sbopkglint: check for binaries that need too new of a glibc.

1 files changed, 46 insertions, 5 deletions

diff --git a/sbopkglint.d/20-arch.t.sh b/sbopkglint.d/20-arch.t.sh
index bf6124e..c904fb2 100644
--- a/sbopkglint.d/20-arch.t.sh
+++ b/sbopkglint.d/20-arch.t.sh
@@ -9,6 +9,8 @@
 # for noarch packages, do nothing.
 # for everything else, make sure any ELF binaries/libraries match the
 # ARCH, and that libs are in the correct directory (lib vs. lib64).
+# also, check the required glibc version of each bin/lib, and complain
+# if it's newer than the glibc on the system.
 
 # warnings:
 # if an i?86 package has any 64-bit ELF objects (libs or bins)
@@ -21,12 +23,48 @@
 # false "wrong directory" warnings, so we exclude that dir from the
 # search.
 
+set_glibc_ver() {
+	GLIBC_VER="$( /$1/libc.so.6 --version | \
+                 grep version | \
+                 head -n1 | \
+                 sed 's,.* \([0-9]\.[0-9]\+\)\.*$,\1,' )"
+	[ "$GLIBC_VER" = "" ] && note "can't get glibc version, disabling glibc check"
+}
+
+# compare the highest required version of glibc from a binary against
+# the version we have installed. ugly code, sorry.
+# one approach would be to run ldd and look for "version `.*' not found",
+# but it's better not to run ldd on arbitrary binaries as root...
+glibc_check() {
+	local ver
+	local highver
+
+	[ "$GLIBC_VER" = "" ] && return
+
+	# get the highest required glibc verson from the binary. there *must*
+	# be a cleaner way to do this, but I haven't found it yet.
+	ver="$( objdump -p "$1" 2>/dev/null | \
+	        sed -n '/Version Ref/,$s/GLIBC_/&/p' | \
+			  rev | cut -d_ -f1 | rev | sort -V | tail -n 1 )"
+	[ "$ver" = "" ] && return  # probably a static binary
+
+	# highver is whichever of (our glibc, binary's highest required glibc)
+	# is higher (or, same as our glibc, if they're the same)
+	highver="$( ( echo $GLIBC_VER ; echo $ver ) | sort -V | tail -n 1 )"
+
+	#echo "===> ver: $ver   highver: $highver"
+
+	if [ "$highver" != "$GLIBC_VER" ]; then
+		echo "$1" >> .badglibc.$$
+	fi
+}
+
 case "$ARCH" in
 	noarch)  ;; # ok, do nothing.
-	i?86)    WRONGDIR="lib64"; CPU="80386"   ;;
-	x86_64)  WRONGDIR="lib";   CPU="x86-64"  ;;
-	aarch64) WRONGDIR="lib";   CPU="aarch64" ;;
-	arm)     WRONGDIR="lib64"; CPU="ARM"     ;;
+	i?86)    WRONGDIR="lib64"; CPU="80386"   ; set_glibc_ver "lib"   ;;
+	x86_64)  WRONGDIR="lib";   CPU="x86-64"  ; set_glibc_ver "lib64" ;;
+	aarch64) WRONGDIR="lib";   CPU="aarch64" ; set_glibc_ver "lib64" ;;
+	arm)     WRONGDIR="lib64"; CPU="ARM"     ; set_glibc_ver "lib"   ;;
 	*) warn "ARCH isn't noarch, i?86, x86_64, arm, or aarch64. don't know how to check binaries." ;;
 esac
 
@@ -85,10 +123,12 @@ if [ -n "$WRONGDIR" ]; then
 
 			# don't check "no machine" ELF objects for being stripped.
 			# our strip command doesn't know how to strip them!
+			# also, check for binaries that need too new of a glibc.
 			if [ ! "$nomachine" ]; then
 				if echo "$filetype" | grep -q "not stripped"; then
 					ls -lb "$file" >> .notstripped.$$
 				fi
+				glibc_check "$file"
 			fi
 		done < .tmp.$$
 		rm -f .tmp.$$
@@ -98,6 +138,7 @@ fi
 [ -s .wrongarch.$$ ] && warn "ELF object(s) with wrong arch (should be $CPU):" && cat .wrongarch.$$
 [ -s .notstripped.$$ ] && warn "ELF object(s) not stripped:" && cat .notstripped.$$
 [ -s .nonexec.$$ ] && warn "ELF binaries/libraries should be executable:" && cat .nonexec.$$
+[ -s .badglibc.$$ ] && warn "ELF binaries/libraries with bad glibc version:" && cat .badglibc.$$
 
 if [ "$WRONGDIR" = "lib64" ]; then
 	[ -e usr/lib64 ] && warn "32-bit $ARCH package may not contain /usr/lib64"
@@ -106,4 +147,4 @@ elif [ "$WRONGDIR" = "lib" -a -e usr/lib ]; then
 	note "64-bit $ARCH package contains /usr/lib; this may or may not be a problem."
 fi
 
-rm -f .inwrongdir.$$ .wrongarch.$$ .notstripped.$$ .nonexec.$$
+rm -f .inwrongdir.$$ .wrongarch.$$ .notstripped.$$ .nonexec.$$ .badglibc.$$