bin/check-elf-dynamic-objects

   1 #!/usr/bin/env bash
   2 #
   3 # This file is part of the LibreOffice project.
   4 #
   5 # This Source Code Form is subject to the terms of the Mozilla Public
   6 # License, v. 2.0. If a copy of the MPL was not distributed with this
   7 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8 #
   9
  10 # verify that ELF NEEDED entries are known-good so hopefully builds run on
  11 # lots of different GNU/Linux distributions
  12
  13 set -euo pipefail
  14
  15 PARA=1
  16 check_path="${INSTDIR:-.}"
  17
  18 help()
  19 {
  20     cat << "EOF"
  21     -d <dir>  directory to check
  22     -p        run unbound parallel checks
  23     -h        help
  24 EOF
  25     [ -z "${1:-}" ] && exit 0
  26 }
  27
  28 die()
  29 {
  30     echo "$1"
  31     echo
  32     help 1
  33     exit 1
  34 }
  35
  36 while [ "${1:-}" != "" ]; do
  37     parm=${1%%=*}
  38     arg=${1#*=}
  39     has_arg=
  40     if [ "${1}" != "${parm?}" ] ; then
  41         has_arg=1
  42     else
  43         arg=""
  44     fi
  45
  46     case "${parm}" in
  47         --dir|-d)
  48             if [ "$has_arg" ] ; then
  49                 check_path="$arg"
  50             else
  51                 shift
  52                 check_path="$1"
  53             fi
  54             if [ ! -d "$check_path" ]; then
  55                 die "Invalid directory '$check_path'"
  56             fi
  57             ;;
  58         -h)
  59             help
  60             ;;
  61         -p)
  62             # this sounds counter intuitive but the idea
  63             # is to possibly support -p <n>
  64             # in the meantime: 0 = nolimit and -p 1 would mean
  65             # the current default: serialize
  66             PARA=0
  67             ;;
  68         -*)
  69             die "Invalid option $1"
  70             ;;
  71         *)
  72             if [ "$DO_NEW" = 1 ] ; then
  73                 REPO="$1"
  74             else
  75                 die "Invalid argument $1"
  76             fi
  77             ;;
  78     esac
  79     shift
  80 done
  81
  82
  83 files=$(find "${check_path}/program" "${check_path}/sdk/bin" -type f)
  84 # all RPATHs should point to ${INSTDIR}/program so that's the files they find
  85 programfiles=$(echo ${files} | grep -o '/program/[^/]* ' | xargs -n 1 basename)
  86
  87 # allowlists should contain only system libraries that have a good reputation
  88 # of maintaining ABI stability
  89 # allow extending the allowlist using the environment variable to be able to work
  90 # on the installer stuff without the need for a baseline setup
  91 globalallowlist="ld-linux-x86-64.so.2 ld-linux.so.2 libc.so.6 libm.so.6 libdl.so.2 libpthread.so.0 librt.so.1 libutil.so.1 libnsl.so.1 libcrypt.so.1 libgcc_s.so.1 libstdc++.so.6 libz.so.1 libfontconfig.so.1 libfreetype.so.6 libxml2.so.2 libxslt.so.1 libexslt.so.0 libnspr4.so libnss3.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libssl3.so ${LO_ELFCHECK_ALLOWLIST-}"
  92 x11allowlist="libX11.so.6 libX11-xcb.so.1 libXext.so.6 libSM.so.6 libICE.so.6 libXinerama.so.1 libXrender.so.1 libXrandr.so.2 libcairo.so.2"
  93 openglallowlist="libGL.so.1"
  94 gobjectallowlist="libgobject-2.0.so.0 libglib-2.0.so.0"
  95 gdbusallowlist="libdbus-glib-1.so.2 libdbus-1.so.3 libgmodule-2.0.so.0 libgthread-2.0.so.0 ${gobjectallowlist}"
  96 gioallowlist="libgio-2.0.so.0 ${gdbusallowlist}"
  97 gstreamerallowlist="libgsttag-1.0.so.0 libgstaudio-1.0.so.0 libgstpbutils-1.0.so.0 libgstvideo-1.0.so.0 libgstbase-1.0.so.0 libgstreamer-1.0.so.0 ${gobjectallowlist}"
  98 gtk3allowlist="libgtk-3.so.0 libgdk-3.so.0 libcairo-gobject.so.2 libpangocairo-1.0.so.0 libfribidi.so.0 libatk-1.0.so.0 libcairo.so.2 libpangoft2-1.0.so.0 libpango-1.0.so.0 libfontconfig.so.1 libfreetype.so.6 libgdk_pixbuf-2.0.so.0 libharfbuzz.so.0 ${gioallowlist}"
