-
Bug
-
Resolution: Not a Bug
-
Normal
-
None
-
rhel-9.4
-
None
-
None
-
None
-
rhel-sst-security-crypto
-
ssg_security
-
None
-
False
-
-
None
-
None
-
None
-
None
-
None
What were you trying to do that didn't work?
Running annocheck stack-prot test against libkcapi-hmaccalc reports failures.
Please provide the package NVR for which bug is seen:
libkcapi-hmaccalc-1.4.0-2.el9
How reproducible:
Deterministic.
Steps to reproduce
- dnf install -y annobin-annocheck
- dnf debuginfo-install -y libkcapi-hmaccalc
- rpm -ql libkcapi-hmaccalc | xargs annocheck --verbose --ignore-unknown --ignore-links --skip-all --test-stack-prot
Actual results
stack-prot test failures are reported for the following binaries:
/usr/bin/sha1hmac /usr/bin/sha224hmac /usr/bin/sha256hmac /usr/bin/sha384hmac /usr/bin/sha512hmac /usr/bin/sm3hmac
Example of a failing test for the /usr/bin/sha1hmac binary (other binaries fail for the same reason):
Hardened: /usr/bin/sha1hmac: MAYB: test: stack-prot, reason: could not determine how the code was created Hardened: /usr/bin/sha1hmac: info: For more information visit: https://sourceware.org/annobin/annobin.html/Test-stack-prot.html Hardened: /usr/bin/sha1hmac: WARN: This can happen if the program is compiled from a language unknown to annocheck Hardened: /usr/bin/sha1hmac: WARN: or because there are no annobin build notes (could they be in a separate file ?) Hardened: /usr/bin/sha1hmac: WARN: For more details see https://sourceware.org/annobin/annobin.html/Absence-of-compiled-code.html Hardened: /usr/bin/sha1hmac: Overall: FAIL (due to MAYB results).
Expected results
No failures for the stack-prot test - failures are either fixed or in case the failures are expected they are documented in the rpminspect.yaml file to have the test skipped including a comment explaining why.