Re: [gentoo-hardened] ET_EXEC binaries after emerge -e world

[Ned Ludd]

On Wed, 2005-05-11 at 10:32 +0100, Pedro Venda wrote:
> On Tuesday 10 May 2005 13:24, Ned Ludd wrote:
> > On Tue, 2005-05-10 at 11:24 +0100, Pedro Venda wrote:
> > > On Tuesday 10 May 2005 11:12, kakou wrote:
> > > > Pedro Venda wrote:
> > > > >hi everyone,
> > > > >
> > > > >I've started using hardened for a couple of weeks now. I've done an
> > > >
> > > > emerge -e
> > > >
> > > > >world and there are still 134 ET_EXEC binaries left, including for
> > > > > example dhcpd.
> > > >
> > > > How do you count ET_EXEC binaries left ?
> > >
> > > scanelf -aR / | grep ET_EXEC | wc -l
> > >
> > > > >Shouldn't be 0 ET_EXEC binaries left after world recompilation? or
> > > > > could
> >
> > There will never be 0. A few things really need to be ET_EXEC. Any
> > static binary for example will be ET_EXEC and pretty much all the glibc
> > (ldconfig/localedef)
> >
> > Better for you todo a scanelf -pR |grep ET_EXEC
> >
> > scanelf -Rp|grep ET_EXEC| awk '{print $2}'| xargs file|grep -v
> > "statically linked"|cut -d : -f 1| xargs qfile
> >
> > qfile comes from here and I'll add it to the tree soon.
> > http://dev.gentoo.org/~solar/portage_misc/qfile.c
>
> 183 binaries left.
>
> qfile does something like qpkg -f $file right?

Yes that's more or less all qfile does, few options (-nc|-C) = nocolor,
there is an -e option to print out exact matches of CAT/PF vs CAT/PN.
Lacks --help/man page..

As of the most recent gentoolkit the qpkg tool has been deprecated in
favor of equery. qpkg went unmaintained and genone asserted it was
flawed. equery uses a python backend and takes about 15-20 seconds just
to initialize. That drove me nuts hence qfile.

Had I suggested the equery command at 20 second runtime multiplied by
that 183 packages.. (picture nightmare). 
The same command using qfile saves 61 mins of your life.

-- 
Ned Ludd <solar@g.o>

-- 
gentoo-hardened@g.o mailing list