Bug 2022973
Summary: | annobin needs to be taught about /usr/sbin/ldconfig | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 9 | Reporter: | Jan Pazdziora <jpazdziora> |
Component: | annobin | Assignee: | Nick Clifton <nickc> |
Status: | CLOSED ERRATA | QA Contact: | Václav Kadlčík <vkadlcik> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 9.0 | CC: | ashankar, codonell, dj, fweimer, jpazdziora, mcermak, mnewsome, nickc, pfrankli, rlemosor, sipoyare, vkadlcik |
Target Milestone: | rc | Keywords: | Bugfix, Triaged |
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | annobin-10.25-1.el9 | Doc Type: | No Doc Update |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2022-05-17 12:33:12 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Jan Pazdziora
2021-11-13 15:04:06 UTC
I filed this against glibc because the inconsistency of the %files with the disk layout bothers me in general. But maybe annocheck should be able to handle this situation gracefully. Adding Nick to Cc for potential assessment whether this is truly just a bug in annocheck. (In reply to Jan Pazdziora from comment #1) > Adding Nick to Cc for potential assessment whether this is truly just a bug > in annocheck. It kind of is and is not a bug. Annocheck has a special exception for the ldconfig executable because it is known to be built in a special way, and without a lot of the usual security features. The code however checks the absolute path: /* The ldconfig binary is known to be compiled with most security features. */ if (streq (data->full_filename, "/sbin/ldconfig")) { sprintf (reason, "the ldconfig binary is a special case, hand-crafted by the glibc build system"); skip (data, check < TEST_MAX ? check : TEST_NOTES, SOURCE_SKIP_CHECKS, reason); return true; } I did this because I was trying to keep the exception as narrow as possible, I did not want anybody to call their program "ldconfig" and then avoid the annocheck tests. But obviously I missed the AArch64 symlink case. I will fix this in the next release of annobin. We are going to implement full UsrMove in glibc eventually (maybe even for RHEL 9 GA), so annobin needs to be taught about /usr/sbin/ldconfig. Should be fixed in annobin-10.25-1.el9 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: annobin), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2022:2342 |