Bug 1548665 - wireshark: Partial Fedora build flags injection
Summary: wireshark: Partial Fedora build flags injection
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: wireshark
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Ruprich 🐧
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords: Reopened
Depends On:
Blocks: Fedora28BuildFlags
TreeView+ depends on / blocked
 
Reported: 2018-02-24 10:11 UTC by Florian Weimer
Modified: 2018-06-05 14:10 UTC (History)
7 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-05-30 14:10:00 UTC


Attachments (Terms of Use)

Description Florian Weimer 2018-02-24 10:11:59 UTC
Various components of wireshark (e.g., /usr/bin/capinfos, /usr/lib64/wireshark/extcap/ciscodump, /usr/bin/wireshark-gtk, /usr/bin/wireshark-qt) in wireshark-cli-1:2.4.4-2.fc28.x86_64, wireshark-gtk-1:2.4.4-2.fc28.x86_64, wireshark-qt-1:2.4.4-2.fc28.x86_64 have not been linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config.

The build log doesn't show the actual flags, so it is difficult to tell what is going on there.

See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.

Comment 1 Fedora Update System 2018-03-13 11:31:17 UTC
wireshark-2.4.5-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ed785c3f1c

Comment 2 Fedora Update System 2018-03-13 11:33:00 UTC
wireshark-2.4.5-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-688817e677

Comment 3 Fedora Update System 2018-03-13 13:03:52 UTC
wireshark-2.4.5-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f19212808

Comment 4 Fedora Update System 2018-03-13 13:05:33 UTC
wireshark-2.4.5-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-89ed29a14b

Comment 5 Fedora Update System 2018-03-13 15:13:09 UTC
wireshark-2.4.5-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f19212808

Comment 6 Fedora Update System 2018-03-14 01:39:00 UTC
wireshark-2.4.5-2.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-89ed29a14b

Comment 7 Fedora Update System 2018-03-15 10:46:38 UTC
wireshark-2.4.5-3.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-bfdad62cd6

Comment 8 Fedora Update System 2018-03-15 10:48:36 UTC
wireshark-2.4.5-3.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf3f8e8b0

Comment 9 Fedora Update System 2018-03-15 13:34:21 UTC
wireshark-2.4.5-3.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-bfdad62cd6

Comment 10 Fedora Update System 2018-03-15 16:28:35 UTC
wireshark-2.4.5-3.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf3f8e8b0

Comment 11 Fedora Update System 2018-03-27 20:02:17 UTC
wireshark-2.4.5-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Florian Weimer 2018-04-03 09:00:08 UTC
wireshark-qt-2.4.5-3.fc28.x86_64 still lacks full RELRO:

$ checksec --file /usr/bin/wireshark-qt
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     6               13      /usr/bin/wireshark-qt

The RPM spec file is just bogus:

# FC5+ automatic -fstack-protector-all switch
export RPM_OPT_FLAGS=${RPM_OPT_FLAGS//-fstack-protector-strong/-fstack-protector-all}
export CFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export CXXFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export LDFLAGS="$RPM_OPT_FLAGS $LDFLAGS -pie -fPIC"

You should *really* use the standard build flags from redhat-rpm-config.

Comment 13 Fedora Update System 2018-04-17 00:13:14 UTC
wireshark-2.4.5-3.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Michal Ruprich 🐧 2018-05-02 12:35:42 UTC
The latest wireshark in rawhide has full RELRO. Closing this bug. Florian, feel free to reopen it again should you think something else is missing.

Thanks.

Comment 15 Florian Weimer 2018-05-07 12:23:30 UTC
/usr/bin/dumpcap and other programs in wireshark-cli-1:2.6.0-1.fc28.x86_64 still have this issue.  These binaries have not been linked with BIND_NOW.  Due to missing command lines from the build log, it is difficult to tell what is going on, but I think it's the faulty %build section mentioned in comment 12:

%build
%ifarch s390 s390x sparcv9 sparc64
export PIECFLAGS="-fPIE -fPIC"
%else
export PIECFLAGS="-fpie -fPIC"
%endif

# FC5+ automatic -fstack-protector-all switch
export RPM_OPT_FLAGS=${RPM_OPT_FLAGS//-fstack-protector-strong/-fstack-protector-all}
export CFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export CXXFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export LDFLAGS="$RPM_OPT_FLAGS $LDFLAGS -pie -fPIC"

Let me repeat that this is broken, you should use the flags described here and not try to meddle with PIE/PIC flags explicitly:

https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md

Comment 16 Fedora Update System 2018-05-15 13:42:15 UTC
wireshark-2.6.0-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-7e307f3e5a

Comment 17 Fedora Update System 2018-05-15 13:42:31 UTC
wireshark-2.6.0-3.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-279a8f520b

Comment 18 Fedora Update System 2018-05-15 20:52:21 UTC
wireshark-2.6.0-3.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-279a8f520b

Comment 19 Fedora Update System 2018-05-15 23:03:05 UTC
wireshark-2.6.0-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-7e307f3e5a

Comment 20 Fedora Update System 2018-05-24 15:29:11 UTC
wireshark-2.6.1-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d1cfa444d2

Comment 21 Fedora Update System 2018-05-24 15:29:39 UTC
wireshark-2.6.1-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3dfee621af

Comment 22 Fedora Update System 2018-05-25 15:42:37 UTC
wireshark-2.6.1-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d1cfa444d2

Comment 23 Fedora Update System 2018-05-25 18:44:54 UTC
wireshark-2.6.1-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3dfee621af

Comment 24 Fedora Update System 2018-05-30 14:10:00 UTC
wireshark-2.6.1-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2018-06-05 14:10:02 UTC
wireshark-2.6.1-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.