rpmlint: new "executable stack" warnings on rawhide

[Fabio Valentini]

Hi everybody,

I've noticed that as of some days ago, some packages I build on rawhide are
now triggering the "W: executable-stack" warning for all included
executables and shared libraries.

I'm not sure which change might be the cause of this, but meson 0.50.0
seems to be a good candidate, since all my affected packages are built with
meson and the new version landed six days ago.

Is that new warning something we should worry about?

Fabio

[John Reiser]

>  I've noticed that as of some days ago, some packages I build on
> rawhide are now triggering the "W: executable-stack" warning for all included
> executables and shared libraries.
>  
>  I'm not sure which change might be the cause of this, but meson 0.50.0 seems to be a
> good candidate, since all my affected packages are built with meson and the new version
> landed six days ago.
>  
>  Is that new warning something we should worry about? 
Yes.  The warning means that an executable is not as secure as it could be against
malware.

The likely cause is some assembly-language source file that lacks a line such as
         .section        .note.GNU-stack,"",@progbits
which tells the assembler and static binder (/usr/bin/ld) that "the code in this
file
does not need an executable stack."

To identify the files that lack the line:
	find src -name '*.S'  |  sort  > files-S.txt
	grep -l note.GNU-stack  $(< files-S.txt)  > files-non-W-stack.txt
	comm -3 files-S.txt files-non-W-stack.txt

To remove the warning: append the line to the end of each file listed
in the output from 'comm'.

[Fabio Valentini]

On Sun, Mar 17, 2019 at 2:49 PM John Reiser <jreiser(a)bitwagon.com&gt; wrote:
>  > I've noticed that as of some days ago, some packages I build on rawhide are now
> triggering the "W: executable-stack" warning for all included executables and
> shared libraries.
>  >
>  > I'm not sure which change might be the cause of this, but meson 0.50.0 seems to
> be a good candidate, since all my affected packages are built with meson and the new
> version landed six days ago.
>  >
>  > Is that new warning something we should worry about?
>
>  Yes.  The warning means that an executable is not as secure as it could be against
> malware.
>
>  The likely cause is some assembly-language source file that lacks a line such as
>           .section        .note.GNU-stack,"",@progbits
>  which tells the assembler and static binder (/usr/bin/ld) that "the code in this
> file
>  does not need an executable stack." 
No, that's not it. The packages that now trigger this warning don't
contain any assembly sources, only Vala (which is compiled to C) and
C.
For example:
https://taskotron.fedoraproject.org/artifacts/all/2ac7eb02-48a6-11e9-a48a...

Fabio

> To identify the files that lack the line:
>         find src -name '*.S'  |  sort  > files-S.txt
>         grep -l note.GNU-stack  $(< files-S.txt)  > files-non-W-stack.txt
>         comm -3 files-S.txt files-non-W-stack.txt
>
> To remove the warning: append the line to the end of each file listed
> in the output from 'comm'.
> _______________________________________________
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]

[Björn 'besser82' Esser]

Am Sonntag, den 17.03.2019, 15:00 +0100 schrieb Fabio Valentini:
>  On Sun, Mar 17, 2019 at 2:49 PM John Reiser
> <jreiser(a)bitwagon.com&gt;
>  wrote:
>  > > I've noticed that as of some days ago, some packages I build on
>  > > rawhide are now triggering the "W: executable-stack" warning for
>  > > all included executables and shared libraries.
>  > > 
>  > > I'm not sure which change might be the cause of this, but meson
>  > > 0.50.0 seems to be a good candidate, since all my affected
>  > > packages are built with meson and the new version landed six days
>  > > ago.
>  > > 
>  > > Is that new warning something we should worry about?
>  > 
>  > Yes.  The warning means that an executable is not as secure as it
>  > could be against malware.
>  > 
>  > The likely cause is some assembly-language source file that lacks a
>  > line such as
>  >          .section        .note.GNU-stack,"",@progbits
>  > which tells the assembler and static binder (/usr/bin/ld) that "the
>  > code in this file
>  > does not need an executable stack."
>  
>  No, that's not it. The packages that now trigger this warning don't
>  contain any assembly sources, only Vala (which is compiled to C) and
>  C.
>  For example: 
>
> https://taskotron.fedoraproject.org/artifacts/all/2ac7eb02-48a6-11e9-a48a...
>  
>  Fabio
>  
>  > To identify the files that lack the line:
>  >         find src -name '*.S'  |  sort  > files-S.txt
>  >         grep -l note.GNU-stack  $(< files-S.txt)  > files-non-W-
>  > stack.txt
>  >         comm -3 files-S.txt files-non-W-stack.txt
>  > 
>  > To remove the warning: append the line to the end of each file
>  > listed
>  > in the output from 'comm'. 

