Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-45714

annocheck reports stack-prot test fails for libkcapi-hmaccalc

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Normal Normal
    • None
    • rhel-9.4
    • libkcapi
    • None
    • None
    • None
    • rhel-sst-security-crypto
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None

      What were you trying to do that didn't work?

      Running annocheck stack-prot test against libkcapi-hmaccalc reports failures.

      Please provide the package NVR for which bug is seen:

      libkcapi-hmaccalc-1.4.0-2.el9

      How reproducible:

      Deterministic.

      Steps to reproduce

      1. dnf install -y annobin-annocheck
      2. dnf debuginfo-install -y libkcapi-hmaccalc
      3. rpm -ql libkcapi-hmaccalc | xargs annocheck --verbose --ignore-unknown --ignore-links --skip-all --test-stack-prot

      Actual results

      stack-prot test failures are reported for the following binaries:

      /usr/bin/sha1hmac
      /usr/bin/sha224hmac
      /usr/bin/sha256hmac
      /usr/bin/sha384hmac
      /usr/bin/sha512hmac
      /usr/bin/sm3hmac
      

      Example of a failing test for the /usr/bin/sha1hmac binary (other binaries fail for the same reason):

      Hardened: /usr/bin/sha1hmac: MAYB: test: stack-prot, reason: could not determine how the code was created
      Hardened: /usr/bin/sha1hmac: info: For more information visit: https://sourceware.org/annobin/annobin.html/Test-stack-prot.html
      Hardened: /usr/bin/sha1hmac: WARN: This can happen if the program is compiled from a language unknown to annocheck
      Hardened: /usr/bin/sha1hmac: WARN:  or because there are no annobin build notes (could they be in a separate file ?)
      Hardened: /usr/bin/sha1hmac: WARN: For more details see https://sourceware.org/annobin/annobin.html/Absence-of-compiled-code.html
      Hardened: /usr/bin/sha1hmac: Overall: FAIL (due to MAYB results).
      

      Expected results

      No failures for the stack-prot test - failures are either fixed or in case the failures are expected they are documented in the rpminspect.yaml file to have the test skipped including a comment explaining why.

              zfridric Zoltan Fridrich
              mmarhefk@redhat.com Matus Marhefka
              Zoltan Fridrich Zoltan Fridrich
              George Pantelakis George Pantelakis
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: