Bug 2023391
| Summary: | Environment CFLAGS are not respected by the libdnf plugin | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Pino Toscano <ptoscano> | |
| Component: | subscription-manager | Assignee: | Pino Toscano <ptoscano> | |
| Status: | CLOSED ERRATA | QA Contact: | Red Hat subscription-manager QE Team <rhsm-qe> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 9.0 | CC: | cdonnell, redakkan | |
| Target Milestone: | rc | Keywords: | Triaged | |
| Target Release: | 9.0 | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | subscription-manager-1.29.23-1.el9 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2023392 (view as bug list) | Environment: | ||
| Last Closed: | 2022-05-17 15:58:19 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2023392 | |||
Reproducing the failure : ======================== subscription management server: 3.2.22-1 subscription management rules: 5.41 subscription-manager: 1.29.21-1.el9 # annocheck --ignore-unknown --verbose /usr/lib64/libdnf/plugins/product-id.so annocheck: Version 10.48. Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: pie test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: writable-got test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: dynamic-segment test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: bind-now test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: entry test because shared libraries do not use entry points Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-relro test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: notes test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-branch-protection test because not an AArch64 binary Hardened: /usr/lib64/libdnf/plugins/product-id.so: FAIL: cf-protection test because .note.gnu.property section did not contain the necessary flags Hardened: /usr/lib64/libdnf/plugins/product-id.so: info: For more information visit: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-dynamic-tags test because AArch64 specific Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: fortify test because no C/C++ compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: glibcxx-assertions test because no C/C++ compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: go-revision test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: instrumentation test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: lto test because not compiled C/C++ code Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: only-go test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: optimization test because not C/C++ compiled code Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: pic test because not C/C++ compiled code Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: production test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: run-path test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: rwx-seg test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: short-enums test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: stack-clash test because no compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: stack-prot test because no compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: stack-realign test because not a 32-bit i686 executable Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: textrel test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: threads test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: unicode test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: warnings test because no C/C++ compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: Overall: FAIL. Pre-verifying on : ================= # rpm -qa subscription-manager --changelog | grep 2023391 - 2023391: libdnf: respect environment CFLAGS (ptoscano) - 2023391: libdnf: respect environment CFLAGS (ptoscano) # subscription-manager version server type: This system is currently not registered. subscription management server: 3.2.22-1 subscription management rules: 5.41 subscription-manager: 1.29.23-1.el9 # annocheck --ignore-unknown --verbose /usr/lib64/libdnf/plugins/product-id.so annocheck: Version 10.48. Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: pie test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: cf-protection test because correct flags found in .note.gnu.property note Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: writable-got test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: dynamic-segment test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: bind-now test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: lto test because detected in version note Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: stack-prot test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: pic test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: fortify test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: glibcxx-assertions test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: optimization test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: warnings test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: stack-clash test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: entry test because shared libraries do not use entry points Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-relro test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: notes test because no gaps found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-branch-protection test because not an AArch64 binary Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-dynamic-tags test because AArch64 specific Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: go-revision test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: instrumentation test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: only-go test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: production test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: property-note test because CET enabled property note found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: run-path test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: rwx-seg test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: short-enums test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: stack-realign test because not a 32-bit i686 executable Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: textrel test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: threads test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: unicode test Hardened: /usr/lib64/libdnf/plugins/product-id.so: Overall: PASS. ^^ NOTICE the overall result is now passing with fewer skipped tests. Verifying on : ============= # subscription-manager version server type: This system is currently not registered. subscription management server: 3.2.22-1 subscription management rules: 5.41 subscription-manager: 1.29.23-1.el9 # rpm -qa subscription-manager --changelog | grep 2023391 - 2023391: libdnf: respect environment CFLAGS (ptoscano) - 2023391: libdnf: respect environment CFLAGS (ptoscano) # annocheck --ignore-unknown --verbose /usr/lib64/libdnf/plugins/product-id.so annocheck: Version 10.51. Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: pie test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: cf-protection test because correct flags found in .note.gnu.property note Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: writable-got test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: dynamic-segment test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: bind-now test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: lto test because detected in version note Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: stack-prot test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: pic test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: fortify test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: glibcxx-assertions test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: optimization test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: warnings test because LTO compilation discards preprocessor options Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: stack-clash test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: entry test because shared libraries do not use entry points Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-stack test because stack segment exists with the correct permissions Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: gnu-relro test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: notes test because no gaps found Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-branch-protection test because not an AArch64 binary Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: not-dynamic-tags test because AArch64 specific Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: go-revision test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: instrumentation test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: only-go test because no GO compiled code found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: production test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: property-note test because CET enabled property note found Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: run-path test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: rwx-seg test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: short-enums test Hardened: /usr/lib64/libdnf/plugins/product-id.so: skip: stack-realign test because not a 32-bit i686 executable Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: textrel test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: threads test Hardened: /usr/lib64/libdnf/plugins/product-id.so: PASS: unicode test Hardened: /usr/lib64/libdnf/plugins/product-id.so: Overall: PASS. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: subscription-manager), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:3984 |
The libdnf plugin is written in C and built with CMake; unfortunately, the project CMakeLists.txt overwrites the C build flags: if (CMAKE_COMPILER_IS_GNUCC) set (CMAKE_C_FLAGS "-Wall -fPIC -Wextra -pedantic -Wno-long-long -std=c99") if (CMAKE_BUILD_TYPE STREQUAL "Debug") set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -ggdb -O0 --coverage") elseif( CMAKE_BUILD_TYPE STREQUAL "Release" ) set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNDEBUG -g -O3 -fno-strict-aliasing") endif () endif (CMAKE_COMPILER_IS_GNUCC) This causes the loss of CFLAGS exported in the build environment, or even passed to the cmake command line at configure time. This causes the lack of the distribution build flags for the built plugin. This can be checked in two ways: a) checking the build logs: in a verbose build, all the environment CFLAGS should appear in the gcc command line that build the sources for the libdnf plugin b) with annocheck: annocheck --ignore-unknown --verbose product-id.so Actual result: annocheck shows at least two failures: Hardened: usr/lib64/libdnf/plugins/product-id.so: FAIL: cf-protection test because no .note.gnu.property section = no control flow information Hardened: usr/lib64/libdnf/plugins/product-id.so: FAIL: property-note test because no .note.gnu.property section found Expected result: - build log that shows the environment CFLAGS as used during the build - no errors reported by annocheck