Description of problem: After prepared rebase, annocheck failures discovered errors I think in every bind library. bind tried to do some special magic for printing out backtraces when it crashes. I think all those symbols are errors Version-Release number of selected component (if applicable): bind-9.16.15-1.el9 How reproducible: reliable Steps to Reproduce: 1. extract bind-libs rpm 2. annocheck --verbose usr/lib*/lib*.so.* 3. Actual results: Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_acl_isany) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_adb_setadbsize) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_catz_get_iterator) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_dispatch_getsocket) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_journal_empty) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_keynode_dsset) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_loadctx_cancel) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_message_gettsig) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_message_pseudosectiontotext) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_message_getrawmessage) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_nsec_setbit) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns__rbtnode_getdistance) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (addr range: 0xaa170..0xb3678) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rcode_fromtext) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdata_txt_first) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdata_apl_current) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdata_fromregion) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdata_towire) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdata_fromstruct) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rdatatype_attributes) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: isc__rdatalist_disassociate) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (addr range: 0xf2210..0xfba58) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_resolver_freeze) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_rpz_type2str) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_soa_getserial) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_tsec_gettype) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_validator_send) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_view_setnewzonedir) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_zone_attach) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_zone_setminrefreshtime) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_zone_getnotifyacl) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_zone_getorigin) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_zone_rekey) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dst_algorithm_supported) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dst__openssl_toresult) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (function: dns_client_mctx) Hardened: /usr/lib64/libdns-9.16.15-RH.so: FAIL: stack-clash test because -fstack-clash-protection not enabled (addr range: 0x18c420..0x1969b8) Expected results: only PASS: or skip: should be reported. Additional info: Could not yet find any pattern, how were failing symbols selected. They seem to be reliably same. I think they are false positive, but haven't found any way to prove it (yet).
Created attachment 1788842 [details] all failures list all failures in bind 9.16.15
It might be indeed problem of using libtool, which is used to build bind. It might be fixed by libtool fixed and then just rebuild to scan resulting build.
Last build still does not pass annocheck, but there is much less failures. For every shared library it reports on aarch64: branch-protection test because The -mbranch-protection option was not used 1) annocheck 'rhel-policy' test fails for /usr/lib64/libbind9-9.16.20-RH.so on aarch64 Result: VERIFY Waiver Authorization: Not Waivable Details: annocheck: Version 9.90. Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: pie test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: WARN: DW_FORM_GNU_strp_alt not yet handled Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: writeable-got test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: dynamic-segment test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: bind-now test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: info: set binary producer to Gas version 2. Hardened: /usr/lib64/libbind9-9.16.20-RH.so: info: notes produced by assembler plugin version 1 Hardened: /usr/lib64/libbind9-9.16.20-RH.so: info: set binary producer to Gimple version 9. Hardened: /usr/lib64/libbind9-9.16.20-RH.so: info: notes produced by lto plugin version 9.90 Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: stack-prot test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: pic test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: fortify test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: glibcxx-assertions test because source language not C++ Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: optimization test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: warnings test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: lto test because LTO compilation detected Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: stack-clash test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: gnu-relro test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: notes test because no gaps found Hardened: /usr/lib64/libbind9-9.16.20-RH.so: FAIL: branch-protection test because The -mbranch-protection option was not used Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: cf-protection test because not an x86 executable Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: entry test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: go-revision test because no GO compiled code found Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: only-go test because not compiled for x86 Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: production test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: run-path test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: rwx-seg test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: short-enum test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: skip: stack-realign test because not an x86 executable Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: textrel test Hardened: /usr/lib64/libbind9-9.16.20-RH.so: PASS: threads test Suggested Remedy: See annocheck(1) for more information. ... 4) annocheck 'rhel-policy' test fails for /usr/lib64/libisc-9.16.20-RH.so on aarch64 Result: VERIFY Waiver Authorization: Not Waivable Details: annocheck: Version 9.90. Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: pie test Hardened: /usr/lib64/libisc-9.16.20-RH.so: WARN: DW_FORM_GNU_strp_alt not yet handled Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: writeable-got test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: dynamic-segment test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: bind-now test Hardened: /usr/lib64/libisc-9.16.20-RH.so: info: set binary producer to Gas version 2. Hardened: /usr/lib64/libisc-9.16.20-RH.so: info: notes produced by assembler plugin version 1 Hardened: /usr/lib64/libisc-9.16.20-RH.so: info: set binary producer to Gimple version 9. Hardened: /usr/lib64/libisc-9.16.20-RH.so: info: notes produced by lto plugin version 9.90 Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: stack-prot test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: pic test Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: fortify test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: glibcxx-assertions test because source language not C++ Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: optimization test Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: warnings test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: lto test because LTO compilation detected Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: stack-clash test Hardened: /usr/lib64/libisc-9.16.20-RH.so: FAIL: branch-protection test because not enabled (function: isc__shutdown) Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: gnu-relro test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: notes test because no gaps found Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: cf-protection test because not an x86 executable Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: entry test Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: go-revision test because no GO compiled code found Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: only-go test because not compiled for x86 Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: production test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: run-path test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: rwx-seg test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: short-enum test Hardened: /usr/lib64/libisc-9.16.20-RH.so: skip: stack-realign test because not an x86 executable Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: textrel test Hardened: /usr/lib64/libisc-9.16.20-RH.so: PASS: threads test Suggested Remedy: See annocheck(1) for more information.
I am sure BIND is passing flags as good as it is able to. But still some annobin checks fail. This change seems to be introduced outside of my package and would be probably solved somewhere else too. Would keep the bug open until it can pass gating tests without waiving, but I doubt I can improve anything on my side.
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.