January 2018 - Arch-projects - lists.archlinux.org

[arch-projects] [archweb] Licensing issues with JS code
by Adonay Felipe Nogueira 15 Jan '18

15 Jan '18

Hi all, I have an issue to report. However, please note that I'm not subscribed to this mailing list, so I'd recommend you to Cc me when replying. For a short description of the issue, see: [[https://labs.parabola.nu/issues/1405]] However, we must also note that Archweb is now newer than the Archweb release used by Parabola. Nonethless, as far as I know, each of the files still exist, although some of them don't even have license indication for the site's visitor (this is true for "visualize/static/visualize.js" and "mirrors/static/mirror_status.js"). In case of doubt, I might be able to help with some of the points described in the referenced issue. Respectfully, Adonay. -- - [[https://libreplanet.org/wiki/User:Adfeno]] - Palestrante e consultor sobre /software/ livre (não confundir com gratis). - "WhatsApp"? Ele não é livre, por isso não uso. Iguais a ele prefiro GNU Ring, ou Tox. Quer outras formas de contato? Adicione o vCard que está no endereço acima aos teus contatos. - Pretende me enviar arquivos .doc, .ppt, .cdr, ou .mp3? OK, eu aceito, mas não repasso. Entrego apenas em formatos favoráveis ao /software/ livre. Favor entrar em contato em caso de dúvida.

6 17

[arch-projects] [namcap] elffiles: Check for FULL RELRO
by Jelle van der Waa 14 Jan '18

14 Jan '18

Instead of checking for RELRO, check for FULL RELRO which is the default now. --- Namcap/rules/elffiles.py | 15 ++++++++++++--- namcap-tags | 2 +- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/Namcap/rules/elffiles.py b/Namcap/rules/elffiles.py index e2dd7f5..a336d18 100644 --- a/Namcap/rules/elffiles.py +++ b/Namcap/rules/elffiles.py @@ -137,10 +137,17 @@ class ELFGnuRelroRule(TarballRule): Introduced by FS#26435. Uses pyelftools to check for GNU_RELRO. """ - # not smart enough for full/partial RELRO (DT_BIND_NOW?) name = "elfgnurelro" - description = "Check for RELRO in ELF files." + description = "Check for FULL RELRO in ELF files." + + def has_bind_now(self, elffile): + for section in elffile.iter_sections(): + if not isinstance(section, DynamicSection): + continue + if any(tag.entry.d_tag == 'DT_BIND_NOW' for tag in section.iter_tags()): + return True + return False def analyze(self, pkginfo, tar): missing_relro = [] @@ -153,7 +160,9 @@ class ELFGnuRelroRule(TarballRule): continue elffile = ELFFile(fp) if any(seg['p_type'] == 'PT_GNU_RELRO' for seg in elffile.iter_segments()): - continue + if self.has_bind_now(elffile): + continue + missing_relro.append(entry.name) if missing_relro: diff --git a/namcap-tags b/namcap-tags index f967724..f464b9c 100644 --- a/namcap-tags +++ b/namcap-tags @@ -19,7 +19,7 @@ elffile-not-in-allowed-dirs %s :: ELF file ('%s') outside of a valid path. elffile-in-questionable-dirs %s :: ELF files outside of a valid path ('%s'). elffile-with-textrel %s :: ELF file ('%s') has text relocations. elffile-with-execstack %s :: ELF file ('%s') has executable stack. -elffile-without-relro %s :: ELF file ('%s') lacks RELRO, check LDFLAGS. +elffile-without-relro %s :: ELF file ('%s') lacks FULL RELRO, check LDFLAGS. elffile-unstripped %s :: ELF file ('%s') is unstripped. empty-directory %s :: Directory (%s) is empty error-running-rule %s :: Error running rule '%s' -- 2.15.1

1 0

[arch-projects] [namcap] elffiles: Add rule for no PIE binaries
by Jelle van der Waa 14 Jan '18