  99 gtk4allowlist="libgtk-4.so.1 libcairo-gobject.so.2 libpangocairo-1.0.so.0 libatk-1.0.so.0 libcairo.so.2 libpango-1.0.so.0 libgdk_pixbuf-2.0.so.0 libharfbuzz.so.0 libgraphene-1.0.so.0 ${gioallowlist}"
 100 qt5allowlist="libQt5Core.so.5 libQt5Gui.so.5 libQt5Network.so.5 libQt5Widgets.so.5 libQt5X11Extras.so.5 libcairo.so.2 libxcb.so.1 libxcb-icccm.so.4 ${gobjectallowlist}"
 101 qt6allowlist="libQt6Core.so.6 libQt6Gui.so.6 libQt6Multimedia.so.6 libQt6MultimediaWidgets.so.6 libQt6Network.so.6 libQt6Widgets.so.6 libxcb.so.1"
 102 kf5allowlist="libKF5ConfigCore.so.5 libKF5CoreAddons.so.5 libKF5I18n.so.5 libKF5KIOCore.so.5 libKF5KIOFileWidgets.so.5 libKF5KIOWidgets.so.5 libKF5WindowSystem.so.5"
 103 avahiallowlist="libavahi-common.so.3 libavahi-client.so.3 ${gdbusallowlist}"
 104 kerberosallowlist="libgssapi_krb5.so.2 libcom_err.so.2 libkrb5.so.3"
 105 dconfallowlist="libdconf.so.1 libgio-2.0.so.0 ${gobjectallowlist}"
 106
 107 check_one_file()
 108 {
 109 local file="$1"
 110
 111     skip=0
 112     allowlist="${globalallowlist}"
 113     case "${file}" in
 114         */sdk/docs/*)
 115             # skip the majority of files, no ELF binaries here
 116             skip=1
 117         ;;
 118         */_uuid.cpython-*.so)
 119             allowlist="${allowlist} libuuid.so.1"
 120         ;;
 121         */libcairo-lo.so.2)
 122             allowlist="${allowlist} ${x11allowlist} libxcb-shm.so.0 libxcb.so.1 libxcb-render.so.0"
 123         ;;
 124         */libcairocanvaslo.so)
 125             allowlist="${allowlist} libcairo.so.2"
 126         ;;
 127         */libucpgio1lo.so|*/liblosessioninstalllo.so|*/libevoablo.so)
 128             allowlist="${allowlist} ${gioallowlist}"
 129         ;;
 130         */libavmediagst.so)
 131             allowlist="${allowlist} ${gstreamerallowlist}"
 132         ;;
 133         */libavmediagtk.so)
 134             allowlist="${allowlist} ${gtk4allowlist}"
 135         ;;
 136         */libavmediaqt6.so)
 137             allowlist="${allowlist} ${qt6allowlist}"
 138         ;;
 139         */libvclplug_kf5lo.so|*/libkf5be1lo.so)
 140             if [ "$ENABLE_KF5" = TRUE ]; then
 141                 allowlist="${allowlist} ${qt5allowlist} ${kf5allowlist}"
 142             fi
 143         ;;
 144         */libvclplug_gtk3lo.so|*/updater)
 145             allowlist="${allowlist} ${x11allowlist} ${gtk3allowlist}"
 146         ;;
 147         */libvclplug_gtk4lo.so)
 148             allowlist="${allowlist} ${x11allowlist} ${gtk4allowlist}"
 149         ;;
 150         */libvclplug_qt5lo.so)
 151             if [ "$ENABLE_QT5" = TRUE ]; then
 152                 allowlist="${allowlist} ${qt5allowlist}"
 153             fi
 154         ;;
 155         */libvclplug_qt6lo.so)
 156             if [ "$ENABLE_QT6" = TRUE ]; then
 157                 allowlist="${allowlist} ${qt6allowlist}"
 158             fi
 159         ;;
 160         */libvclplug_gtk3_kde5lo.so)
 161             if [ "$ENABLE_GTK3_KDE5" = TRUE ]; then
 162                 allowlist="${allowlist} ${x11allowlist} ${gtk3allowlist} ${qt5allowlist} ${kf5allowlist}"
 163             fi
 164         ;;
 165         */lo_kde5filepicker)
 166             if [ "$ENABLE_GTK3_KDE5" = TRUE ]; then
 167                 allowlist="${allowlist} ${x11allowlist} ${gtk3allowlist} ${qt5allowlist} \
 168                     ${kf5allowlist}"
 169             fi
 170         ;;
 171         */oosplash|*/gengal.bin)
 172             allowlist="${allowlist} ${x11allowlist}"
 173         ;;
 174         */libvclplug_genlo.so|*/libchartcorelo.so|*/libavmediaogl.so|*/libOGLTranslo.so|*/liboglcanvaslo.so)
 175             allowlist="${allowlist} ${x11allowlist} ${openglallowlist}"
 176         ;;
 177         */libvcllo.so)
 178             allowlist="${allowlist} ${x11allowlist} ${openglallowlist} ${gioallowlist} libcups.so.2"
 179         ;;
