From f2143b742c590e4e61e3b03543719af4d3edc76c Mon Sep 17 00:00:00 2001 From: Anil Mahtani <929854+Anilm3@users.noreply.github.com> Date: Tue, 5 Nov 2024 20:38:43 +0000 Subject: [PATCH] Fixes: * Create linux_users group with gid=1000 * Create linux_user with uid=1000 * Simplify toolchain and include cmake release * Reinstate checksums and delete unnecessary files --- .../src/docker/apache2-fpm/Dockerfile | 6 +- .../src/docker/apache2-mod/Dockerfile | 6 +- .../src/docker/nginx-fpm/Dockerfile | 6 +- .../integration/src/docker/php/Dockerfile | 3 + .../src/docker/toolchain/CHECKSUMS | 3 +- .../src/docker/toolchain/Dockerfile | 23 +-- .../src/docker/toolchain/Dockerfile.bak | 15 -- .../src/docker/toolchain/Toolchain.cmake | 29 --- .../src/docker/toolchain/ToolchainGCC.cmake | 13 -- .../src/docker/toolchain/alltypes.h.diff | 25 --- .../src/docker/toolchain/glibc_compat.c | 187 ------------------ .../src/docker/toolchain/locale.h.diff | 23 --- .../src/docker/toolchain/wchar.h.diff | 11 -- 13 files changed, 26 insertions(+), 324 deletions(-) delete mode 100644 appsec/tests/integration/src/docker/toolchain/Dockerfile.bak delete mode 100644 appsec/tests/integration/src/docker/toolchain/Toolchain.cmake delete mode 100644 appsec/tests/integration/src/docker/toolchain/ToolchainGCC.cmake delete mode 100644 appsec/tests/integration/src/docker/toolchain/alltypes.h.diff delete mode 100644 appsec/tests/integration/src/docker/toolchain/glibc_compat.c delete mode 100644 appsec/tests/integration/src/docker/toolchain/locale.h.diff delete mode 100644 appsec/tests/integration/src/docker/toolchain/wchar.h.diff diff --git a/appsec/tests/integration/src/docker/apache2-fpm/Dockerfile b/appsec/tests/integration/src/docker/apache2-fpm/Dockerfile index dbf502e566..72fc5b9210 100644 --- a/appsec/tests/integration/src/docker/apache2-fpm/Dockerfile +++ b/appsec/tests/integration/src/docker/apache2-fpm/Dockerfile @@ -3,8 +3,10 @@ ARG VARIANT FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT RUN apt-get update && apt-get install -y \ - apache2 \ - && rm -rf /var/lib/apt/lists/* + apache2 \ + && rm -rf /var/lib/apt/lists/* + +RUN usermod -a -G linux_users www-data RUN rm -rf /var/www/html RUN sed -i '//,/<\/Directory>/s/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf diff --git a/appsec/tests/integration/src/docker/apache2-mod/Dockerfile b/appsec/tests/integration/src/docker/apache2-mod/Dockerfile index 9d9e1ae252..c15985d1fd 100644 --- a/appsec/tests/integration/src/docker/apache2-mod/Dockerfile +++ b/appsec/tests/integration/src/docker/apache2-mod/Dockerfile @@ -3,8 +3,10 @@ ARG VARIANT FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT RUN apt-get update && apt-get install -y \ - apache2 \ - && rm -rf /var/lib/apt/lists/* + apache2 \ + && rm -rf /var/lib/apt/lists/* + +RUN usermod -a -G linux_users www-data RUN rm -rf /var/www/html RUN sed -i 's@/var/www/html@/var/www/public@' /etc/apache2/sites-available/000-default.conf diff --git a/appsec/tests/integration/src/docker/nginx-fpm/Dockerfile b/appsec/tests/integration/src/docker/nginx-fpm/Dockerfile index f9475e2b4e..1c9b1fc67d 