Bug 2030298

Hi Zdenek,

(In reply to Zdenek Dohnal from comment #0)

> annocheck skips test for x86 executables when running on x86 executable:
> 
> 1) install x86_64 rpms from
> Hardened: /usr/bin/ippfind: skip: stack-realign test because not an x86
> executable 

I think that this is a case of poor communication on my part.  What annocheck should be saying is that the binary is a 64-bit x86_64 binary and not a 32-bit i686 binary.  The -mstack-realign option is only needed with 32-bit i686 binaries.

If you test the i686 rpms the you should see:

  % annocheck cups-ipptool-2.3.3op2-11.el9.i686.rpm 
  annocheck: Version 10.34.
  Hardened: ipptool: FAIL: stack-realign test because -mstack-realign not enabled 
  Hardened: ipptool: FAIL: cf-protection test because no protection enabled 
  Hardened: Rerun annocheck with --verbose to see more information on the tests.
  Hardened: ipptool: Overall: FAIL.
  Hardened: ippfind: FAIL: stack-realign test because -mstack-realign not enabled 
  Hardened: ippfind: FAIL: cf-protection test because no protection enabled 
  Hardened: ippfind: Overall: FAIL.

The cf-protection FAIL may be a mistake, due to synchronization issues between gcc and annobin builds, but the stack-realign result looks to be correct.

Hi Nick,

thank you for looking into it!

(In reply to Nick Clifton from comment #1)
> I think that this is a case of poor communication on my part.  What
> annocheck should be saying is that the binary is a 64-bit x86_64 binary and
> not a 32-bit i686 binary.  The -mstack-realign option is only needed with
> 32-bit i686 binaries.

Aha, then I understand - so the message should be:

Hardened: /usr/bin/ippfind: skip: stack-realign test because not an i686 executable

?

If the updated message is correct, it would be great if it was fixed in newer annobin release, because the current message is really misleading :) .

> 
> If you test the i686 rpms the you should see:
> 
>   % annocheck cups-ipptool-2.3.3op2-11.el9.i686.rpm 
>   annocheck: Version 10.34.
>   Hardened: ipptool: FAIL: stack-realign test because -mstack-realign not
> enabled 
>   Hardened: ipptool: FAIL: cf-protection test because no protection enabled 
>   Hardened: Rerun annocheck with --verbose to see more information on the
> tests.
>   Hardened: ipptool: Overall: FAIL.
>   Hardened: ippfind: FAIL: stack-realign test because -mstack-realign not
> enabled 
>   Hardened: ippfind: FAIL: cf-protection test because no protection enabled 
>   Hardened: ippfind: Overall: FAIL.
> 
> The cf-protection FAIL may be a mistake, due to synchronization issues
> between gcc and annobin builds, but the stack-realign result looks to be
> correct.

I mention -mstackrealign in #2030329 as well, it is used during compilation (http://download.eng.bos.redhat.com/brewroot/vol/rhel-9/packages/cups/2.3.3op2/11.el9/data/logs/i686/build.log):

Compiling ippfind.c...
gcc  -fPIC -g -fstack-protector-strong -D_GNU_SOURCE -I.. -D_CUPS_SOURCE -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign
                                                         --------------
 -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -DLDAP_DEPRECATED=1 -I/usr/include/libusb-1.0  -I/usr/include/dbus-1.0 -I/usr/lib/dbus-1.0/include  -DDBUS_API_SUBJECT_TO_CHANGE -D_FORTIFY_SOURCE=2 -D_REENTRANT  -I/usr/include/p11-kit-1  -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_THREAD_SAFE -D_REENTRANT  -Wall -Wno-format-y2k -Wunused -Wno-unused-result -Wsign-conversion -Wno-deprecated-declarations -Wno-format-truncation -Wno-tautological-compare -c -o ippfind.o ippfind.c

but not during linking (which is okay):

Linking ippfind...
gcc -L../cups  -Wl,-z,relro,-z,now -Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wall -fstack-clash-protection -D_FORTIFY_SOURCE=2 -fPIE -pie -fPIC -g -fstack-protector-strong -D_GNU_SOURCE -o ippfind ippfind.o -lavahi-common -lavahi-client  -L../cups -lcups

so IMO it is another false positive created by annobin being compiled with older gcc, but cups is built with newer....

(In reply to Zdenek Dohnal from comment #2)

> Hardened: /usr/bin/ippfind: skip: stack-realign test because not an i686
> executable

Indeed - I will update annocheck to do this.

> so IMO it is another false positive created by annobin being compiled with
> older gcc, but cups is built with newer....

This might be an issue with how gcc stores command line options in LTO object
files (so that the LTO compiler knows that it needs to use them).  I am talking
with the gcc engineers about this.

Fixed in annobin-10.37-1.el9

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: annobin), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:2342