From 5bab08df175db3a4283596515e498fc5a4d0dab9 Mon Sep 17 00:00:00 2001 From: "Wladimir J. van der Laan" Date: Tue, 24 Nov 2020 13:02:08 +0100 Subject: [PATCH 1/2] contrib: Add test for ELF symbol-check Check both failure cases: - Use a glibc symbol from a version that is too new - Use a symbol from a library that is not in the allowlist And also check a conforming binary. Adding a similar check for Windows PE can be done in a separate PR. --- Makefile.am | 1 + configure.ac | 2 + contrib/devtools/test-symbol-check.py | 88 +++++++++++++++++++++++++++ 3 files changed, 91 insertions(+) create mode 100755 contrib/devtools/test-symbol-check.py diff --git a/Makefile.am b/Makefile.am index c8af4228f35..798f8b35240 100644 --- a/Makefile.am +++ b/Makefile.am @@ -359,4 +359,5 @@ if TARGET_WINDOWS endif if TARGET_LINUX $(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_ELF + $(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF endif diff --git a/configure.ac b/configure.ac index a512fce83eb..215144129ff 100644 --- a/configure.ac +++ b/configure.ac @@ -1695,7 +1695,9 @@ AC_CONFIG_FILES([Makefile src/Makefile doc/man/Makefile share/setup.nsi share/qt AC_CONFIG_FILES([contrib/devtools/split-debug.sh],[chmod +x contrib/devtools/split-debug.sh]) AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile])]) AC_CONFIG_LINKS([contrib/devtools/security-check.py:contrib/devtools/security-check.py]) +AC_CONFIG_LINKS([contrib/devtools/symbol-check.py:contrib/devtools/symbol-check.py]) AC_CONFIG_LINKS([contrib/devtools/test-security-check.py:contrib/devtools/test-security-check.py]) +AC_CONFIG_LINKS([contrib/devtools/test-symbol-check.py:contrib/devtools/test-symbol-check.py]) AC_CONFIG_LINKS([contrib/filter-lcov.py:contrib/filter-lcov.py]) AC_CONFIG_LINKS([test/functional/test_runner.py:test/functional/test_runner.py]) AC_CONFIG_LINKS([test/fuzz/test_runner.py:test/fuzz/test_runner.py]) diff --git a/contrib/devtools/test-symbol-check.py b/contrib/devtools/test-symbol-check.py new file mode 100755 index 00000000000..48abf60039e --- /dev/null +++ b/contrib/devtools/test-symbol-check.py @@ -0,0 +1,88 @@ +#!/usr/bin/env python3 +# Copyright (c) 2020 The Bitcoin Core developers +# Distributed under the MIT software license, see the accompanying +# file COPYING or http://www.opensource.org/licenses/mit-license.php. +''' +Test script for symbol-check.py +''' +import subprocess +import unittest + +def call_symbol_check(cc, source, executable, options): + subprocess.run([cc,source,'-o',executable] + options, check=True) + p = subprocess.run(['./contrib/devtools/symbol-check.py',executable], stdout=subprocess.PIPE, universal_newlines=True) + return (p.returncode, p.stdout.rstrip()) + +def get_machine(cc): + p = subprocess.run([cc,'-dumpmachine'], stdout=subprocess.PIPE, universal_newlines=True) + return p.stdout.rstrip() + +class TestSymbolChecks(unittest.TestCase): + def test_ELF(self): + source = 'test1.c' + executable = 'test1' + cc = 'gcc' + + # there's no way to do this test for RISC-V at the moment; bionic's libc is 2.27 + # and we allow all symbols from 2.27. + if 'riscv' in get_machine(cc): + self.skipTest("test not available for RISC-V") + + # memfd_create was introduced in GLIBC 2.27, so is newer than the upper limit of + # all but RISC-V but still available on bionic + with open(source, 'w', encoding="utf8") as f: + f.write(''' + #define _GNU_SOURCE + #include + + int memfd_create(const char *name, unsigned int flags); + + int main() + { + memfd_create("test", 0); + return 0; + } + ''') + + self.assertEqual(call_symbol_check(cc, source, executable, []), + (1, executable + ': symbol memfd_create from unsupported version GLIBC_2.27\n' + + executable + ': failed IMPORTED_SYMBOLS')) + + # -lutil is part of the libc6 package so a safe bet that it's installed + # it's also out of context enough that it's unlikely to ever become a real dependency + source = 'test2.c' + executable = 'test2' + with open(source, 'w', encoding="utf8") as f: + f.write(''' + #include + + int main() + { + login(0); + return 0; + } + ''') + + self.assertEqual(call_symbol_check(cc, source, executable, ['-lutil']), + (1, executable + ': NEEDED library libutil.so.1 is not allowed\n' + + executable + ': failed LIBRARY_DEPENDENCIES')) + + # finally, check a conforming file that simply uses a math function + source = 'test3.c' + executable = 'test3' + with open(source, 'w', encoding="utf8") as f: + f.write(''' + #include + + int main() + { + return (int)pow(2.0, 4.0); + } + ''') + + self.assertEqual(call_symbol_check(cc, source, executable, ['-lm']), + (0, '')) + +if __name__ == '__main__': + unittest.main() + From ed1bbcefeaafef460b6e5609de85e13c12e0d2a4 Mon Sep 17 00:00:00 2001 From: fanquake Date: Wed, 2 Dec 2020 16:39:44 +0800 Subject: [PATCH 2/2] contrib: add MACHO tests to symbol-check tests --- Makefile.am | 1 + contrib/devtools/test-symbol-check.py | 37 +++++++++++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/Makefile.am b/Makefile.am index 798f8b35240..ce8bff0f9a7 100644 --- a/Makefile.am +++ b/Makefile.am @@ -353,6 +353,7 @@ clean-local: clean-docs test-security-check: if TARGET_DARWIN $(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_MACHO + $(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO endif if TARGET_WINDOWS $(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_PE diff --git a/contrib/devtools/test-symbol-check.py b/contrib/devtools/test-symbol-check.py index 48abf60039e..b07ec2ffdf2 100755 --- a/contrib/devtools/test-symbol-check.py +++ b/contrib/devtools/test-symbol-check.py @@ -83,6 +83,43 @@ class TestSymbolChecks(unittest.TestCase): self.assertEqual(call_symbol_check(cc, source, executable, ['-lm']), (0, '')) + def test_MACHO(self): + source = 'test1.c' + executable = 'test1' + cc = 'clang' + + with open(source, 'w', encoding="utf8") as f: + f.write(''' + #include + + int main() + { + XML_ExpatVersion(); + return 0; + } + + ''') + + self.assertEqual(call_symbol_check(cc, source, executable, ['-lexpat']), + (1, 'libexpat.1.dylib is not in ALLOWED_LIBRARIES!\n' + + executable + ': failed DYNAMIC_LIBRARIES')) + + source = 'test2.c' + executable = 'test2' + with open(source, 'w', encoding="utf8") as f: + f.write(''' + #include + + int main() + { + CGMainDisplayID(); + return 0; + } + ''') + + self.assertEqual(call_symbol_check(cc, source, executable, ['-framework', 'CoreGraphics']), + (0, '')) + if __name__ == '__main__': unittest.main()