|
|
5255f8 |
#!/usr/bin/python3
|
|
|
5255f8 |
|
|
|
5255f8 |
"""
|
|
|
5255f8 |
Check debug symbols are present in shared object and can identify
|
|
|
5255f8 |
code.
|
|
|
5255f8 |
|
|
|
5255f8 |
It starts scanning from a directory and recursively scans all ELF
|
|
|
5255f8 |
files found in it for various symbols to ensure all debuginfo is
|
|
|
5255f8 |
present and nothing has been stripped.
|
|
|
5255f8 |
|
|
|
5255f8 |
Usage:
|
|
|
5255f8 |
|
|
|
5255f8 |
./check-debug-symbols /path/of/dir/to/scan/
|
|
|
5255f8 |
|
|
|
5255f8 |
|
|
|
5255f8 |
Example:
|
|
|
5255f8 |
|
|
|
5255f8 |
./check-debug-symbols /usr/lib64
|
|
|
5255f8 |
"""
|
|
|
5255f8 |
|
|
|
5255f8 |
# This technique was explained to me by Mark Wielaard (mjw).
|
|
|
5255f8 |
|
|
|
5255f8 |
import collections
|
|
|
5255f8 |
import os
|
|
|
5255f8 |
import re
|
|
|
5255f8 |
import subprocess
|
|
|
5255f8 |
import sys
|
|
|
5255f8 |
|
|
|
5255f8 |
ScanResult = collections.namedtuple('ScanResult',
|
|
|
5255f8 |
'file_name debug_info debug_abbrev file_symbols gnu_debuglink')
|
|
|
5255f8 |
|
|
|
5255f8 |
|
|
|
5255f8 |
def scan_file(file):
|
|
|
5255f8 |
"Scan the provided file and return a ScanResult containing results of the scan."
|
|
|
5255f8 |
|
|
|
5255f8 |
# Test for .debug_* sections in the shared object. This is the main test.
|
|
|
5255f8 |
# Stripped objects will not contain these.
|
|
|
5255f8 |
readelf_S_result = subprocess.run(['eu-readelf', '-S', file],
|
|
|
5255f8 |
stdout=subprocess.PIPE, encoding='utf-8', check=True)
|
|
|
5255f8 |
has_debug_info = any(line for line in readelf_S_result.stdout.split('\n') if '] .debug_info' in line)
|
|
|
5255f8 |
|
|
|
5255f8 |
has_debug_abbrev = any(line for line in readelf_S_result.stdout.split('\n') if '] .debug_abbrev' in line)
|
|
|
5255f8 |
|
|
|
5255f8 |
# Test FILE symbols. These will most likely be removed by anyting that
|
|
|
5255f8 |
# manipulates symbol tables because it's generally useless. So a nice test
|
|
|
5255f8 |
# that nothing has messed with symbols.
|
|
|
5255f8 |
def contains_file_symbols(line):
|
|
|
5255f8 |
parts = line.split()
|
|
|
5255f8 |
if len(parts) < 8:
|
|
|
5255f8 |
return False
|
|
|
5255f8 |
return \
|
|
|
5255f8 |
parts[2] == '0' and parts[3] == 'FILE' and parts[4] == 'LOCAL' and parts[5] == 'DEFAULT' and \
|
|
|
5255f8 |
parts[6] == 'ABS' and re.match(r'((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx))?', parts[7])
|
|
|
5255f8 |
|
|
|
5255f8 |
readelf_s_result = subprocess.run(["eu-readelf", '-s', file],
|
|
|
5255f8 |
stdout=subprocess.PIPE, encoding='utf-8', check=True)
|
|
|
5255f8 |
has_file_symbols = any(line for line in readelf_s_result.stdout.split('\n') if contains_file_symbols(line))
