mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2025-12-10 08:44:39 +01:00
0b116e9d73
Add 3 pending patch that improve binary reproducibility. The first address a problem with RPATH string not getting cleared on removal of RPATH entry from ELF section. The other 2 skip including external shared library in RPATH in meson build phase. This follows the logic that on cross-compiling we can't run the binary anyway as it does target a different arch hence it doesn't make sense to include those extra path in RPATH causing reproducibility problems (as path for those external library will depend on the build system path) Link: https://github.com/openwrt/openwrt/pull/20389 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
161 lines
6.8 KiB
Diff
161 lines
6.8 KiB
Diff
From 8586a5eff0c117c627fe3f71003dd30e3785796a Mon Sep 17 00:00:00 2001
|
|
From: Christian Marangi <ansuelsmth@gmail.com>
|
|
Date: Sat, 11 Oct 2025 01:48:51 +0200
|
|
Subject: [PATCH] depfixer: zero-out rpath entry string on removing entry
|
|
|
|
While investigating a reproducible problem with a binary compiled with
|
|
Meson, it was notice that the RPATH entry was never removed.
|
|
|
|
By comparing the binary from 2 different build system it was observed
|
|
that altough the RPATH entry was removed (verified by the readelf -d
|
|
command) the actual path was still present causing 2 different binary.
|
|
|
|
Going deeper in the Meson build process, it was discovered that
|
|
remove_rpath_entry only deletes the entry in the '.dynamic' section but
|
|
never actually 'clean' (or better say zero-out) the path from the
|
|
.dynstr section producing binary dependendt of the build system.
|
|
|
|
To address this, introduce a new helper to to zero-out the entry from
|
|
the .dynstr section permitting to produce REAL reproducible binary.
|
|
|
|
Additional logic was needed to handle GCC linker optimization for dynstr
|
|
table where the rpath string might be reused for other dym function
|
|
string. The setion that is actually removed is filled with 'X' following
|
|
patchelf behaviour.
|
|
|
|
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
|
|
---
|
|
mesonbuild/scripts/depfixer.py | 79 ++++++++++++++++++++++++++++++++++
|
|
1 file changed, 79 insertions(+)
|
|
|
|
--- a/mesonbuild/scripts/depfixer.py
|
|
+++ b/mesonbuild/scripts/depfixer.py
|
|
@@ -31,8 +31,12 @@ class DataSizes:
|
|
p = '<'
|
|
else:
|
|
p = '>'
|
|
+ self.Char = p + 'c'
|
|
+ self.CharSize = 1
|
|
self.Half = p + 'h'
|
|
self.HalfSize = 2
|
|
+ self.Section = p + 'h'
|
|
+ self.SectionSize = 2
|
|
self.Word = p + 'I'
|
|
self.WordSize = 4
|
|
self.Sword = p + 'i'
|
|
@@ -71,6 +75,24 @@ class DynamicEntry(DataSizes):
|
|
ofile.write(struct.pack(self.Sword, self.d_tag))
|
|
ofile.write(struct.pack(self.Word, self.val))
|
|
|
|
+class DynsymEntry(DataSizes):
|
|
+ def __init__(self, ifile: T.BinaryIO, ptrsize: int, is_le: bool) -> None:
|
|
+ super().__init__(ptrsize, is_le)
|
|
+ is_64 = ptrsize == 64
|
|
+ self.st_name = struct.unpack(self.Word, ifile.read(self.WordSize))[0]
|
|
+ if is_64:
|
|
+ self.st_info = struct.unpack(self.Char, ifile.read(self.CharSize))[0]
|
|
+ self.st_other = struct.unpack(self.Char, ifile.read(self.CharSize))[0]
|
|
+ self.st_shndx = struct.unpack(self.Section, ifile.read(self.SectionSize))[0]
|
|
+ self.st_value = struct.unpack(self.Addr, ifile.read(self.AddrSize))[0]
|
|
+ self.st_size = struct.unpack(self.XWord, ifile.read(self.XWordSize))[0]
|
|
+ else:
|
|
+ self.st_value = struct.unpack(self.Addr, ifile.read(self.AddrSize))[0]
|
|
+ self.st_size = struct.unpack(self.Word, ifile.read(self.WordSize))[0]
|
|
+ self.st_info = struct.unpack(self.Char, ifile.read(self.CharSize))[0]
