Failed test: bind-now test Test results: \n Hardened: libgfortran.so.3.0.0: FAIL: bind-now test because not linked with -Wl'-z'now Applicable RPMs: compat-libgfortran-48-4.8.5-36.4.el9.1.aarch64.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.i686.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.ppc64le.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.s390x.rpm; compat-libgfortran-48-4.8.5-36.4.el9.1.x86_64.rpm Recommendation: Please fix the build system for the package or else add a skip of tests to the rpminspect.yaml file. For more details please see https://sourceware.org/annobin/annobin.html/Test-bind-now.html and https://sourceware.org/annobin/annobin.html/Waiving-Hardened-Results.html#Waiving-Hardened-Results. Why this bug was filed: All packages in RHEL 9 built with gcc (g++, etc.) are required to use a common set of flags provided by the distribution. These flags turn on important security and performance features so it is critical that any package that lacks these flags be repaired. A scanning tool named annocheck, part of the annobin package, was used to scan RHEL 9 packages. This BZ was created because binary packages of this component with the mentioned NVRs were not built with the requisite flags for one or more RHEL 9 architectures. How to reproduce the failure: You could try running annocheck locally against your builds: https://developers.redhat.com/blog/2019/02/04/annocheck-examining-the-contents-of-binary-files. Annocheck resources: * annobin documentation: https://sourceware.org/annobin/annobin.html/index.html * annocheck on the customer portal: https://access.redhat.com/documentation/en-us/red_hat_developer_toolset/9/html/user_guide/chap-annobin Contacts: * Instant messaging: #tools on IRC * Email: use tools for generic questions. Otherwise, use go-tools and llvm-clang-list for Go and Clang/LLVM specific questions. * annobin-annocheck maintainer: Nick Clifton (nickc)
# rpm -q compat-libgfortran-48 compat-libgfortran-48-4.8.5-36.5.el9.x86_64 # annocheck --verbose /usr/lib64/libgfortran.so.3.0.0 annocheck: Version 10.51. Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: pie test Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: writable-got test Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: dynamic-segment test Hardened: /usr/lib64/libgfortran.so.3.0.0: PASS: bind-now test [...] Although I still see # annocheck /usr/lib64/libgfortran.so.3.0.0 annocheck: Version 10.51. Hardened: libgfortran.so.3.0.0: FAIL: cf-protection test because .note.gnu.property section did not contain the necessary flags but this bug report doesn't mention that (???).
Oh, I see, I'm using: # GCC 4.8 doesn't know these options, but redhat-rpm-config supplies them. OPT_FLAGS=`echo $OPT_FLAGS|sed -e 's/ -fstack-clash-protection -fcf-protection/ /g'` so -fcf-protection won't work here.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: compat-libgfortran-48), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2593