|
|
|
5255f8 |
|
|
|
5255f8 |
# Test that there are no .gnu_debuglink sections pointing to another
|
|
|
5255f8 |
# debuginfo file. There shouldn't be any debuginfo files, so the link makes
|
|
|
5255f8 |
# no sense either.
|
|
|
5255f8 |
has_gnu_debuglink = any(line for line in readelf_s_result.stdout.split('\n') if '] .gnu_debuglink' in line)
|
|
|
5255f8 |
|
|
|
5255f8 |
return ScanResult(file, has_debug_info, has_debug_abbrev, has_file_symbols, has_gnu_debuglink)
|
|
|
5255f8 |
|
|
|
5255f8 |
def is_elf(file):
|
|
|
5255f8 |
result = subprocess.run(['file', file], stdout=subprocess.PIPE, encoding='utf-8', check=True)
|
|
|
5255f8 |
return re.search('ELF 64-bit LSB (?:executable|shared object)', result.stdout)
|
|
|
5255f8 |
|
|
|
5255f8 |
def scan_file_if_sensible(file):
|
|
|
5255f8 |
if is_elf(file):
|
|
|
5255f8 |
# print(file)
|
|
|
5255f8 |
return scan_file(file)
|
|
|
5255f8 |
return None
|
|
|
5255f8 |
|
|
|
5255f8 |
def scan_dir(dir):
|
|
|
5255f8 |
results = []
|
|
|
5255f8 |
for root, _, files in os.walk(dir):
|
|
|
5255f8 |
for name in files:
|
|
|
5255f8 |
result = scan_file_if_sensible(os.path.join(root, name))
|
|
|
5255f8 |
if result:
|
|
|
5255f8 |
results.append(result)
|
|
|
5255f8 |
return results
|
|
|
5255f8 |
|
|
|
5255f8 |
def scan(file):
|
|
|
5255f8 |
file = os.path.abspath(file)
|
|
|
5255f8 |
if os.path.isdir(file):
|
|
|
5255f8 |
return scan_dir(file)
|
|
|
5255f8 |
elif os.path.isfile(file):
|
|
|
5255f8 |
return [scan_file_if_sensible(file)]
|
|
|
5255f8 |
|
|
|
5255f8 |
def is_bad_result(result):
|
|
|
5255f8 |
return not result.debug_info or not result.debug_abbrev or not result.file_symbols or result.gnu_debuglink
|
|
|
5255f8 |
|
|
|
5255f8 |
def print_scan_results(results, verbose):
|
|
|
5255f8 |
# print(results)
|
|
|
5255f8 |
for result in results:
|
|
|
5255f8 |
file_name = result.file_name
|
|
|
5255f8 |
found_issue = False
|
|
|
5255f8 |
if not result.debug_info:
|
|
|
5255f8 |
found_issue = True
|
|
|
5255f8 |
print('error: missing .debug_info section in', file_name)
|
|
|
5255f8 |
if not result.debug_abbrev:
|
|
|
5255f8 |
found_issue = True
|
|
|
5255f8 |
print('error: missing .debug_abbrev section in', file_name)
|
|
|
5255f8 |
if not result.file_symbols:
|
|
|
5255f8 |
found_issue = True
|
|
|
5255f8 |
print('error: missing FILE symbols in', file_name)
|
|
|
5255f8 |
if result.gnu_debuglink:
|
|
|
5255f8 |
found_issue = True
|
|
|
5255f8 |
print('error: unexpected .gnu_debuglink section in', file_name)
|
|
|
5255f8 |
if verbose and not found_issue:
|
|
|
5255f8 |
print('OK: ', file_name)
|
|
|
5255f8 |
|
|
|
5255f8 |
def main(args):
|
|
|
5255f8 |
verbose = False
|
|
|
5255f8 |
files = []
|
|
|
5255f8 |
for arg in args:
|
|
|
5255f8 |
if arg == '--verbose' or arg == '-v':
|
|
|
5255f8 |
verbose = True
|
|
|
5255f8 |
else:
|
|
|
5255f8 |
files.append(arg)
|
|
|
5255f8 |
|
|
|
5255f8 |
results = []
|
|
|
5255f8 |
for file in files:
|
|
|
5255f8 |
results.extend(scan(file))
|
|
|
5255f8 |
|
|
|
5255f8 |
print_scan_results(results, verbose)
|
|
|
5255f8 |
|
|
|
5255f8 |
if any(is_bad_result(result) for result in results):
|
|
|
5255f8 |
return 1
|
|
|
5255f8 |
return 0
|
|
|
5255f8 |
|
|
|
5255f8 |
|
|
|
5255f8 |
if __name__ == '__main__':
|
|
|
5255f8 |
sys.exit(main(sys.argv[1:]))
|