Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2044645

Summary:	annocheck FAIL: pie test (bacula)
Product:	Red Hat Enterprise Linux 9	Reporter:	Rui Ormonde <rlemosor>
Component:	bacula	Assignee:	Pavel Cahyna <pcahyna>
Status:	CLOSED ERRATA	QA Contact:	Evgeny Fedin <efedin>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	efedin, fweimer, nickc
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	bacula-11.0.1-5.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 14:03:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2045722
Bug Blocks:	2044387

Description Rui Ormonde 2022-01-24 21:46:09 UTC

Failed test: pie test

Test results:
Hardened: bat: FAIL: pie test because not built with '-Wl'-pie' (gcc/clang) or '-buildmode pie' (go)
Hardened: bat: FAIL: bind-now test because not linked with -Wl'-z'now

Applicable RPMs:
bacula-console-bat-11.0.1-4.el9.aarch64.rpm; bacula-console-bat-11.0.1-4.el9.ppc64le.rpm; bacula-console-bat-11.0.1-4.el9.s390x.rpm; bacula-console-bat-11.0.1-4.el9.x86_64.rpm; bacula-traymonitor-11.0.1-4.el9.aarch64.rpm; bacula-traymonitor-11.0.1-4.el9.ppc64le.rpm; bacula-traymonitor-11.0.1-4.el9.s390x.rpm; bacula-traymonitor-11.0.1-4.el9.x86_64.rpm

Recommendation: Please fix the build system for the package or else add a skip of tests to the rpminspect.yaml file. For more details please see https://sourceware.org/annobin/annobin.html/Test-pie.html and https://sourceware.org/annobin/annobin.html/Waiving-Hardened-Results.html#Waiving-Hardened-Results.

Why this bug was filed: All packages in RHEL 9 built with gcc (g++, etc.) are required to use a common set of flags provided by the distribution. These flags turn on important security and performance features so it is critical that any package that lacks these flags be repaired. A scanning tool named annocheck, part of the annobin package, was used to scan RHEL 9 packages. This BZ was created because binary packages of this component with the mentioned NVRs were not build with the requisite flags for one or more RHEL 9 architectures.

How to reproduce the failure: You could try running annocheck locally against your builds: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files.

This bug report is part of a subset of annocheck failures that were understood as critical enough to warrant a package correction. The package set was analyzed on a nightly compose, outside of OSCI gating.

Annocheck resources:
* annobin documentation: https://sourceware.org/annobin/annobin.html/index.html
* annocheck on the customer portal: https://access.redhat.com/documentation/en-us/red_hat_developer_toolset/9/html/user_guide/chap-annobin.

Contacts:
* Instant messaging: #tools on IRC
* Email: use tools for generic questions. Otherwise, use go-tools and llvm-clang-list for Go and Clang/LLVM specific questions.
* annobin-annocheck maintainer: Nick Clifton (nickc)

Comment 2 Pavel Cahyna 2022-01-25 09:49:18 UTC

My investigation has revealed that the two executables have one thing in common: they are Qt GUI applications. Their Makefile is regenerated by qmake, but in the spec file the regeneration happens only after the executables are built, thus the correct flags are not applied. I suspect some other Qt applications may have this problem (I certainly found it in pcp-gui), so it could be worth to let their maintainers know to discuss common approaches.

Comment 5 Florian Weimer 2022-01-25 10:51:58 UTC

(In reply to Pavel Cahyna from comment #2)
> My investigation has revealed that the two executables have one thing in
> common: they are Qt GUI applications. Their Makefile is regenerated by
> qmake, but in the spec file the regeneration happens only after the
> executables are built, thus the correct flags are not applied. I suspect
> some other Qt applications may have this problem (I certainly found it in
> pcp-gui), so it could be worth to let their maintainers know to discuss
> common approaches.

Do you use any %qmake macros for building? This came up before:

Build flag injection for qmake
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/WDU7IHZIUWENZAY4YRGU3OMHLB5CECOX/

Comment 7 Pavel Cahyna 2022-01-25 17:37:12 UTC

(In reply to Florian Weimer from comment #5)
> (In reply to Pavel Cahyna from comment #2)
> > My investigation has revealed that the two executables have one thing in
> > common: they are Qt GUI applications. Their Makefile is regenerated by
> > qmake, but in the spec file the regeneration happens only after the
> > executables are built, thus the correct flags are not applied. I suspect
> > some other Qt applications may have this problem (I certainly found it in
> > pcp-gui), so it could be worth to let their maintainers know to discuss
> > common approaches.
> 
> Do you use any %qmake macros for building? This came up before:

I do, https://gitlab.com/redhat/centos-stream/rpms/bacula/-/blob/c9s/bacula.spec#L349 . Apparently the problem is that this is invoked too late: the executable has already been built in the lines above (moving the %qmake invocation above will help).

> 
> Build flag injection for qmake
> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/
> message/WDU7IHZIUWENZAY4YRGU3OMHLB5CECOX/

I am not sure what is the conclusion from that thread. Should I use %qmake_qt5_wrapper instead of %qmake_qt5, or continue to use %qmake_qt5 ?

Comment 8 Pavel Cahyna 2022-01-25 18:40:45 UTC

I would like to remove these two subpackages: bz2045722

Comment 9 Florian Weimer 2022-01-25 20:11:07 UTC

(In reply to Pavel Cahyna from comment #7)
> > Build flag injection for qmake
> > https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/
> > message/WDU7IHZIUWENZAY4YRGU3OMHLB5CECOX/
> 
> I am not sure what is the conclusion from that thread. Should I use
> %qmake_qt5_wrapper instead of %qmake_qt5, or continue to use %qmake_qt5 ?

My (limited) understanding is that %qmake_qt5 should work.

I think you should probably use %set_build_flags near the start of the build.

Comment 10 Pavel Cahyna 2022-02-03 16:10:50 UTC

The offending binaries are now buildroot-only. I will try to fix the build together with the future update, but I believe the problem does not really matter anymore.

Comment 12 Pavel Cahyna 2022-02-14 14:34:53 UTC

Merge request: https://gitlab.com/redhat/centos-stream/rpms/bacula/-/merge_requests/3 . Note that rpminspect executed from Zuul says 
Running annocheck inspection...      pass
https://centos.softwarefactory-project.io/zuul/t/centos/build/a74ce2048d54461cab5f1ec1db777ad2

In another merge request without this change https://gitlab.com/redhat/centos-stream/rpms/bacula/-/merge_requests/4 there is 
Running annocheck inspection...      FAIL
https://centos.softwarefactory-project.io/zuul/t/centos/build/7a4f94e209f74d31b90bc37f5956a89d

Comment 23 errata-xmlrpc 2022-05-17 14:03:09 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: bacula), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2638