Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-75778

annocheck falsely reports grub2 binaries as not being compiled by gcc

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done-Errata
    • Icon: Normal Normal
    • rhel-9.6
    • None
    • annobin
    • None
    • annobin-12.85-1.el9
    • Low
    • 1
    • rhel-pt-gcc
    • ssg_platform_tools
    • 24
    • 26
    • 1
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • PT GCC 2025 S01
    • Unspecified Release Note Type - Unknown
    • All
    • Linux
    • None

      I am seeing new FAIL results with annobin-annocheck-12.65-2.el9 with binaries from grub2-tools-2.06-94.el9 and grub2-tools-minimal-2.06-94.el9 packages on RHEL-9.6, e.g.:

      Hardened: /usr/bin/grub2-editenv: info: written in C (source: DW_AT_language string).
      Hardened: /usr/bin/grub2-editenv: MAYB: test: stack-prot, reason: could not determine how the code was created
      Hardened: /usr/bin/grub2-editenv: info: For more information visit: https://sourceware.org/annobin/annobin.html/Test-stack-prot.html
      Hardened: /usr/bin/grub2-editenv: WARN: This can happen if the program is compiled from a language unknown to annocheck
      Hardened: /usr/bin/grub2-editenv: WARN: or because there are no annobin build notes (could they be in a separate file ?)
      Hardened: /usr/bin/grub2-editenv: WARN: For more details see https://sourceware.org/annobin/annobin.html/Absence-of-compiled-code.html
      Hardened: /usr/bin/grub2-editenv: Overall: FAIL (due to MAYB results).

      On RHEL-9.4 there are older grub2 packages and there is annobin-annocheck-12.31-2.el9 and it reports the same binaries as PASS. When I look into build log of grub2-2.06-94.el9 (https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=3413373) I see that binaries were correctly compiled with -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 option, can it be some false positive result with annobin-annocheck-12.65-2.el9 ?

        1. glibc-x86_64.out
          84 kB
        2. glibc-s390x.out
          1.96 MB
        3. screenshot.png
          screenshot.png
          293 kB

              nickc@redhat.com Nick Clifton
              nickc@redhat.com Nick Clifton
              Matus Marhefka
              Nick Clifton Nick Clifton
              Vaclav Kadlcik Vaclav Kadlcik
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: