Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1548665 - wireshark: Partial Fedora build flags injection
Summary: wireshark: Partial Fedora build flags injection
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: wireshark
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Ruprich
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: Fedora28BuildFlags
TreeView+ depends on / blocked
 
Reported: 2018-02-24 10:11 UTC by Florian Weimer
Modified: 2018-06-05 14:10 UTC (History)
7 users (show)

Fixed In Version: wireshark-2.4.5-3.fc27 wireshark-2.4.5-3.fc28 wireshark-2.6.1-1.fc28 wireshark-2.6.1-1.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-05-30 14:10:00 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Florian Weimer 2018-02-24 10:11:59 UTC 
Various components of wireshark (e.g., /usr/bin/capinfos, /usr/lib64/wireshark/extcap/ciscodump, /usr/bin/wireshark-gtk, /usr/bin/wireshark-qt) in wireshark-cli-1:2.4.4-2.fc28.x86_64, wireshark-gtk-1:2.4.4-2.fc28.x86_64, wireshark-qt-1:2.4.4-2.fc28.x86_64 have not been linked with the standard Fedora linker flags (LDFLAGS) from redhat-rpm-config.

The build log doesn't show the actual flags, so it is difficult to tell what is going on there.

See https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md for information on RPM macros and environment variables provided by the build environment.
Comment 1 Fedora Update System 2018-03-13 11:31:17 UTC 
wireshark-2.4.5-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ed785c3f1c
Comment 2 Fedora Update System 2018-03-13 11:33:00 UTC 
wireshark-2.4.5-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-688817e677
Comment 3 Fedora Update System 2018-03-13 13:03:52 UTC 
wireshark-2.4.5-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f19212808
Comment 4 Fedora Update System 2018-03-13 13:05:33 UTC 
wireshark-2.4.5-2.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-89ed29a14b
Comment 5 Fedora Update System 2018-03-13 15:13:09 UTC 
wireshark-2.4.5-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-8f19212808
Comment 6 Fedora Update System 2018-03-14 01:39:00 UTC 
wireshark-2.4.5-2.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-89ed29a14b
Comment 7 Fedora Update System 2018-03-15 10:46:38 UTC 
wireshark-2.4.5-3.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-bfdad62cd6
Comment 8 Fedora Update System 2018-03-15 10:48:36 UTC 
wireshark-2.4.5-3.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf3f8e8b0
Comment 9 Fedora Update System 2018-03-15 13:34:21 UTC 
wireshark-2.4.5-3.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-bfdad62cd6
Comment 10 Fedora Update System 2018-03-15 16:28:35 UTC 
wireshark-2.4.5-3.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf3f8e8b0
Comment 11 Fedora Update System 2018-03-27 20:02:17 UTC 
wireshark-2.4.5-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
Comment 12 Florian Weimer 2018-04-03 09:00:08 UTC 
wireshark-qt-2.4.5-3.fc28.x86_64 still lacks full RELRO:

$ checksec --file /usr/bin/wireshark-qt
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FORTIFY Fortified Fortifiable  FILE
Partial RELRO   Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH   Yes     6               13      /usr/bin/wireshark-qt

The RPM spec file is just bogus:

# FC5+ automatic -fstack-protector-all switch
export RPM_OPT_FLAGS=${RPM_OPT_FLAGS//-fstack-protector-strong/-fstack-protector-all}
export CFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export CXXFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export LDFLAGS="$RPM_OPT_FLAGS $LDFLAGS -pie -fPIC"

You should *really* use the standard build flags from redhat-rpm-config.
Comment 13 Fedora Update System 2018-04-17 00:13:14 UTC 
wireshark-2.4.5-3.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Comment 14 Michal Ruprich 2018-05-02 12:35:42 UTC 
The latest wireshark in rawhide has full RELRO. Closing this bug. Florian, feel free to reopen it again should you think something else is missing.

Thanks.
Comment 15 Florian Weimer 2018-05-07 12:23:30 UTC 
/usr/bin/dumpcap and other programs in wireshark-cli-1:2.6.0-1.fc28.x86_64 still have this issue.  These binaries have not been linked with BIND_NOW.  Due to missing command lines from the build log, it is difficult to tell what is going on, but I think it's the faulty %build section mentioned in comment 12:

%build
%ifarch s390 s390x sparcv9 sparc64
export PIECFLAGS="-fPIE -fPIC"
%else
export PIECFLAGS="-fpie -fPIC"
%endif

# FC5+ automatic -fstack-protector-all switch
export RPM_OPT_FLAGS=${RPM_OPT_FLAGS//-fstack-protector-strong/-fstack-protector-all}
export CFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export CXXFLAGS="$RPM_OPT_FLAGS $CPPFLAGS $PIECFLAGS -D_LARGEFILE64_SOURCE"
export LDFLAGS="$RPM_OPT_FLAGS $LDFLAGS -pie -fPIC"

Let me repeat that this is broken, you should use the flags described here and not try to meddle with PIE/PIC flags explicitly:

https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md
Comment 16 Fedora Update System 2018-05-15 13:42:15 UTC 
wireshark-2.6.0-2.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-7e307f3e5a
Comment 17 Fedora Update System 2018-05-15 13:42:31 UTC 
wireshark-2.6.0-3.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-279a8f520b
Comment 18 Fedora Update System 2018-05-15 20:52:21 UTC 
wireshark-2.6.0-3.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-279a8f520b
Comment 19 Fedora Update System 2018-05-15 23:03:05 UTC 
wireshark-2.6.0-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-7e307f3e5a
Comment 20 Fedora Update System 2018-05-24 15:29:11 UTC 
wireshark-2.6.1-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-d1cfa444d2
Comment 21 Fedora Update System 2018-05-24 15:29:39 UTC 
wireshark-2.6.1-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3dfee621af
Comment 22 Fedora Update System 2018-05-25 15:42:37 UTC 
wireshark-2.6.1-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-d1cfa444d2
Comment 23 Fedora Update System 2018-05-25 18:44:54 UTC 
wireshark-2.6.1-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3dfee621af
Comment 24 Fedora Update System 2018-05-30 14:10:00 UTC 
wireshark-2.6.1-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Comment 25 Fedora Update System 2018-06-05 14:10:02 UTC 
wireshark-2.6.1-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.