Did you examine the C code files generated from the Vala sources not to
have local functions that are called through function pointers?

See [1] as a reference.


[1]  https://www.win.tue.nl/~aeb/linux/hh/protection.html

[Fabio Valentini]

On Sun, Mar 17, 2019 at 12:07 PM Fabio Valentini <decathorpe(a)gmail.com&gt; wrote:
>  Hi everybody,
>
>  I've noticed that as of some days ago, some packages I build on rawhide are now
> triggering the "W: executable-stack" warning for all included executables and
> shared libraries.
>
>  I'm not sure which change might be the cause of this, but meson 0.50.0 seems to be a
> good candidate, since all my affected packages are built with meson and the new version
> landed six days ago.
>
>  Is that new warning something we should worry about?
>
>  Fabio 
Well, it turns out, it *was* a bug in meson 0.50.0 which, by now, has
affected a long list of packages and is starting to cause issues with
SELinux denials, etc.

The issue is tracked at [0] and meson has been fixed for all branches
of fedora, rebuilds of affected packages are running now.

Fabio

[0]: https://bugzilla.redhat.com/show_bug.cgi?id=1699099

[Adam Williamson]

On Sun, 2019-03-17 at 12:07 +0100, Fabio Valentini wrote:
>  Hi everybody,
>  
>  I've noticed that as of some days ago, some packages I build on rawhide are
>  now triggering the "W: executable-stack" warning for all included
>  executables and shared libraries.
>  
>  I'm not sure which change might be the cause of this, but meson 0.50.0
>  seems to be a good candidate, since all my affected packages are built with
>  meson and the new version landed six days ago.
>  
>  Is that new warning something we should worry about? 
Just to loop back on this...this wound up causing a release blocker
bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1699099

mclasen, mcatanzaro and I investigated it and eventually worked out
that it is indeed caused by a bug in meson 0.50.0:

https://github.com/mesonbuild/meson/issues/5268

the offending meson change was actually later reverted for other
reasons. I have now backported the reversion to the Fedora meson
packages and am rebuilding everything that was built with meson 0.50.0
(it's likely that at least some of the rebuilds aren't strictly
necessary, but it's easier to rebuild everything than try to figure out
which packages did and didn't wind up with execstack marked bits).

Note meson 0.50.0 wound up in the buildroots for F29 and F30 as well as
Rawhide, so there are rebuilds for all three going through.

Once I've rebuilt everything (there are quite a lot of things) I'll
figure out a strategy for sending out updates.

