On Fri, Sep 23, 2016 at 08:51:45AM +0200, Jan Engelhardt wrote:

On Friday 2016-09-23 00:07, Cristian Rodríguez wrote:

...

...

BUILT WITH PIE: $ file /usr/bin/su /usr/bin/su: setuid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 3.0.0, red libs), for GNU/Linux 3.0.0, BuildID[sha1]=e1848fb6201a18d0c17900dcf7936819c1a81ff9, stripped

"file" now needs to differentiate between a PIE and a shared library..

Yeah, I can see how this blows up in some faces. rpm's scripts use `file | grep "shared object"` (scary!).

find-requires: "Executables" (by file(1)'s definition) need to have the +x bit to be dependency-scanned with ldd by f-r. Shared objects do not need the +x bit to be scanned.

This means now that executables which erroneously or willingly had no +x bit now get scanned when built as PIE.

find-provides: No change, since executables do not have a DT_SONAME field.

We have quite a lot of packages with PIE binaries already, it seems not that much of an issue or problem? I dont think we ever had binaries without +x. What is broken in this project however is a mismatch between rpmlint and python-magic (from file). [ 2022s] 0 packages and 0 specfiles checked; 0 errors, 0 warnings. [ 2022s] Traceback (most recent call last): [ 2022s] File "rpmlint.py", line 385, in <module> [ 2022s] File "rpmlint.py", line 161, in main [ 2022s] File "rpmlint.py", line 220, in runChecks [ 2022s] File "TagsCheck.py", line 634, in check [ 2022s] File "Pkg.py", line 605, in files [ 2022s] File "Pkg.py", line 700, in _gatherFilesInfo [ 2022s] File "./magic.py", line 129, in file [ 2022s] TypeError: str() takes at most 1 argument (2 given) I looked at it, but the bug seems not obvious. Ciao, Marcus -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

On Sep 23 2016, Cristian Rodríguez wrote:

"file" now needs to differentiate between a PIE and a shared library.. according to the interwebs.. the only way is looking for the .interp section in the executable. (that sounds fragile though)

A shared library can validly have an interpreter. Andreas. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different." -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

On Mon, Sep 26, 2016 at 4:54 AM, Andreas Schwab wrote:

On Sep 23 2016, Cristian Rodríguez wrote:

...

"file" now needs to differentiate between a PIE and a shared library.. according to the interwebs.. the only way is looking for the .interp section in the executable. (that sounds fragile though)

A shared library can validly have an interpreter.

So, there seems to be no way to differentiate between them.. DT_SONAME may also be set on executables (but will be ignored) maybe the compiler or linker could add some metadata to ease identification.. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org