14 Jan '18

Verify if packages where build with PIE enabled by checking if it's an EY_DYN file with a DT_DEBUG entry. --- Namcap/rules/elffiles.py | 33 ++++++++++++++++++++++++++++++ Namcap/tests/package/test_elffiles.py | 38 ++++++++++++++++++++++++++++++++++- namcap-tags | 1 + 3 files changed, 71 insertions(+), 1 deletion(-) diff --git a/Namcap/rules/elffiles.py b/Namcap/rules/elffiles.py index e2dd7f5..a87c0db 100644 --- a/Namcap/rules/elffiles.py +++ b/Namcap/rules/elffiles.py @@ -194,4 +194,37 @@ class ELFUnstrippedRule(TarballRule): self.warnings = [("elffile-unstripped %s", i) for i in unstripped_binaries] +class NoPIERule(TarballRule): + """ + Checks for no PIE ELF files. + """ + + name = "elfnopie" + description = "Check for no PIE ELF files." + + def has_dt_debug(self, elffile): + for section in elffile.iter_sections(): + if not isinstance(section, DynamicSection): + continue + if any(tag.entry.d_tag == 'DT_DEBUG' for tag in section.iter_tags()): + return True + return False + + def analyze(self, pkginfo, tar): + nopie_binaries = [] + + for entry in tar: + if not entry.isfile(): + continue + fp = tar.extractfile(entry) + if not is_elf(fp): + continue + elffile = ELFFile(fp) + if elffile.header['e_type'] != 'ET_DYN' or not self.has_dt_debug(elffile): + nopie_binaries.append(entry.name) + + if nopie_binaries: + self.warnings = [("elffile-nopie %s", i) for i in nopie_binaries] + + # vim: set ts=4 sw=4 noet: diff --git a/Namcap/tests/package/test_elffiles.py b/Namcap/tests/package/test_elffiles.py index 6362a58..b11fa13 100644 --- a/Namcap/tests/package/test_elffiles.py +++ b/Namcap/tests/package/test_elffiles.py @@ -95,5 +95,41 @@ package() { ]) self.assertEqual(r.infos, []) -# vim: set ts=4 sw=4 noet: +class TestNoPieStack(MakepkgTest): + pkgbuild = """ +pkgname=__namcap_test_nopie +pkgver=1.0 +pkgrel=1 +pkgdesc="A package" +arch=('i686' 'x86_64') +url="http://www.example.com/" +license=('GPL') +depends=('glibc') +source=() +options=(!purge !zipman) +build() { + cd "${srcdir}" + echo "int main() { return 0; }" > main.c + /usr/bin/gcc -o main main.c -no-pie +} +package() { + install -D -m 644 "${srcdir}/main" "${pkgdir}/usr/bin/nopie" +} +""" + def test_nopie(self): + pkgfile = "__namcap_test_nopie-1.0-1-%(arch)s.pkg.tar" % { "arch": self.arch } + with open(os.path.join(self.tmpdir, "PKGBUILD"), "w") as f: + f.write(self.pkgbuild) + self.run_makepkg() + pkg, r = self.run_rule_on_tarball( + os.path.join(self.tmpdir, pkgfile), + Namcap.rules.elffiles.NoPIERule + ) + self.assertEqual(r.errors, []) + self.assertEqual(r.warnings, [ + ("elffile-nopie %s", + "usr/bin/nopie") + ]) + self.assertEqual(r.infos, []) +# vim: set ts=4 sw=4 noet: diff --git a/namcap-tags b/namcap-tags index f967724..420ad5c 100644 --- a/namcap-tags +++ b/namcap-tags @@ -17,6 +17,7 @@ directory-not-world-executable %s :: Directory (%s) does not have the world exec elffile-in-any-package %s :: ELF file ('%s') found in an 'any' package. elffile-not-in-allowed-dirs %s :: ELF file ('%s') outside of a valid path. elffile-in-questionable-dirs %s :: ELF files outside of a valid path ('%s'). +elffile-nopie %s :: ELF file ('%s') lacks PIE. elffile-with-textrel %s :: ELF file ('%s') has text relocations. elffile-with-execstack %s :: ELF file ('%s') has executable stack. elffile-without-relro %s :: ELF file ('%s') lacks RELRO, check LDFLAGS. -- 2.15.1

1 0