Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

checksec: switch to binutils-unwrapped #44881

Merged
merged 1 commit into from Aug 16, 2018
Merged

checksec: switch to binutils-unwrapped #44881

merged 1 commit into from Aug 16, 2018

Conversation

cript0nauta
Copy link
Contributor

Motivation for this change

checksec wasn't working because it couldn't find the readelf command.
This happened because binutils doesn't expose the readelf binary.

Things done

Change the derivation to depend on binutils-unwrapped instead, that does
expose the readelf binary.

  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

@cript0nauta
checksec: switch to binutils-unwrapped
fb15f20 
checksec needs the readelf command to work properly, which is contained
in the binutils-unwrapped derivation but not in the normal binutils.
Before this commit, this tool wasn't working due to that.
@joachifm
Copy link
Contributor

@GrahamcOfBorg build checksec

@GrahamcOfBorg
Copy link

Success on x86_64-linux (full log)

Attempted: checksec

Partial log (click to expand)

building
no Makefile, doing nothing
installing
post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/03jhdq1cpxqsg8jr83c7h8nakh5kmn8v-checksec-1.5
strip is /nix/store/gpc2wld1s0c6qzx9326cwn1wcx29xzsj-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/03jhdq1cpxqsg8jr83c7h8nakh5kmn8v-checksec-1.5/bin
patching script interpreter paths in /nix/store/03jhdq1cpxqsg8jr83c7h8nakh5kmn8v-checksec-1.5
checking for references to /build in /nix/store/03jhdq1cpxqsg8jr83c7h8nakh5kmn8v-checksec-1.5...
/nix/store/03jhdq1cpxqsg8jr83c7h8nakh5kmn8v-checksec-1.5

@GrahamcOfBorg
Copy link

Success on aarch64-linux (full log)

Attempted: checksec

Partial log (click to expand)

building
no Makefile, doing nothing
installing
post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/ab6m4bhfnya6x96pks1l3wqg03bihi54-checksec-1.5
strip is /nix/store/ah0va6j4cnwj9nx4j6rwcfc8nh785jwm-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/ab6m4bhfnya6x96pks1l3wqg03bihi54-checksec-1.5/bin
patching script interpreter paths in /nix/store/ab6m4bhfnya6x96pks1l3wqg03bihi54-checksec-1.5
checking for references to /build in /nix/store/ab6m4bhfnya6x96pks1l3wqg03bihi54-checksec-1.5...
/nix/store/ab6m4bhfnya6x96pks1l3wqg03bihi54-checksec-1.5

@GrahamcOfBorg
Copy link

No attempt on x86_64-darwin (full log)

The following builds were skipped because they don't evaluate on x86_64-darwin: checksec

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

@joachifm joachifm merged commit f9a7de9 into NixOS:master Aug 16, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
10.rebuild-darwin: 0 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@cript0nauta @joachifm @GrahamcOfBorg