Wind River Support Network

HomeDefectsLIN7-1075
Fixed

LIN7-1075 : lsof package pulls info from build machine

Created: Oct 14, 2014    Updated: Mar 4, 2019
Resolved Date: Oct 24, 2014
Found In Version: 7.0
Fix Version: 7.0
Severity: Standard
Applicable for: Wind River Linux 7
Component/s: Userspace

Description

The lsof package creates a file called version.h that includes these macros that are set based on the development machine's (in my case Ubuntu) environment:
LSOF_CCV - version of Ubuntu's GCC
LSOF_CCFLAGS - flags to Ubuntu GCC
LSOF_HOST - build machine hostname
LSOF_LOGNAME - builder's login name
LSOF_SYSINFO - build machine's info
LSOF_USER - builder's user name

This is invasive since it could build an executable with usernames and/or build machine names in them. At the very least, it makes an unreproducible binary unless the same user on the same host
builds it every time.

Steps to Reproduce

[cxu@pek-lpgtest9 lsof]$ head lsof_4.87_src/version.h
#define	LSOF_BLDCMT	""
#define	LSOF_CC		"x86_64-wrs-linux-gcc -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/buildarea2/cxu/intel-x86-64_std_build_master1013_complete/bitbake_build/tmp/sysroots/intel-x86-64"
#define	LSOF_CCV	"4.4.7 20120313 (Red Hat 4.4.7-3) (GCC) "
Live chat
Online