Bug 2044881

Summary:	annocheck FAIL: pie test (motif)
Product:	Red Hat Enterprise Linux 9	Reporter:	Rui Ormonde <rlemosor>
Component:	motif	Assignee:	Adam Jackson <ajax>
Status:	CLOSED ERRATA	QA Contact:	Tomas Pelka <tpelka>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	ndegraef, tpelka
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	motif-2.3.4-25.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 14:14:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2044387

Description Rui Ormonde 2022-01-25 10:35:19 UTC

Failed test: pie test

Test results:
\n Hardened: mwm: FAIL: pie test because not built with '-Wl'-pie' (gcc/clang) or '-buildmode pie' (go) \n Hardened: mwm: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: xmbind: FAIL: pie test because not built with '-Wl'-pie' (gcc/clang) or '-buildmode pie' (go) \n Hardened: xmbind: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: libMrm.so.4.0.4: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: libUil.so.4.0.4: FAIL: bind-now test because not linked with -Wl'-z'now \n Hardened: libXm.so.4.0.4: FAIL: bind-now test because not linked with -Wl'-z'now

Applicable RPMs:
motif-2.3.4-24.el9.aarch64.rpm; motif-2.3.4-24.el9.i686.rpm; motif-2.3.4-24.el9.ppc64le.rpm; motif-2.3.4-24.el9.s390x.rpm; motif-2.3.4-24.el9.x86_64.rpm; motif-devel-2.3.4-24.el9.aarch64.rpm; motif-devel-2.3.4-24.el9.i686.rpm; motif-devel-2.3.4-24.el9.ppc64le.rpm; motif-devel-2.3.4-24.el9.s390x.rpm; motif-devel-2.3.4-24.el9.x86_64.rpm

Recommendation: Please fix the build system for the package or else add a skip of tests to the rpminspect.yaml file. For more details please see https://sourceware.org/annobin/annobin.html/Test-pie.html and https://sourceware.org/annobin/annobin.html/Waiving-Hardened-Results.html#Waiving-Hardened-Results.

Why this bug was filed: All packages in RHEL 9 built with gcc (g++, etc.) are required to use a common set of flags provided by the distribution. These flags turn on important security and performance features so it is critical that any package that lacks these flags be repaired. A scanning tool named annocheck, part of the annobin package, was used to scan RHEL 9 packages. This BZ was created because binary packages of this component with the mentioned NVRs were not built with the requisite flags for one or more RHEL 9 architectures.

How to reproduce the failure: You could try running annocheck locally against your builds: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files.

Annocheck resources:
* annobin documentation: https://sourceware.org/annobin/annobin.html/index.html
* annocheck on the customer portal: https://access.redhat.com/documentation/en-us/red_hat_developer_toolset/9/html/user_guide/chap-annobin

Contacts:
* Instant messaging: #tools on IRC
* Email: use tools for generic questions. Otherwise, use go-tools and llvm-clang-list for Go and Clang/LLVM specific questions.
* annobin-annocheck maintainer: Nick Clifton (nickc)

Comment 6 Tomas Pelka 2022-02-23 19:42:41 UTC

https://dashboard.osci.redhat.com/#/artifact/brew-build/aid/43284478?focus=id:968851470b85f39d007b1a4c2f173166499e925245ffc3bbd725f3e229d5e287 ended with timeout, seems to be related to https://issues.redhat.com/browse/TFT-1025. The log did not showed major issues.

Comment 10 errata-xmlrpc 2022-05-17 14:14:34 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: motif), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2677