Bug 1548123

Summary: dbxtool: Partial build flags injection
Product: [Fedora] Fedora Reporter: Florian Weimer <fweimer>
Component: dbxtoolAssignee: Petr Šabata <psabata>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: pjones, psabata
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: dbxtool-8-6.fc29 dbxtool-8-5.fc28 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-17 00:17:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1539083    
Attachments:
Description Flags
F29 build.log none

Description Florian Weimer 2018-02-22 19:14:13 UTC 
/usr/bin/dbxtool in dbxtool-8-4.fc28.x86_64 is not linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config.

Naïvely setting LDFLAGS does not fix this because the recursive make invocation does not pass down the flags, it seems.  (I tried.)

Please fix this in Fedora 28 as well.

See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.
Comment 1 Petr Šabata 2018-04-12 14:05:47 UTC 
So I thought I had a fix when hardened.sh for F28 stopped complaining but when I then tested it with the F29 build, it's noisy again.  The build passes some of the flags more than once because it concatenates its own flags with flags from its deps.

I wonder if it's fine and it's just confusing the check script:

% hardened.sh /usr/bin/dbxtool
hardened.sh: /usr/bin/dbxtool: FAIL: multiple, different, settings of -fstack-protector used
hardened.sh: /usr/bin/dbxtool: FAIL: insufficient value for -D_FORTIFY_SOURCE=0
hardened.sh: /usr/bin/dbxtool: FAIL: multiple, different, settings of -fpic/-fpie used
hardened.sh: /usr/bin/dbxtool: FAIL: some parts built without operator range checking
hardened.sh: /usr/bin/dbxtool: FAIL: some parts built with different settings for -fcf-protection
hardened.sh: /usr/bin/dbxtool: FAIL: some parts built different CET settings
Comment 2 Petr Šabata 2018-04-12 14:08:56 UTC 
Created attachment 1420862 [details]
F29 build.log
Comment 3 Florian Weimer 2018-04-12 14:41:58 UTC 
(In reply to Petr Šabata from comment #1)
> So I thought I had a fix when hardened.sh for F28 stopped complaining but
> when I then tested it with the F29 build, it's noisy again.  The build
> passes some of the flags more than once because it concatenates its own
> flags with flags from its deps.

Is this check script based on annobin?  That's not quite there yet in rawhide (and has false negatives in Fedora 28).  Nick is working on this.

(In reply to Petr Šabata from comment #2)
> Created attachment 1420862 [details]
> F29 build.log

gcc -Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -o dbxtool dbxtool.o iter.o esltree.o -lpopt  -lefivar  -lpthread

This looks okay to me.
Comment 4 Petr Šabata 2018-04-12 14:50:40 UTC 
(In reply to Florian Weimer from comment #3)
> (In reply to Petr Šabata from comment #1)
> > So I thought I had a fix when hardened.sh for F28 stopped complaining but
> > when I then tested it with the F29 build, it's noisy again.  The build
> > passes some of the flags more than once because it concatenates its own
> > flags with flags from its deps.
> 
> Is this check script based on annobin?  That's not quite there yet in
> rawhide (and has false negatives in Fedora 28).  Nick is working on this.

It comes from the annobin package.

> (In reply to Petr Šabata from comment #2)
> > Created attachment 1420862 [details]
> > F29 build.log
> 
> gcc -Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
> -o dbxtool dbxtool.o iter.o esltree.o -lpopt  -lefivar  -lpthread
> 
> This looks okay to me.

Thanks!
Comment 5 Fedora Update System 2018-04-12 14:51:43 UTC 
dbxtool-8-5.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b61d0943c
Comment 6 Fedora Update System 2018-04-15 02:21:57 UTC 
dbxtool-8-5.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b61d0943c
Comment 7 Fedora Update System 2018-04-17 00:17:59 UTC 
dbxtool-8-5.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.