diff options
author | Wladimir J. van der Laan <laanwj@protonmail.com> | 2020-12-18 12:12:06 +0100 |
---|---|---|
committer | Wladimir J. van der Laan <laanwj@protonmail.com> | 2020-12-18 12:16:40 +0100 |
commit | f1dbf92ff0475a01d20170ea422c1d086acbbc57 (patch) | |
tree | 9844b34123a3ab34d65e9b005cb6c3c0ef8c8fb9 /src/Makefile.am | |
parent | 83e4670fd7cde3f9624d91208885e868fda6658f (diff) | |
parent | a0a771843fc39c3cc2574a51f009c3391e1808e9 (diff) | |
download | bitcoin-f1dbf92ff0475a01d20170ea422c1d086acbbc57.tar.xz |
Merge #20434: contrib: Parse ELF directly for symbol and security checks
a0a771843fc39c3cc2574a51f009c3391e1808e9 contrib: Changes to checks for PowerPC64 (Luke Dashjr)
634f6ec4eb9997d7bd0f8209fad49a4171d42384 contrib: Parse ELF directly for symbol and security checks (Wladimir J. van der Laan)
Pull request description:
Instead of the ever-messier text parsing of the output of the readelf tool (which is clearly meant for human consumption not to be machine parseable), parse the ELF binaries directly.
Add a small dependency-less ELF parser specific to the checks.
This is slightly more secure, too, because it removes potential ambiguity due to misparsing and changes in the output format of `elfread`. It also allows for stricter and more specific ELF format checks in the future.
This removes the build-time dependency for `readelf`.
It passes the test-security-check for me locally, ~~though I haven't checked on all platforms~~. I've checked that this works on the cross-compile output for all ELF platforms supported by Bitcoin Core at the moment, as well as PPC64 LE and BE.
Top commit has no ACKs.
Tree-SHA512: 7f9241fec83ee512642fecf5afd90546964561efd8c8c0f99826dcf6660604a4db2b7255e1afb1e9bb0211fd06f5dbad18a6175dfc03e39761a40025118e7bfc
Diffstat (limited to 'src/Makefile.am')
-rw-r--r-- | src/Makefile.am | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/Makefile.am b/src/Makefile.am index 48efdb24cd..23d790d552 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -742,13 +742,13 @@ endif if GLIBC_BACK_COMPAT @echo "Checking glibc back compat..." - $(AM_V_at) READELF=$(READELF) CPPFILT=$(CPPFILT) $(PYTHON) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS) + $(AM_V_at) CPPFILT=$(CPPFILT) $(PYTHON) $(top_srcdir)/contrib/devtools/symbol-check.py $(bin_PROGRAMS) endif check-security: $(bin_PROGRAMS) if HARDEN @echo "Checking binary security..." - $(AM_V_at) READELF=$(READELF) OBJDUMP=$(OBJDUMP) OTOOL=$(OTOOL) $(PYTHON) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS) + $(AM_V_at) OBJDUMP=$(OBJDUMP) OTOOL=$(OTOOL) $(PYTHON) $(top_srcdir)/contrib/devtools/security-check.py $(bin_PROGRAMS) endif if EMBEDDED_LEVELDB |