during our
    tests in QE for detecting issues.
    
    Fix Description:  This improves our ASAN integration with our rpms and systemd.
    This way, we can give ASAN builds to QE for testing, and we can produce
    non-instrumented builds for production releases.
    
    Note that if you run ./configure --enable-asan; make rpms, this will create
    an ASAN instrumented RPM.
    
    https://fedorahosted.org/389/ticket/48350
    
    Author: wibrown
    
    Review by: nhosoi (Thanks!)

diff --git a/Makefile.am b/Makefile.am
index 0e9939a..e715fba 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -26,6 +26,12 @@ NUNC_STANS_ON = 0
 endif
 DS_INCLUDES = -I$(srcdir)/ldap/include -I$(srcdir)/ldap/servers/slapd -I$(srcdir)/include
-I. $(NUNC_STANS_INCLUDES)
 
+if enable_asan
+ASAN_ON = 1
+else
+ASAN_ON = 0
+endif
+
 # these paths are dependent on the settings of prefix and exec_prefix which may be
specified
 # at make time.  So we cannot use AC_DEFINE in the configure.ac because that would set
the
 # values prior to their being defined.  Defining them here ensures that they are
properly
@@ -1797,6 +1803,7 @@ fixupcmd = sed \
 	-e 's,@enable_autobind\@,$(enable_autobind),g' \
 	-e 's,@enable_auto_dn_suffix\@,$(enable_auto_dn_suffix),g' \
 	-e 's,@enable_presence\@,$(enable_presence),g' \
+	-e 's,@enable_asan\@,$(ASAN_ON),g' \
 	-e 's,@ECHO_N\@,$(ECHO_N),g' \
 	-e 's,@ECHO_C\@,$(ECHO_C),g' \
 	-e 's,@brand\@,$(brand),g' \
@@ -1864,6 +1871,7 @@ fixupcmd = sed \
 	-e 's,@enable_autobind\@,$(enable_autobind),g' \
 	-e 's,@enable_auto_dn_suffix\@,$(enable_auto_dn_suffix),g' \
 	-e 's,@enable_presence\@,$(enable_presence),g' \
+	-e 's,@enable_asan\@,$(ASAN_ON),g' \
 	-e 's,@ECHO_N\@,$(ECHO_N),g' \
 	-e 's,@ECHO_C\@,$(ECHO_C),g' \
 	-e 's,@brand\@,$(brand),g' \
@@ -1925,10 +1933,18 @@ endif
 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
 	$(fixupcmd) $^ > $@
 
+
+if enable_asan
+# yes, that is an @ in the filename . . .
+%/$(PACKAGE_NAME)@.service: %/systemd.template.asan.service.in
+	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
+	$(fixupcmd) $^ > $@
+else
 # yes, that is an @ in the filename . . .
 %/$(PACKAGE_NAME)@.service: %/systemd.template.service.in
 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
 	$(fixupcmd) $^ > $@
+endif
 
 %/$(PACKAGE_NAME).systemd: %/systemd.template.sysconfig
 	if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
@@ -1974,7 +1990,7 @@ rpmbrprep: dist-bzip2 rpmroot
 	cp $(distdir).tar.bz2 $(RPMBUILD)/SOURCES
 	cp $(srcdir)/rpm/389-ds-base-git.sh $(RPMBUILD)/SOURCES
 	cp $(srcdir)/rpm/389-ds-base-devel.README $(RPMBUILD)/SOURCES
-	sed -e "s/__VERSION__/$(RPM_VERSION)/" -e
"s/__RELEASE__/$(RPM_RELEASE)/" -e
"s/__NUNC_STANS_ON__/$(NUNC_STANS_ON)/" <
$(abs_builddir)/rpm/389-ds-base.spec > $(RPMBUILD)/SPECS/389-ds-base.spec
+	sed -e "s/__VERSION__/$(RPM_VERSION)/" -e
"s/__RELEASE__/$(RPM_RELEASE)/" -e
"s/__NUNC_STANS_ON__/$(NUNC_STANS_ON)/" -e "s/__ASAN_ON__/$(ASAN_ON)/"
 < $(abs_builddir)/rpm/389-ds-base.spec > $(RPMBUILD)/SPECS/389-ds-base.spec
 
