From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 8237 invoked by alias); 4 Nov 2016 18:14:18 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Received: (qmail 8222 invoked by uid 89); 4 Nov 2016 18:14:17 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=oh, portable, xxx, risk X-HELO: mail.headstrong.de Subject: Re: [PATCH] nscd_stat.c: make the build reproducible To: Florian Weimer , libc-alpha@sourceware.org, 783210@bugs.debian.org, Aurelien Jarno References: <1457456791-17402-1-git-send-email-aurelien@aurel32.net> <20160308233738.GP6588@vapier.lan> <20160309075403.GA2444@aurel32.net> <20160309223006.GA6588@vapier.lan> <20160801045215.GS6702@vapier.lan> <9028c704-ff65-f112-f50d-00ecab7baaae@debian.org> From: Ximin Luo Message-ID: <19a991ad-3cfc-53ab-f276-33a54d2d250a@debian.org> Date: Fri, 04 Nov 2016 18:14:00 -0000 MIME-Version: 1.0 In-Reply-To: <9028c704-ff65-f112-f50d-00ecab7baaae@debian.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-SW-Source: 2016-11/txt/msg00194.txt.bz2 Ximin Luo: > Mike Frysinger: >> On 28 Jul 2016 15:15, Florian Weimer wrote: >>> On 03/09/2016 05:30 PM, Mike Frysinger wrote: >>>> would it be so terrible to properly marshall this data ? >>> >>> Ximin Luo and I discussed this and I wonder if it is possible to read >>> out the libc.so.6 build ID if it is present. It should indirectly call >>> all the layout dependencies and be reasonably easy to access because it >>> is in an allocated section (and we might want to print it from an >>> libc.so.6 invocation, too). >>> >>> We still need the time-based approach if the build ID is not available, >>> but I expect most distributions will have something like it. >>> >>> The Debian bug is: >>> >>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783210 >>> >>> (Also Cc:ed) >> >> agreed that build-id should be an acceptable replacement for what the >> code is doing today, but in order to pull that off, i guess you'd have >> to have to do a configure test to see if build-id is active ? if you >> leave the logic to runtime, you'd still need to include the datetime >> stamp in the object which would still make the build unreproducible. >> >> this also doesn't really cover the quoted idea of marshalling the data >> between client & server :). >> -mike >> > > Hi all, > > I've written a small program that prints out the Build IDs of all the objects that are dynamically linked to it, plus itself. > > It works well, although I'm not a C expert so I don't know if it is portable enough. For example, I hard-code some >>2 <<2s in there, along with a uint8_t - I didn't see a corresponding ElfW(xxx) type in elf.h > > Another downside is it needs to be linked against libdl, which I think is not the case currently with nscd. I'm not sure if this carries extra security risk or whatever. > Oh! Actually it doesn't need to be linked against libdl. That was from an earlier version of the code where I was using dlinfo instead of dl_iterate_phdr. But this latter function doesn't need extra libs. :) > An alternative would be to detect the build-id *at build time* and then monkey-patch it into the binary itself. > > What do you all think? How shall I proceed? > X -- GPG: ed25519/56034877E1F87C35 GPG: rsa4096/1318EFAC5FBBDBCE https://github.com/infinity0/pubkeys.git