* Gordon Messmer:
> On 2026-09-04 2:17 AM, Florian Weimer wrote:
>
>> https://codeberg.org/gordonmessmer/got-audit-pipeline
>> https://codeberg.org/gordonmessmer/got-audit
>
>> Does this light up on Red Hat's build of Fedora? It has heavy run-time
>> patching of libc.so.6, apparently.
>
> I'm not sure what you mean by run-time patching... There are libraries
> in Fedora like libattr.so and libtirpc.so that provide identically
> named functions as functions in libc.so (although, with different
> symbol versions). The scanner does look for libraries that export
> identical function names, which might be a sign of function hijacking,
> but it has an allow-list for functions in a few libraries. I think
> that needs a better and more generalized approach.
>
> Are you referring to some other run-time patching?
It's very narrow if this only detects on very specific form of run-time
patching. Fedora CSB has this patch of libc.so.6. (I believe it's not
malicious.)
000000000001e740 <putenv>:
- 1e740: f3 0f 1e fa endbr64
+ 1e740: cc int3
+ 1e741: 0f 1e fa nop %edx
1e744: 55 push %rbp
1e745: be 3d 00 00 00 mov $0x3d,%esi
1e74a: 48 89 e5 mov %rsp,%rbp
@@ -33543,7 +33544,8 @@
2027b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000020280 <setenv>:
- 20280: f3 0f 1e fa endbr64
+ 20280: cc int3
+ 20281: 0f 1e fa nop %edx
20284: 55 push %rbp
20285: 48 89 e5 mov %rsp,%rbp
20288: 48 83 ec 20 sub $0x20,%rsp
@@ -33675,7 +33677,8 @@
2047c: 00 00 00 00
0000000000020480 <clearenv>:
- 20480: f3 0f 1e fa endbr64
+ 20480: cc int3
+ 20481: 0f 1e fa nop %edx
20484: 55 push %rbp
20485: 31 c0 xor %eax,%eax
20487: ba 01 00 00 00 mov $0x1,%edx
Thanks,
Florian
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
