From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 95942 invoked by alias); 19 Jul 2019 21:36:57 -0000 Mailing-List: contact elfutils-devel-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Post: List-Help: List-Subscribe: Sender: elfutils-devel-owner@sourceware.org Received: (qmail 95932 invoked by uid 89); 19 Jul 2019 21:36:57 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.100.3 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-6.7 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.1 spammy= X-Spam-Status: No, score=-6.7 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on sourceware.org X-Spam-Level: X-HELO: gnu.wildebeest.org Received: from wildebeest.demon.nl (HELO gnu.wildebeest.org) (212.238.236.112) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 19 Jul 2019 21:36:55 +0000 Received: from librem.wildebeest.org (deer0x15.wildebeest.org [172.31.17.151]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gnu.wildebeest.org (Postfix) with ESMTPSA id D1A08300073F; Fri, 19 Jul 2019 23:36:53 +0200 (CEST) Received: by librem.wildebeest.org (Postfix, from userid 1000) id 7FAE6C010D; Fri, 19 Jul 2019 23:36:53 +0200 (CEST) Date: Fri, 19 Jul 2019 21:36:00 -0000 From: Mark Wielaard To: "Dmitry V. Levin" Cc: Florian Weimer , elfutils-devel@sourceware.org, Panu Matilainen Subject: Re: [PATCH] elfclassify tool Message-ID: <20190719213653.GA2851@wildebeest.org> References: <87k1fz8c9q.fsf@oldenburg2.str.redhat.com> <2e6a27c552ae5e365db54ca6b432c77c9ad5b041.camel@klomp.org> <871s22yybt.fsf@oldenburg2.str.redhat.com> <8736mfzhob.fsf@oldenburg2.str.redhat.com> <20190719134341.GA26346@altlinux.org> <84da918d32c57e6f16fbcf1c854b375111dbdcb5.camel@wildebeest.org> <20190719183542.GB29323@altlinux.org> <87v9vxivsu.fsf@oldenburg2.str.redhat.com> <20190719212308.GA31813@altlinux.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190719212308.GA31813@altlinux.org> User-Agent: Mutt/1.10.1 (2018-07-13) X-Spam-Flag: NO X-IsSubscribed: yes X-SW-Source: 2019-q3/txt/msg00069.txt.bz2 On Sat, Jul 20, 2019 at 12:23:08AM +0300, Dmitry V. Levin wrote: > On Fri, Jul 19, 2019 at 11:00:49PM +0200, Florian Weimer wrote: > > * Dmitry V. Levin: > > > > >> So, I don't think the code is wrong. We might want to tweak the comment > > >> a bit though, to make it less definitive? > > > > > > What I'm saying is that has_soname is just a hint which is probably even > > > less reliable than has_program_interpreter. > > > > If I recall correctly, I added the soname check to classify > > /lib64/libc.so.6 as a library, not an executable. So it didn't come > > completely out of nowhere. > > Well, /lib64/libc.so.6 is not just a library, it's also a valid executable. > > If the ELF type is ET_DYN and the object is not marked as DF_1_PIE, > could we come up with a more reliable heuristics than DT_SONAME and PT_INTERP? Why do you feel it is unreliable? Do you have any examples of files misidentified? I tested a bit and --shared seems to correctly indentify all shared libraries. I did add --program as a counterpart to --executable if you really want to identify such "libraries" as programs. But in general it looks like --shared and --executable come up with the correct classification. The only two examples I could find were the glibc and Qt binaries which have "dual use" library/executables. And I believe --shared corrrectly identifies them as primarily shared libraries. Cheers, Mark