Re: [Xen-devel] mkelf32 uninitialized data and reproducible builds

[Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>]

On Mon, Aug 08, 2016 at 07:02:25PM +0000, Trammell Hudson wrote:
> The xen/arch/x86/boot/mkelf32 executable is preventing Xen hypervisors
> from being reproducibly built.  It is using an uninitialized stack
> buffer for padding after the ehdr and phdr are written to the xen file,
> which leads to non-deterministic bytes in the binary.
> 
> Additionally, the file is then compressed with gzip -9 without the
> -n or --no-name flag, which leads to the xen.gz file having
> non-deterministric timestamp bytes in the compressed file.
> 
> The xen/Makefile variables XEN_WHOAMI, XEN_DOMAIN, XEN_BUILD_TIME,
> XEN_BUILD_DATE and XEN_BUILD_HOST are also not reproducible, but
> since they are defined with ?= it is possible for an outside
> build script to override them.  Perhaps having a flag to set
> these to a default value would be useful.
> 
> Fixing these allows a re-build of the binary to be the same on
> a given host and avoids undefined behaviour in mkelf32.

That is a nice patch. Sadly it is missing an Signed Off By.

I am wondering if you would be comfortable providing that?

The implication of it is that:



        Developer's Certificate of Origin 1.1

        By making a contribution to this project, I certify that:

        (a) The contribution was created in whole or in part by me and I
            have the right to submit it under the open source license
            indicated in the file; or

        (b) The contribution is based upon previous work that, to the best
            of my knowledge, is covered under an appropriate open source
            license and I have the right under that license to submit that
            work with modifications, whether created in whole or in part
            by me, under the same open source license (unless I am
            permitted to submit under a different license), as indicated
            in the file; or

        (c) The contribution was provided directly to me by some other
            person who certified (a), (b) or (c) and I have not modified
            it.

        (d) I understand and agree that this project and the contribution
            are public and that a record of the contribution (including all
            personal information I submit with it, including my sign-off) is
            maintained indefinitely and may be redistributed consistent with
            this project or the open source license(s) involved.


> 
> -- 
> Trammell
> 
> diff --recursive -u 
> /home/hudson/build/clean/xen-4.6.3/xen/arch/x86/boot/mkelf32.c 
> ./xen/arch/x86/boot/mkelf32.c
> --- /home/hudson/build/clean/xen-4.6.3/xen/arch/x86/boot/mkelf32.c    
> 2016-06-20 08:08:22.000000000 -0400
> +++ ./xen/arch/x86/boot/mkelf32.c     2016-08-04 18:02:25.854371605 -0400
> @@ -231,14 +231,14 @@
>      u32        loadbase, dat_siz, mem_siz;
>      char      *inimage, *outimage;
>      int        infd, outfd;
> -    char       buffer[1024];
> +    char       buffer[1024] = {};
>      int        bytes, todo, i;
>  
> -    Elf32_Ehdr in32_ehdr;
> -    Elf32_Phdr in32_phdr;
> +    Elf32_Ehdr in32_ehdr = {};
> +    Elf32_Phdr in32_phdr = {};
>  
> -    Elf64_Ehdr in64_ehdr;
> -    Elf64_Phdr in64_phdr;
> +    Elf64_Ehdr in64_ehdr = {};
> +    Elf64_Phdr in64_phdr = {};
>  
>      if ( argc != 5 )
>      {
> diff --recursive -u /home/hudson/build/clean/xen-4.6.3/xen/Makefile 
> ./xen/Makefile
> --- /home/hudson/build/clean/xen-4.6.3/xen/Makefile   2016-06-20 
> 08:08:22.000000000 -0400
> +++ ./xen/Makefile    2016-08-04 17:50:04.888970103 -0400
> @@ -97,7 +103,7 @@
>       rm -f tags TAGS cscope.files cscope.in.out cscope.out cscope.po.out 
> GTAGS GPATH GRTAGS GSYMS
>  
>  $(TARGET).gz: $(TARGET)
> -     gzip -f -9 < $< > $@.new
> +     gzip -n -f -9 < $< > $@.new
>       mv $@.new $@
>  
>  $(TARGET): delete-unfresh-files
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> https://lists.xen.org/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel