[PATCH] tests: simple test for execstack supermin
Add a simple test which uses scanelf or readelf to detect whether the supermin executable is really not executable. Kind of followup of commit c9f7a7998021e1cbe22a8ec325d43e2bdc3eff5a. --- tests/Makefile.am | 1 + tests/test-execstack.sh | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100755 tests/test-execstack.sh diff --git a/tests/Makefile.am b/tests/Makefile.am index dc73737..4dc5958 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -23,6 +23,7 @@ EXTRA_DIST = \ TESTS = \ test-basic.sh \ + test-execstack.sh \ test-build-bash.sh \ test-binaries-exist.sh \ test-harder.sh diff --git a/tests/test-execstack.sh b/tests/test-execstack.sh new file mode 100755 index 0000000..a9cb5e0 --- /dev/null +++ b/tests/test-execstack.sh @@ -0,0 +1,32 @@ +#!/bin/bash - +# supermin +# (C) Copyright 2014 Red Hat Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +set -e + +if scanelf --help >/dev/null 2>&1; then + echo "using scanelf" + scanelf -e ../src/supermin + test `scanelf -qe ../src/supermin | wc -l` -eq 0 +elif readelf --help >/dev/null 2>&1; then + echo "using readelf" + readelf -lW ../src/supermin | grep GNU_STACK + ! readelf -lW ../src/supermin | grep GNU_STACK | grep 'E ' >/dev/null 2>&1 +else + echo "$0: test skipped because none of the following tools is installed: scanelf, readelf" + exit 77 +fi -- 1.9.0
On Fri, May 02, 2014 at 02:47:11PM +0200, Pino Toscano wrote:
Add a simple test which uses scanelf or readelf to detect whether the supermin executable is really not executable.
Kind of followup of commit c9f7a7998021e1cbe22a8ec325d43e2bdc3eff5a.
ACK. (Not that executable stacks matter for OCaml programs. It's fixing something which is a problem for C programs :-) Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
On Fri, May 02, 2014 at 02:47:11PM +0200, Pino Toscano wrote:
Add a simple test which uses scanelf or readelf to detect whether the supermin executable is really not executable.
FYI this test failed on ARM. It's a genuine failure showing that we are building a supermin binary with an executable stack. It turns out to be an OCaml bug. Years ago I filed: http://caml.inria.fr/mantis/view.php?id=4564 It was only fixed upstream on i686 & x86-64 ... not on ARM. $ touch empty.ml $ ocamlopt empty.ml $ readelf -lW a.out | grep GNU_STACK GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4 So I will have to apply the same fix to the OCaml ARM compiler too. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 100 libraries supported. http://fedoraproject.org/wiki/MinGW
--- tests/test-execstack.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/test-execstack.sh b/tests/test-execstack.sh index a9cb5e0..a02803b 100755 --- a/tests/test-execstack.sh +++ b/tests/test-execstack.sh @@ -18,6 +18,11 @@ set -e +if [ -n "$SKIP_TEST_EXECSTACK" ]; then + echo "$0: test skipped because SKIP_TEST_EXECSTACK is set." + exit 77 +fi + if scanelf --help >/dev/null 2>&1; then echo "using scanelf" scanelf -e ../src/supermin -- 2.0.0.rc2
On Sat, May 10, 2014 at 01:41:48PM +0200, Hilko Bengen wrote:
--- tests/test-execstack.sh | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/tests/test-execstack.sh b/tests/test-execstack.sh index a9cb5e0..a02803b 100755 --- a/tests/test-execstack.sh +++ b/tests/test-execstack.sh @@ -18,6 +18,11 @@
set -e
+if [ -n "$SKIP_TEST_EXECSTACK" ]; then + echo "$0: test skipped because SKIP_TEST_EXECSTACK is set." + exit 77 +fi +
ACK. This test is indeed troublesome because it tests something which is (to some extent) outside our control. Thanks, Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
On Friday 09 May 2014 22:19:02 Richard W.M. Jones wrote:
On Fri, May 02, 2014 at 02:47:11PM +0200, Pino Toscano wrote:
Add a simple test which uses scanelf or readelf to detect whether the supermin executable is really not executable.
FYI this test failed on ARM. It's a genuine failure showing that we are building a supermin binary with an executable stack.
Ouch, I didn't know about this issue, sorry for the tests breakage on !x86 & !x86_64 platforms.
It turns out to be an OCaml bug. Years ago I filed:
http://caml.inria.fr/mantis/view.php?id=4564
It was only fixed upstream on i686 & x86-64 ... not on ARM.
$ touch empty.ml $ ocamlopt empty.ml $ readelf -lW a.out | grep GNU_STACK GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4
So I will have to apply the same fix to the OCaml ARM compiler too.
Judging from the Debian build logs of pristine supermin 5.1.8, architecture affected were for sure arm, mips, powerpc. -- Pino Toscano
On Mon, May 12, 2014 at 07:00:11PM +0200, Pino Toscano wrote:
On Friday 09 May 2014 22:19:02 Richard W.M. Jones wrote:
So I will have to apply the same fix to the OCaml ARM compiler too.
Judging from the Debian build logs of pristine supermin 5.1.8, architecture affected were for sure arm, mips, powerpc.
The patch is quite simple. Here is the ARM & aarch64 patch that I applied to Fedora: https://git.fedorahosted.org/cgit/fedora-ocaml.git/commit/?id=64da031fc17ca9... You might also have to patch the emit code (but x86 & ARM 32 & 64 bit at least already have this). Line 863 at: https://git.fedorahosted.org/cgit/fedora-ocaml.git/tree/asmcomp/amd64/emit.m... Note also Xavier's comment about why he only fixed Linux/ELF/x86 originally: http://caml.inria.fr/mantis/view.php?id=4564#c4548 Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
participants (3)
-
Hilko Bengen -
Pino Toscano -
Richard W.M. Jones