100644 --- a/appsec/tests/integration/src/docker/nginx-fpm/Dockerfile +++ b/appsec/tests/integration/src/docker/nginx-fpm/Dockerfile @@ -4,8 +4,10 @@ ARG VARIANT FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT RUN apt-get update && apt-get install -y \ - nginx \ - && rm -rf /var/lib/apt/lists/* + nginx \ + && rm -rf /var/lib/apt/lists/* + +RUN usermod -a -G linux_users www-data RUN rm -rf /var/www/html diff --git a/appsec/tests/integration/src/docker/php/Dockerfile b/appsec/tests/integration/src/docker/php/Dockerfile index e85c7f012b..00900e3ad8 100644 --- a/appsec/tests/integration/src/docker/php/Dockerfile +++ b/appsec/tests/integration/src/docker/php/Dockerfile @@ -35,4 +35,7 @@ ENV CARGO_HOME=/root/.cargo ENV RUSTUP_HOME=/root/.rustup ENV LD_LIBRARY_PATH=/root/php/icu-60/lib +RUN groupadd -g 1000 linux_users && \ + useradd -G linux_users -u 1000 linux_user + ENTRYPOINT ["php"] diff --git a/appsec/tests/integration/src/docker/toolchain/CHECKSUMS b/appsec/tests/integration/src/docker/toolchain/CHECKSUMS index d62c3ab33f..f44d511fd9 100644 --- a/appsec/tests/integration/src/docker/toolchain/CHECKSUMS +++ b/appsec/tests/integration/src/docker/toolchain/CHECKSUMS @@ -1 +1,2 @@ -89a67ebfbbc764cc456e8825ecfa90707741f8835b1b2adffae0b227ab1fe5ca9cce75b0efaffc9ca8431cae528dc54fd838867a56a2b645344d9e82d19ab1b7 llvm-project-16.0.6.src.tar.xz +9591360672ba6192c606404caf70101538728a1cd5d548efcbb952f663f182bd1954d63743ffc9dd18f5c649a62a042c5e36d1ff423634dfd074f672dd1f4af9 cmake-3.28.0-linux-x86_64.tar.gz +48a20095711870b23bd5db342de0e058a7c6876bafad4c6ce9ff9bce672ca1e95ed9ac890d519b0884cd277d091575eda7e60a97cad377ee57c1e20dee25feb1 cmake-3.28.0-linux-aarch64.tar.gz diff --git a/appsec/tests/integration/src/docker/toolchain/Dockerfile b/appsec/tests/integration/src/docker/toolchain/Dockerfile index 4600bec712..4c1cc7d069 100644 --- a/appsec/tests/integration/src/docker/toolchain/Dockerfile +++ b/appsec/tests/integration/src/docker/toolchain/Dockerfile @@ -1,18 +1,13 @@ -FROM debian:latest AS toolchain - -ARG LLVM_VERSION=16.0.6 -ARG ARCH - -COPY Toolchain.cmake /build/Toolchain.cmake -COPY CHECKSUMS /CHECKSUMS - -RUN echo "Building LLVM ${LLVM_VERSION} on ${ARCH}" +FROM debian@sha256:08db48d59c0a91afb802ebafc921be3154e200c452e4d0b19634b426b03e0e25 AS toolchain RUN apt-get update && apt-get install -y \ - build-essential wget cmake binutils lld libncurses5-dev git patchelf xz-utils curl lsb-release wget software-properties-common gnupg + build-essential wget binutils lld libncurses5-dev git patchelf xz-utils curl lsb-release wget software-properties-common gnupg -RUN wget https://apt.llvm.org/llvm.sh && \ - chmod +x llvm.sh && \ - ./llvm.sh 16 all +RUN ln -s /bin/sed /usr/bin/sed +RUN mkdir /build +ADD . /build/ -RUN ln -s /usr/bin/cmake /usr/local/bin/cmake +RUN wget https://github.com/Kitware/CMake/releases/download/v3.28.0/cmake-3.28.0-linux-$(arch | sed s/arm/aarch/).tar.gz && \ + grep -F "cmake-3.28.0-linux-$(arch | sed s/arm/aarch/).tar.gz" ./build/CHECKSUMS | sha512sum --check && \ + tar --strip-components=1 -C /usr/local -xvzf cmake-3.28.0-linux-$(arch | sed s/arm/aarch/).tar.gz && \ + rm cmake-3.28.0-linux-$(arch | sed s/arm/aarch/).tar.gz diff --git a/appsec/tests/integration/src/docker/toolchain/Dockerfile.bak b/appsec/tests/integration/src/docker/toolchain/Dockerfile.bak deleted file mode 100644 index 904a99093e..