RE: [gentoo-security] Do I need to rebuild things after upgrading ssl?

[Simon Reynolds]

On Fri, 2004-03-19 at 12:40, Joel Osburn wrote:
> Hence the discussion yesterday in this thread.  Jeremy Huddleston
> suggested doing "readelf -s <exec> | grep <symbol>".  I'm no guru, and
> don't totally understand what a file containing any given symbol means,
> but if this command does indeed show if a file was statically compiled
> against a given library, then there are a lot of things that need to be
> recompiled.  Put it in a little script and run it against my /usr/bin/
> shows such files as ftp, links2, mutt, ssh, and wget.  That doesn't
> sound right to me, but... how can I prove it one way or the other?

FYI: if the symbol appears in the ELF file, and it was dynamically
linked to libssl, you probably don't need to worry about it.

Keeping track of statically compiled dependencies through portage is a
good idea, in the mean time here's a simple script to search your
system:
Warning! This takes a while to run, 15 min. on my system. It is not
guaranteed to be exhaustive, and it may fry your hard drive. On my
system, it returned three false positives. 


#!/bin/bash

# I probably should have had this only check binaries coming from
# packages which depend on ssl, but I wanted to be sure

for d in /bin /lib /sbin /usr/bin /usr/lib /usr/libexec /usr/sbin \
/usr/X11R6/bin /usr/X11R6/lib /usr/games/bin /usr/games/bin /opt
do
    for i in `find $d -type f -perm +0111`
    do
        file $i | grep ELF >/dev/null || continue
        ldd $i | grep libssl >/dev/null && continue
        readelf -s $i | grep " SSL_" >/dev/null || continue
        echo $i
    done
done


--
gentoo-security@g.o mailing list