 # Requires rpmdevtools. Consider making this a dependancy of rpms.
 rpmsources: rpmbrprep
diff --git a/configure.ac b/configure.ac
index 9544bbc..85e99f0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -69,7 +69,7 @@ AC_MSG_CHECKING(for --enable-debug)
 AC_ARG_ENABLE(debug, AS_HELP_STRING([--enable-debug], [Enable debug features (default:
no)]),
 [
   AC_MSG_RESULT(yes)
-  debug_defs="-g3 -DDEBUG -DMCC_DEBUG"
+  debug_defs="-g3 -DDEBUG -DMCC_DEBUG -O0"
 ],
 [
   AC_MSG_RESULT(no)
@@ -88,6 +88,7 @@ AC_ARG_ENABLE(asan, AS_HELP_STRING([--enable-asan], [Enable gcc address
sanitize
   asan_defs=""
 ])
 AC_SUBST([asan_defs])
+AM_CONDITIONAL(enable_asan,test "$enable_asan" = "yes")
 
 AM_CONDITIONAL([RPM_HARDEND_CC], [test -f /usr/lib/rpm/redhat/redhat-hardened-cc1])
 AC_MSG_CHECKING(for --enable-gcc-security)
diff --git a/ldap/admin/src/scripts/start-dirsrv.in
b/ldap/admin/src/scripts/start-dirsrv.in
index 4bc0ba2..410786b 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -60,6 +60,14 @@ start_instance() {
             return 1
         fi
     else
+        if test 1 -eq @enable_asan@; then
+            echo "NOTICE: Starting instance ${SERV_ID} with ASAN options."
+            echo "This is probably not what you want. Please contact support."
+            : ${ASAN_LOG_PATH:=$RUN_DIR/ns-slapd-${SERV_ID}.asan}
+            echo "Asan errors will go to ${ASAN_LOG_PATH}*"
+            export ASAN_OPTIONS="detect_leaks=1 symbolize=1 detect_deadlocks=1
log_path=${ASAN_LOG_PATH}"
+            export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
+        fi
         $SERVERBIN_DIR/ns-slapd -D $CONFIG_DIR -i $PIDFILE "$@"
         if [ $? -ne 0 ]; then
             return 1
@@ -70,16 +78,17 @@ start_instance() {
     max_count=${PID_TIME:-600}
     while test $loop_counter -le $max_count; do
         loop_counter=`expr $loop_counter + 1`
-        if test ! -f $PIDFILE ; then
-            if kill -s 0 $PID > /dev/null 2>&1 ; then
-                sleep 1
-        else
-            echo Server failed to start !!! Please check errors log for problems
-            return 1
-        fi
-        else
+        if test -f $PIDFILE ; then
             PID=`cat $PIDFILE`
             return 0;
+        else
+            # I'm not sure what this meant to achieve, but $PID is 0 here.
+            if kill -s 0 $PID > /dev/null 2>&1 ; then
+                sleep 1
+            else
+                echo Server failed to start !!! Please check errors log for problems
+                return 1
+            fi
         fi
     done
     echo Server not running!! Failed to start ns-slapd process.  Please check the errors
log for problems.
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index e4665e8..e3f7e1d 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -1,5 +1,8 @@
 
 %global pkgname   dirsrv
+
+# This is used in certain builds to help us know if it has extra features.
+%global variant base
 # for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official
release
 # also remove the space between % and global - this space is needed because
 # fedpkg verrel stupidly ignores comment lines
@@ -25,6 +28,13 @@
 %global jemalloc_ver 3.6.0
 %endif
 
+# This enables an ASAN build. This should not go to production, so we rename.
+%global use_asan __ASAN_ON__
+%if 0%{?use_asan:1}
+%global variant base-asan
+%endif
+
+
 # fedora 15 and later uses tmpfiles.d
 # otherwise, comment this out
 %{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}
@@ -35,7 +45,7 @@
 # set PIE flag
 %global _hardened_build 1
 
-Summary:          389 Directory Server (base)
+Summary:          389 Directory Server (%{variant})
 Name:             389-ds-base
 Version:          __VERSION__
 Release:          __RELEASE__%{?dist}
@@ -79,6 +89,9 @@ BuildRequires:    tcp_wrappers
 BuildRequires:    pam-devel
 BuildRequires:    systemd-units
 BuildRequires:    systemd-devel
+%if 0%{?use_asan:1}
+BuildRequires:    libasan
+%endif
 
 # this is needed for using semanage from our setup scripts
 Requires:         policycoreutils-python
@@ -125,6 +138,11 @@ Requires:         perl-Socket
 Requires:         perl-NetAddr-IP
 Requires:         systemd-libs
 
+%if 0%{?use_asan:1}
+Requires:    libasan
+Requires:    llvm
+%endif
+
 Source0:          http://port389.org/sources/%{name}-%{version}%{?prerel}.tar.bz2
 # 389-ds-git.sh should be used to generate the source tarball from git
 Source1:          %{name}-git.sh
@@ -137,12 +155,21 @@ Source3:         
http://www.port389.org/binaries/jemalloc-%{jemalloc_ver}.tar.b
 Source4:         
https://git.fedorahosted.org/cgit/nunc-stans.git/snapshot/nunc-stans-%{nu...
 %endif
 