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/Dockerfile.bak +++ /dev/null @@ -1,15 +0,0 @@ -FROM debian@sha256:e11072c1614c08bf88b543fcfe09d75a0426d90896408e926454e88078274fcb AS toolchain - -ARG LLVM_VERSION=16 -ARG ARCH - -COPY . /build - -RUN echo "Building LLVM ${LLVM_VERSION} on ${ARCH}" - -RUN apt-get update -y && \ - apt-get install -y git wget lsb-release software-properties-common gnupg curl xz-utils make file lld patchelf gcc libgcc-s1 sed autoconf libssl-dev libxml2 cmake - -RUN wget https://apt.llvm.org/llvm.sh && \ - chmod +x llvm.sh && \ - ./llvm.sh ${LLVM_VERSION} all diff --git a/appsec/tests/integration/src/docker/toolchain/Toolchain.cmake b/appsec/tests/integration/src/docker/toolchain/Toolchain.cmake deleted file mode 100644 index b88959a21f..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/Toolchain.cmake +++ /dev/null @@ -1,29 +0,0 @@ -set(CMAKE_SYSTEM_NAME Linux) -execute_process( - COMMAND arch - OUTPUT_VARIABLE ARCHITECTURE - OUTPUT_STRIP_TRAILING_WHITESPACE -) -if(ARCHITECTURE MATCHES "x86_64") - set(ARCH x86_64) -else() - set(ARCH aarch64) -endif() -set(CMAKE_AR /usr/bin/llvm-ar-16) -set(triple ${ARCH}-none-linux-musl) -set(CMAKE_ASM_COMPILER_TARGET ${triple}) -set(CMAKE_C_COMPILER /usr/bin/clang-16) -set(CMAKE_C_COMPILER_TARGET ${triple}) -set(c_cxx_flags "-Qunused-arguments -rtlib=compiler-rt -unwindlib=libunwind -static-libgcc -fno-omit-frame-pointer") -set(CMAKE_C_FLAGS_INIT ${c_cxx_flags}) -set(CMAKE_CXX_COMPILER /usr/bin/clang++-16) -set(CMAKE_CXX_COMPILER_TARGET ${triple}) -set(CMAKE_CXX_FLAGS_INIT "-stdlib=libc++ -isystem/usr/lib/clang/16.0.6/include/c++/v1 ${c_cxx_flags}") -set(CMAKE_EXE_LINKER_FLAGS_INIT "-v -fuse-ld=lld -static -nodefaultlibs -lc++ -lc++abi /usr/lib/clang/16.0.6/lib/linux/libclang_rt.builtins-${ARCH}.a -lunwind -lc /usr/lib/clang/16.0.6/lib/linux/libclang_rt.builtins-${ARCH}.a") -set(CMAKE_SHARED_LINKER_FLAGS_INIT "-v -fuse-ld=lld -nodefaultlibs -Wl,-Bstatic -lc++ -lc++abi /usr/lib/clang/16.0.6/lib/linux/libclang_rt.builtins-${ARCH}.a -lunwind -lglibc_compat -Wl,-Bdynamic /usr/lib/clang/16.0.6/lib/linux/libclang_rt.builtins-${ARCH}.a") -set(CMAKE_C_STANDARD_LIBRARIES "-Wl,-Bdynamic -lc") -set(CMAKE_CXX_STANDARD_LIBRARIES "-Wl,-Bdynamic -lc") - -set(CMAKE_NM /usr/bin/llvm-nm-16) -set(CMAKE_RANLIB /usr/bin/llvm-ranlib-16) -set(CMAKE_STRIP /usr/bin/strip) # llvm-strip doesn't seem to work correctly diff --git a/appsec/tests/integration/src/docker/toolchain/ToolchainGCC.cmake b/appsec/tests/integration/src/docker/toolchain/ToolchainGCC.cmake deleted file mode 100644 index f5a442e915..