|
|
+ self.st_other = struct.unpack(self.Char, ifile.read(self.CharSize))[0]
|
|
+ self.st_shndx = struct.unpack(self.Section, ifile.read(self.SectionSize))[0]
|
|
+
|
|
class SectionHeader(DataSizes):
|
|
def __init__(self, ifile: T.BinaryIO, ptrsize: int, is_le: bool) -> None:
|
|
super().__init__(ptrsize, is_le)
|
|
@@ -115,6 +137,8 @@ class Elf(DataSizes):
|
|
self.verbose = verbose
|
|
self.sections: T.List[SectionHeader] = []
|
|
self.dynamic: T.List[DynamicEntry] = []
|
|
+ self.dynsym: T.List[DynsymEntry] = []
|
|
+ self.dynsym_strings: T.List[str] = []
|
|
self.open_bf(bfile)
|
|
try:
|
|
(self.ptrsize, self.is_le) = self.detect_elf_type()
|
|
@@ -122,6 +146,8 @@ class Elf(DataSizes):
|
|
self.parse_header()
|
|
self.parse_sections()
|
|
self.parse_dynamic()
|
|
+ self.parse_dynsym()
|
|
+ self.parse_dynsym_strings()
|
|
except (struct.error, RuntimeError):
|
|
self.close_bf()
|
|
raise
|
|
@@ -232,6 +258,23 @@ class Elf(DataSizes):
|
|
if e.d_tag == 0:
|
|
break
|
|
|
|
+ def parse_dynsym(self) -> None:
|
|
+ sec = self.find_section(b'.dynsym')
|
|
+ if sec is None:
|
|
+ return
|
|
+ self.bf.seek(sec.sh_offset)
|
|
+ for i in range(sec.sh_size // sec.sh_entsize):
|
|
+ e = DynsymEntry(self.bf, self.ptrsize, self.is_le)
|
|
+ self.dynsym.append(e)
|
|
+
|
|
+ def parse_dynsym_strings(self) -> None:
|
|
+ sec = self.find_section(b'.dynstr')
|
|
+ if sec is None:
|
|
+ return
|
|
+ for i in self.dynsym:
|
|
+ self.bf.seek(sec.sh_offset + i.st_name)
|
|
+ self.dynsym_strings.append(self.read_str().decode())
|
|
+
|
|
@generate_list
|
|
def get_section_names(self) -> T.Generator[str, None, None]:
|
|
section_names = self.sections[self.e_shstrndx]
|
|
@@ -353,12 +396,48 @@ class Elf(DataSizes):
|
|
self.bf.write(new_rpath)
|
|
self.bf.write(b'\0')
|
|
|
|
+ def clean_rpath_entry_string(self, entrynum: int) -> None:
|
|
+ # Get the rpath string
|
|
+ offset = self.get_entry_offset(entrynum)
|
|
+ self.bf.seek(offset)
|
|
+ rpath_string = self.read_str().decode()
|
|
+ reused_str = ''
|
|
+
|
|
+ # Inspect the dyn strings and check if our rpath string
|
|
+ # ends with one of them.
|
|
+ # This is to handle a subtle optimization of the linker
|
|
+ # where one of the dyn function name offset in the dynstr
|
|
+ # table might be set at the an offset of the rpath string.
|
|
+ # Example:
|
|
+ #
|
|
+ # rpath offset = 1314 string = /usr/lib/foo
|
|
+ # dym function offset = 1322 string = foo
|
|
+ #
|
|
+ # In the following case, the dym function string offset is
|
|
+ # placed at the offset +10 of the rpath.
|
|
+ # To correctly clear the rpath entry AND keep normal
|
|
+ # functionality of this optimization (and the binary),
|
|
+ # parse the maximum string we can remove from the rpath entry.
|
|
+ #
|
|
+ # Since strings MUST be null terminated, we can always check
|
|
+ # if the rpath string ends with the dyn function string and
|
|
+ # calculate what we can actually remove accordingly.
|
|
+ for dynsym_string in self.dynsym_strings:
|
|
+ if rpath_string.endswith(dynsym_string):
|
|
+ if len(dynsym_string) > len(reused_str):
|
|
+ reused_str = dynsym_string
|
|
+
|
|
+ # Seek back to start of string
|
|
+ self.bf.seek(offset)
|
|
+ self.bf.write(b'X' * (len(rpath_string) - len(reused_str)))
|
|
+
|
|
def remove_rpath_entry(self, entrynum: int) -> None:
|
|
sec = self.find_section(b'.dynamic')
|
|
if sec is None:
|
|
return None
|
|
for (i, entry) in enumerate(self.dynamic):
|
|
if entry.d_tag == entrynum:
|
|
+ self.clean_rpath_entry_string(entrynum)
|
|
rpentry = self.dynamic[i]
|
|
rpentry.d_tag = 0
|
|
self.dynamic = self.dynamic[:i] + self.dynamic[i + 1:] + [rpentry]
|