+%if 0%{?use_asan:1}
+%description
+389 Directory Server is an LDAPv3 compliant server.  The base package includes
+the LDAP server and command line utilities for server administration.
+WARNING! This build is linked to Address Sanitisation libraries. This probably
+isn't what you want. Please contact support immediately.
+Please see http://seclists.org/oss-sec/2016/q1/363 for more information.
+%else
 %description
 389 Directory Server is an LDAPv3 compliant server.  The base package includes
 the LDAP server and command line utilities for server administration.
+%endif
 
 %package          libs
-Summary:          Core libraries for 389 Directory Server
+Summary:          Core libraries for 389 Directory Server (%{variant})
 Group:            System Environment/Daemons
 BuildRequires:    nspr-devel
 BuildRequires:    nss-devel
@@ -179,7 +206,7 @@ are used by the main package and the -devel package.  This allows the
-devel
 package to be installed with just the -libs package and without the main package.
 
 %package          devel
-Summary:          Development libraries for 389 Directory Server
+Summary:          Development libraries for 389 Directory Server (%{variant})
 Group:            Development/Libraries
 Requires:         %{name}-libs = %{version}-%{release}
 Requires:         pkgconfig
@@ -246,14 +273,20 @@ OPENLDAP_FLAG="--with-openldap"
 %{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}
 # hack hack hack https://bugzilla.redhat.com/show_bug.cgi?id=833529
 NSSARGS="--with-svrcore-inc=%{_includedir} --with-svrcore-lib=%{_libdir}
--with-nss-lib=%{_libdir} --with-nss-inc=%{_includedir}/nss3"
+
 %if %{use_nunc_stans}
 NUNC_STANS_FLAGS="--enable-nunc-stans
--with-nunc-stans=../nunc-stans-%{nunc_stans_ver}" 
 %endif
+
+%if 0%{?use_asan:1}
+ASAN_FLAGS="--enable-asan --enable-debug"
+%endif
+
 %configure --enable-autobind --with-selinux $OPENLDAP_FLAG $TMPFILES_FLAG \
            --with-systemdsystemunitdir=%{_unitdir} \
            --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
            --with-systemdgroupname=%{groupname} $NSSARGS $NUNC_STANS_FLAGS \
-           --with-systemd
+           --with-systemd $ASAN_FLAGS
 
 # Generate symbolic info for debuggers
 export XCFLAGS=$RPM_OPT_FLAGS
diff --git a/wrappers/systemd.template.asan.service.in
b/wrappers/systemd.template.asan.service.in
new file mode 100644
index 0000000..af91f16
--- /dev/null
+++ b/wrappers/systemd.template.asan.service.in
@@ -0,0 +1,35 @@
+# you usually do not want to edit this file - instead, edit the
+# @initconfigdir@/@package_name@.systemd file instead - otherwise,
+# do not edit this file in /lib/systemd/system - instead, do the following:
+# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service
+# mkdir -p /etc/systemd/system/@systemdgroupname@.wants
+# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line
+# where %i is the name of the instance
+# you may already have a symlink in
+# /etc/systemd/system/@systemdgroupname@.wants/dirsrv(a)%i.service pointing to
+# /lib/systemd/system/dirsrv\@.service - you will have to change it to link
+# to /etc/systemd/system/dirsrv\@.service instead
+# ln -s /etc/systemd/system/dirsrv\@.service
/etc/systemd/system/@systemdgroupname@.wants/dirsrv(a)%i.service
+# systemctl daemon-reload 
+# systemctl (re)start @systemdgroupname@
+[Unit]
+Description=@capbrand@ Directory Server with ASAN %i.
+PartOf=@systemdgroupname@
+After=chronyd.service network.service
+
+[Service]
+Type=notify
+EnvironmentFile=@initconfigdir@/@package_name@
+EnvironmentFile=@initconfigdir@/@package_name@-%i
+PIDFile=@localstatedir@/run/@package_name(a)/slapd-%i.pid
+# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.
+Environment='ASAN_OPTIONS="detect_leaks=1 symbolize=0
log_path=@localstatedir@/run/@package_name(a)/ns-slapd-%i.asan
detect_deadlocks=1"'
+LimitCORE=infinity
+ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i
@localstatedir@/run/@package_name(a)/slapd-%i.pid
+# if you need to set other directives e.g. LimitNOFILE=8192
+# set them in this file
+.include @initconfigdir@/@package_name@.systemd
+
+[Install]
+WantedBy=dirsrv.target
+