Subject: [PATCH 2/2] Check for dbg symbols directly in /usr/lib/debug

From: Raphael Geissert <[email-masked]>
Date: Mon, 8 Jun 2009 15:18:24 -0500

The only binaries that should be installed directly in /usr/lib/debug
are the debugging versions of the normal binaries, and not the dbg symbols.
Debugging symbols should be installed in a subdirectory.
---
 checks/binaries                          |    8 ++++++++
 checks/binaries.desc                     |   11 +++++++++++
 t/tests/binaries-general/debian/Makefile |    5 +++++
 t/tests/binaries-general/desc            |    1 +
 t/tests/binaries-general/tags            |    3 ++-
 5 files changed, 27 insertions(+), 1 deletions(-)

diff --git a/checks/binaries b/checks/binaries
index 5b391b6..beed670 100644
--- a/checks/binaries
+++ b/checks/binaries
@@ -272,6 +272,14 @@ foreach my $file (sort keys %{$info->file_info}) {
 	}
     }
 
+    # Detached debugging symbols directly in /usr/lib/debug.
+    if ($file =~ m,^\./usr/lib/debug/[^/]+$,) {
+	unless (exists($objdump->{NEEDED})
+	    || $fileinfo =~ m/statically linked/) {
+	    tag "debug-symbols-directly-in-usr-lib-debug", $file;
+	}
+    }
+
     # statically linked?
     if (!exists($objdump->{NEEDED}) || !defined($objdump->{NEEDED})) {
 	if ($fileinfo =~ m/shared object/o) {
diff --git a/checks/binaries.desc b/checks/binaries.desc
index 6af59c0..2360cb1 100644
--- a/checks/binaries.desc
+++ b/checks/binaries.desc
@@ -247,3 +247,14 @@ Info: The given ELF object appears to have been statically linked to zlib.
  Doing this is discouraged due to the extra work needed by the security team
  to fix all the extra embedded copies or trigger the package rebuilds, as
  appropriate.
+
+Tag: debug-symbols-directly-in-usr-lib-debug
+Severity: important
+Certainty: certain
+Info: The given debugging symbols-only object is installed directly in
+ <tt>/usr/lib/debug</tt>, although it should be installed in a subdirectory.
+ I.e. debug symbols of a binary in <tt>/usr/bin</tt> should be placed in
+ <tt>/usr/lib/debug/usr/bin</tt>.
+ .
+ gdb, when looking for debugging symbols, prepends <tt>/usr/lib/debug</tt> to
+ the path of the original binary.
diff --git a/t/tests/binaries-general/debian/Makefile b/t/tests/binaries-general/debian/Makefile
index 344b2db..d68b286 100644
--- a/t/tests/binaries-general/debian/Makefile
+++ b/t/tests/binaries-general/debian/Makefile
@@ -1,5 +1,6 @@
 all:
 	gcc -o basic basic.c -pg -Wl,--rpath,/usr/local/lib
+	gcc -static -o basic.static basic.c
 
 install:
 	install -d $(DESTDIR)/usr/share/foo/
@@ -7,6 +8,10 @@ install:
 	install -d $(DESTDIR)/usr/lib/debug/usr/share/foo/
 	objcopy --only-keep-debug basic $(DESTDIR)/usr/lib/debug/usr/share/foo/basic
 	strip -s $(DESTDIR)/usr/lib/debug/usr/share/foo/basic
+	objcopy --only-keep-debug basic $(DESTDIR)/usr/lib/debug/basic
+	cp basic.static $(DESTDIR)/usr/lib/debug/
+	# dh_strip attempts to play the smart guy if the ELF obj is executable:
+	cd $(DESTDIR)/usr/lib/debug/ && chmod -x basic basic.static
 
 clean distclean:
 	rm -f basic
diff --git a/t/tests/binaries-general/desc b/t/tests/binaries-general/desc
index ee5751f..f8d6bc9 100644
--- a/t/tests/binaries-general/desc
+++ b/t/tests/binaries-general/desc
@@ -7,4 +7,5 @@ Test-For:
  arch-dependent-file-in-usr-share
  binary-compiled-with-profiling-enabled
  binary-or-shlib-defines-rpath
+ debug-symbols-directly-in-usr-lib-debug
  library-in-debug-or-profile-should-not-be-stripped
diff --git a/t/tests/binaries-general/tags b/t/tests/binaries-general/tags
index b553878..d32aa9b 100644
--- a/t/tests/binaries-general/tags
+++ b/t/tests/binaries-general/tags
@@ -1,5 +1,6 @@
 E: binaries-general: arch-dependent-file-in-usr-share ./usr/share/foo/basic
+E: binaries-general: debug-symbols-directly-in-usr-lib-debug ./usr/lib/debug/basic
 E: binaries-general: library-in-debug-or-profile-should-not-be-stripped ./usr/lib/debug/usr/share/foo/basic
 W: binaries-general: binary-compiled-with-profiling-enabled ./usr/share/foo/basic
 W: binaries-general: binary-or-shlib-defines-rpath ./usr/share/foo/basic /usr/local/lib
-W: binaries-general: debug-package-should-be-named-dbg usr/lib/debug/usr/
+W: binaries-general: debug-package-should-be-named-dbg usr/lib/debug/basic