Thanks for spotting this earlier, wish we'd worked out the cause at the
time, it would've saved some pain!
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net

[Fabio Valentini]

On Tue, Apr 16, 2019 at 6:11 PM Adam Williamson
<adamwill(a)fedoraproject.org&gt; wrote:
>  On Sun, 2019-03-17 at 12:07 +0100, Fabio Valentini wrote:
>  > Hi everybody,
>  >
>  > I've noticed that as of some days ago, some packages I build on rawhide are
>  > now triggering the "W: executable-stack" warning for all included
>  > executables and shared libraries.
>  >
>  > I'm not sure which change might be the cause of this, but meson 0.50.0
>  > seems to be a good candidate, since all my affected packages are built with
>  > meson and the new version landed six days ago.
>  >
>  > Is that new warning something we should worry about?
>
>  Just to loop back on this...this wound up causing a release blocker
>  bug:
>
>  https://bugzilla.redhat.com/show_bug.cgi?id=1699099
>
>  mclasen, mcatanzaro and I investigated it and eventually worked out
>  that it is indeed caused by a bug in meson 0.50.0:
>
>  https://github.com/mesonbuild/meson/issues/5268
>
>  the offending meson change was actually later reverted for other
>  reasons. I have now backported the reversion to the Fedora meson
>  packages and am rebuilding everything that was built with meson 0.50.0
>  (it's likely that at least some of the rebuilds aren't strictly
>  necessary, but it's easier to rebuild everything than try to figure out
>  which packages did and didn't wind up with execstack marked bits).
>
>  Note meson 0.50.0 wound up in the buildroots for F29 and F30 as well as
>  Rawhide, so there are rebuilds for all three going through.
>
>  Once I've rebuilt everything (there are quite a lot of things) I'll
>  figure out a strategy for sending out updates. 
Since you probably have a list of affected packages / builds, I can
help by submitting updates for my own packages at least (once the
rebuilds are finished), if that helps.

Fabio

> Thanks for spotting this earlier, wish we'd worked out the cause at the
> time, it would've saved some pain!
> --
> Adam Williamson
> Fedora QA Community Monkey
> IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
> http://www.happyassassin.net
> _______________________________________________
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]

[Adam Williamson]

On Tue, 2019-04-16 at 19:44 +0200, Fabio Valentini wrote:
>  On Tue, Apr 16, 2019 at 6:11 PM Adam Williamson
>  <adamwill(a)fedoraproject.org&gt; wrote:
>  > On Sun, 2019-03-17 at 12:07 +0100, Fabio Valentini wrote:
>  > > Hi everybody,
>  > > 
>  > > I've noticed that as of some days ago, some packages I build on rawhide
> are
>  > > now triggering the "W: executable-stack" warning for all included
>  > > executables and shared libraries.
>  > > 
>  > > I'm not sure which change might be the cause of this, but meson 0.50.0
>  > > seems to be a good candidate, since all my affected packages are built with
>  > > meson and the new version landed six days ago.
>  > > 
>  > > Is that new warning something we should worry about?
>  > 
>  > Just to loop back on this...this wound up causing a release blocker
>  > bug:
>  > 
>  > https://bugzilla.redhat.com/show_bug.cgi?id=1699099
>  > 
>  > mclasen, mcatanzaro and I investigated it and eventually worked out
>  > that it is indeed caused by a bug in meson 0.50.0:
>  > 
>  > https://github.com/mesonbuild/meson/issues/5268
>  > 
>  > the offending meson change was actually later reverted for other
>  > reasons. I have now backported the reversion to the Fedora meson
>  > packages and am rebuilding everything that was built with meson 0.50.0
>  > (it's likely that at least some of the rebuilds aren't strictly
>  > necessary, but it's easier to rebuild everything than try to figure out
>  > which packages did and didn't wind up with execstack marked bits).
>  > 
>  > Note meson 0.50.0 wound up in the buildroots for F29 and F30 as well as
>  > Rawhide, so there are rebuilds for all three going through.
>  > 
>  > Once I've rebuilt everything (there are quite a lot of things) I'll
>  > figure out a strategy for sending out updates.
>  
>  Since you probably have a list of affected packages / builds, I can
>  help by submitting updates for my own packages at least (once the
>  rebuilds are finished), if that helps. 
Thanks, but it's probably gonna be easier for one person just to do it,
so we don't have to spend cycles trying to co-ordinate :P I'll let you
know if I need help, though.
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net