 180         */libsofficeapp.so)
 181             allowlist="${allowlist} ${x11allowlist} ${openglallowlist} ${gioallowlist} libcups.so.2"
 182         ;;
 183         */liblibreofficekitgtk.so)
 184             allowlist="${allowlist} ${gtk3allowlist}"
 185         ;;
 186         */libsdlo.so)
 187             allowlist="${allowlist} ${avahiallowlist}"
 188         ;;
 189         */libskialo.so)
 190             allowlist="${allowlist} ${openglallowlist} ${x11allowlist}"
 191         ;;
 192         */libofficebean.so)
 193             allowlist="${allowlist} libjawt.so"
 194         ;;
 195         */libpostgresql-sdbc-impllo.so)
 196             allowlist="${allowlist} ${kerberosallowlist}"
 197         ;;
 198         */libmysqlclo.so)
 199             if [ "$WITH_GSSAPI" = TRUE ]; then
 200                 allowlist="${allowlist} ${kerberosallowlist}"
 201             fi
 202         ;;
 203         */libconfigmgrlo.so)
 204             if [ "$ENABLE_DCONF" = TRUE ]; then
 205                 allowlist="${allowlist} ${dconfallowlist}"
 206             fi
 207         ;;
 208         */libmergedlo.so)
 209             allowlist="${allowlist} ${x11allowlist} ${openglallowlist} ${gioallowlist} ${kerberosallowlist} ${dconfallowlist} libcups.so.2 libcairo.so.2"
 210         ;;
 211     esac
 212     if test "${skip}" = 0 && readelf -d "${file}" &> /dev/null ; then
 213         rpath=$(readelf -d "${file}" | grep '(\(RPATH\|RUNPATH\))' || true)
 214         neededs=$(readelf -d "${file}" | grep '(NEEDED)' | sed -e 's/.*\[\(.*\)\]$/\1/')
 215         neededsinternal=
 216         for needed in ${neededs}
 217         do
 218             if ! echo ${allowlist} | grep -q -w "${needed}" ; then
 219                 neededsinternal="${neededsinternal} ${needed}"
 220                 if ! echo ${programfiles} | grep -q -w "${needed}" ; then
 221                     echo "${file}" has suspicious NEEDED: "${needed}"
 222                     status=1
 223                 fi
 224             fi
 225         done
 226         if test -z "${rpath}" ; then
 227             case "${file}" in
 228                 */python-core-*/lib/lib-dynload/*)
 229                     # python modules don't have RPATH
 230                 ;;
 231                 */share/extensions/*)
 232                     # extension libraries don't have RPATH
 233                 ;;
 234                 *)
 235                     # no NEEDED from instdir, no RPATH needed
 236                     if test -n "${neededsinternal}" ; then
 237                         echo "${file}" has no RPATH
 238                         status=1
 239                     fi
 240                 ;;
 241             esac
 242         else
 243             case "$file" in
 244                 */sdk/bin/*)
 245                     if echo "${rpath}" | grep -q -v '\[\$ORIGIN/../../program\]$' ; then
 246                         echo "${file}" has unexpected RPATH "${rpath}"
 247                         status=1
 248                     fi
 249                 ;;
 250                 *)
 251                     if echo "${rpath}" | grep -q -v '\[\$ORIGIN\]$' ; then
 252                         echo "${file}" has unexpected RPATH "${rpath}"
 253                         status=1
 254                     fi
 255                 ;;
 256             esac
 257         fi
 258     fi
 259 }
 260 status=0
 261
 262 if [ "$PARA" = "1" ] ; then
 263     for file in ${files}
 264     do
 265         check_one_file $file
 266     done
 267 else
 268     rm -f check_elf.out
 269     for file in ${files}
 270     do
 271         (
 272         check_one_file $file
 273         )>> check_elf.out &
 274     done
 275
 276     wait
 277
 278     if [ -s check_elf.out ] ; then
 279         cat check_elf.out
 280         status=1
 281     fi
 282     rm check_elf.out
 283 fi
 284 exit ${status}
 285