From: "vo.x (Vit Ondruch) via ruby-core" <ruby-core@...>
Date: 2024-06-05T17:30:56+00:00
Subject: [ruby-core:118188] [Ruby master Bug#18061]  Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found

Issue #18061 has been updated by vo.x (Vit Ondruch).


vo.x (Vit Ondruch) wrote in #note-35:
> Just FTR, the annocheck test is incomplete in case `--enable-shared` is used, because the test is checking just `ruby` executable, while it should also check `libruby.so`.

The test should be likely executed above all executable ELF files and object files. I think that something like `annocheck . 2>/dev/null | grep FAIL` could do the job, because `annocheck` scans the whole directory structure. Here is the result on my system:

~~~
$ annocheck . 2>/dev/null | grep FAIL | less
$ annocheck . 2>/dev/null | grep FAIL
Hardened: Context.o: Overall: FAIL (due to MAYB results).
Hardened: miniruby: FAIL: cf-protection test because .note.gnu.property section did not contain the necessary flags 
Hardened: miniruby: FAIL: property-note test because a property note was found but it shows that cf-protection is not enabled 
Hardened: miniruby: Overall: FAIL.
Hardened: libruby-static.a:Context.o: Overall: FAIL (due to MAYB results).
Hardened: libruby.so.3.3.1: FAIL: cf-protection test because .note.gnu.property section did not contain the necessary flags 
Hardened: libruby.so.3.3.1: FAIL: property-note test because a property note was found but it shows that cf-protection is not enabled 
Hardened: libruby.so.3.3.1: Overall: FAIL.
~~~

----------------------------------------
Bug #18061:  Execshield test: libruby.so.N.N.N: FAIL: property-note test because no .note.gnu.property section found
https://bugs.ruby-lang.org/issues/18061#change-108639

* Author: jaruga (Jun Aruga)
* Status: Open
* Backport: 2.6: UNKNOWN, 2.7: REQUIRED, 3.0: REQUIRED
----------------------------------------
I found an issue in our company's internal test called "execshield" by a security tool annobin - annocheck command [1][2].

```
Hardened: libruby.so.2.7.4: FAIL: property-note test because no .note.gnu.property section found
```

Here is the reproducer on the upstream latest master, commit is 5f2987d6c2ae9ace3178ac3e1bbb4ac7079101eb,

```
$ autoconf
$ ./configure --enable-shared
$ make

$ ls libruby.so.3.1.0
libruby.so.3.1.0*
```

If you are using Red Hat based Linux distro, it's easy to install by the RPM package like this.

```
$ sudo dnf -y install annobin-annocheck
```

```
$ sudo yum -y install annobin-annocheck
```

Then

```
$ annocheck libruby.so.3.1.0
```

If you are using other Linux distros such as Ubuntu, you can use it by a container I prepared.

Prepare the following `Dockerfile`.

```
$ cat Dockerfile 
FROM docker.io/fedora:34

RUN cat /etc/fedora-release
RUN dnf -y install annobin-annocheck
WORKDIR /work
```

Then build the container image with the `Dockerfile` and run the annocheck command for the `libruby.so.3.1.0` on your host environment. The `-v` is an option for bind mount between host and container environment.

```
$ docker build --rm -t fedora-annocheck .

$ docker run --rm -t -v $(pwd):/work fedora-annocheck annocheck /work/libruby.so.3.1.0
annocheck: Version 9.79.
Hardened: libruby.so.3.1.0: FAIL: bind-now test because not linked with -Wl,-z,now 
Hardened: libruby.so.3.1.0: FAIL: notes test because gaps were detected in the annobin coverage 
Hardened: libruby.so.3.1.0: FAIL: cf-protection test because no .note.gnu.property section = no control flow information 
Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found 
Hardened: Rerun annocheck with --verbose to see more information on the tests.
```

The message `Hardened: libruby.so.3.1.0: FAIL: property-note test because no .note.gnu.property section found` is what I found in our internal test. For other FAIL messages, maybe it can be fixed by changing how to build.

Asking a colleague, I was told that the `coroutine/*/Context.S` files such as [coroutine/x86/Context.S](https://github.com/ruby/ruby/blob/master/coroutine/x86/Context.S) cause the failure. Do you have any idea how to fix this? Thanks.

* [1] https://sourceware.org/annobin/
* [2] You can see `man annocheck` or https://www.mankier.com/1/annocheck .

---Files--------------------------------
0001-Add-.note.gnu.property-sections.patch (2.64 KB)
0001-Add-.note.gnu.property-sections.patch (3.69 KB)
config-pie.log (11.4 KB)


-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/