Bug 2044834

Summary:	annocheck FAIL: bind-now test (compat-libgfortran-48)
Product:	Red Hat Enterprise Linux 9	Reporter:	rlemosor
Component:	compat-libgfortran-48	Assignee:	Marek Polacek <mpolacek>
Status:	CLOSED ERRATA	QA Contact:	Václav Kadlčík <vkadlcik>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	ahajkova
Target Milestone:	rc	Keywords:	Bugfix, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	compat-libgfortran-48-4.8.5-36.5.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 13:49:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2044387

Description rlemosor 2022-01-25 10:10:31 UTC

Failed test: bind-now test

Test results:
\n Hardened: libgfortran.so.3.0.0: FAIL: bind-now test because not linked with -Wl'-z'now

Applicable RPMs:
compat-libgfortran-48-4.8.5-36.4.el9.1.aarch64.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.i686.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.ppc64le.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.s390x.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.x86_64.rpm

Recommendation: Please fix the build system for the package or else add a skip of tests to the rpminspect.yaml file. For more details please see https://sourceware.org/annobin/annobin.html/Test-bind-now.html and https://sourceware.org/annobin/annobin.html/Waiving-Hardened-Results.html#Waiving-Hardened-Results.

Why this bug was filed: All packages in RHEL 9 built with gcc (g++, etc.) are required to use a common set of flags provided by the distribution. These flags turn on important security and performance features so it is critical that any package that lacks these flags be repaired. A scanning tool named annocheck, part of the annobin package, was used to scan RHEL 9 packages. This BZ was created because binary packages of this component with the mentioned NVRs were not built with the requisite flags for one or more RHEL 9 architectures.

How to reproduce the failure: You could try running annocheck locally against your builds: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files.

Annocheck resources:
* annobin documentation: https://sourceware.org/annobin/annobin.html/index.html
* annocheck on the customer portal: https://access.redhat.com/documentation/en-us/red_hat_developer_toolset/9/html/user_guide/chap-annobin

Contacts:
* Instant messaging: #tools on IRC
* Email: use tools for generic questions. Otherwise, use go-tools and llvm-clang-list for Go and Clang/LLVM specific questions.
* annobin-annocheck maintainer: Nick Clifton (nickc)

Comment 2 Marek Polacek 2022-01-26 21:27:00 UTC

# rpm -q compat-libgfortran-48
compat-libgfortran-48-4.8.5-36.5.el9.x86_64
# annocheck --verbose /usr/lib64/libgfortran.so.3.0.0 
annocheck: Version 10.51.
Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: pie test 
Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: writable-got test 
Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: dynamic-segment test 
Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: bind-now test 
[...]

Although I still see 

# annocheck /usr/lib64/libgfortran.so.3.0.0 
annocheck: Version 10.51.
Hardened: libgfortran.so.3.0.0: FAIL: cf-protection test because .note.gnu.property section did not contain the necessary flags 

but this bug report doesn't mention that (???).

Comment 7 Marek Polacek 2022-01-27 15:07:53 UTC

Oh, I see, I'm using:

# GCC 4.8 doesn't know these options, but redhat-rpm-config supplies them.
OPT_FLAGS=`echo $OPT_FLAGS|sed -e 's/ -fstack-clash-protection -fcf-protection/ /g'`

so -fcf-protection won't work here.

Comment 9 errata-xmlrpc 2022-05-17 13:49:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: compat-libgfortran-48), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2593