Re: [PATCH] elfclassify tool

[Mark Wielaard <mark@klomp.org>]

On Sat, Jul 20, 2019 at 01:57:27AM +0300, Dmitry V. Levin wrote:
> On Fri, Jul 19, 2019 at 11:36:53PM +0200, Mark Wielaard wrote:
> > > If the ELF type is ET_DYN and the object is not marked as DF_1_PIE,
> > > could we come up with a more reliable heuristics than DT_SONAME and PT_INTERP?
> > 
> > Why do you feel it is unreliable? Do you have any examples of files
> > misidentified?
> 
> No, I don't have such examples because most (if not all) ET_DYN
> non-DF_1_PIE objects we have nowadays are actually libraries regardless
> of their DT_SONAME or PT_INTERP.
> 
> What actually disqualifies these objects from being libraries, besides
> missing PT_DYNAMIC?

The goal here was to have a classification specifically to handle things
like glibc or Qt executable.so shared libraries. So that --shared would
make them as shared libraries primarily (and so --executable would not
mark them as programs). This is because for shared libraries you might
want to do some processing you don't want for executable (or the other
way around). Think about deciding whether or not to keep the .symtab.

Maybe you are looking for another goal/classification?  For example I
added --program which does classify those special files as programs
(even though --shared also says they are shared libraries). Maybe you
are looking for a different classification similar/dual to that. Say
--library?

> The only reason why I feel uncomfortable to rely on this has_soname check
> is that DT_SONAME is so easily added unnoticed by mistake.

But it isn't used in isolation to mark something as --shared.

> btw, I think it would be appropriate to move the has_dynamic check before
> the first check in is_shared that returns true.

Yes, that is probably fine, but does it really matter?
Florian, what do you think?

Cheers,

Mark