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/ToolchainGCC.cmake +++ /dev/null @@ -1,13 +0,0 @@ -set(target x86_64-none-linux-gnu) -set(tool_prefix "") -set(CMAKE_SYSROOT /) -set(CMAKE_AR ${tool_prefix}ar) -set(CMAKE_ASM_COMPILER_TARGET ${target}) -set(CMAKE_C_COMPILER ${tool_prefix}gcc) -set(CMAKE_C_COMPILER_TARGET ${target}) -set(CMAKE_C_COMPILER_EXTERNAL_TOOLCHAIN /usr) -set(CMAKE_CXX_COMPILER ${tool_prefix}g++) -set(CMAKE_CXX_COMPILER_TARGET ${target}) -set(CMAKE_CXX_COMPILER_EXTERNAL_TOOLCHAIN /usr) -set(CMAKE_NM ${tool_prefix}nm) -set(CMAKE_RANLIB ${tool_prefix}ranlib) diff --git a/appsec/tests/integration/src/docker/toolchain/alltypes.h.diff b/appsec/tests/integration/src/docker/toolchain/alltypes.h.diff deleted file mode 100644 index daa64e502d..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/alltypes.h.diff +++ /dev/null @@ -1,25 +0,0 @@ ---- bits/alltypes.h 2023-11-06 11:49:18.000000000 +0000 -+++ bits/alltypes.h 2024-04-22 09:30:09.927560000 +0000 -@@ -383,12 +383,20 @@ - - - #if defined(__NEED_pthread_attr_t) && !defined(__DEFINED_pthread_attr_t) --typedef struct { union { int __i[sizeof(long)==8?14:9]; volatile int __vi[sizeof(long)==8?14:9]; unsigned long __s[sizeof(long)==8?7:9]; } __u; } pthread_attr_t; -+typedef struct { union { int __i[sizeof(long)==8?14:9]; volatile int __vi[sizeof(long)==8?14:9]; unsigned long __s[sizeof(long)==8?7:9]; -+#ifdef __aarch64__ -+ char __glibc_compat[64]; -+#endif -+} __u; } pthread_attr_t; - #define __DEFINED_pthread_attr_t - #endif - - #if defined(__NEED_pthread_mutex_t) && !defined(__DEFINED_pthread_mutex_t) --typedef struct { union { int __i[sizeof(long)==8?10:6]; volatile int __vi[sizeof(long)==8?10:6]; volatile void *volatile __p[sizeof(long)==8?5:6]; } __u; } pthread_mutex_t; -+typedef struct { union { int __i[sizeof(long)==8?10:6]; volatile int __vi[sizeof(long)==8?10:6]; volatile void *volatile __p[sizeof(long)==8?5:6]; -+#ifdef __aarch64__ -+ char __glibc_compat[48]; -+#endif -+} __u; } pthread_mutex_t; - #define __DEFINED_pthread_mutex_t - #endif - diff --git a/appsec/tests/integration/src/docker/toolchain/glibc_compat.c b/appsec/tests/integration/src/docker/toolchain/glibc_compat.c deleted file mode 100644 index 68d5e1f978..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/glibc_compat.c +++ /dev/null @@ -1,187 +0,0 @@ -#include -#include -#include -#include -#include -#include - -#if defined(__linux__) && !defined(__GLIBC__) - -# ifdef __x86_64__ -float ceilf(float x) -{ - float result; - // NOLINTNEXTLINE(hicpp-no-assembler) - __asm__("roundss $0x0A, %[x], %[result]" - : [result] "=x"(result) - : [x] "x"(x)); - return result; -} -double ceil(double x) -{ - double result; - // NOLINTNEXTLINE(hicpp-no-assembler) - __asm__("roundsd $0x0A, %[x], %[result]" - : [result] "=x"(result) - : [x] "x"(x)); - return result; -} -# endif - -# ifdef __aarch64__ -float ceilf(float x) -{ - float result; - __asm__("frintp %s0, %s1\n" : "=w"(result) : "w"(x)); - return result; -} -double ceil(double x) -{ - double result; - __asm__("frintp %d0, %d1\n" : "=w"(result) : "w"(x)); - return result; -} -# endif - -# ifdef __aarch64__ -# define _STAT_VER 0 -# else -# define _STAT_VER 1 -# endif - -// glibc before 2.33 (2021) doesn't have these -int stat(const char *restrict path, void *restrict buf) -{ - int __xstat(int, const char *restrict, void *restrict); - return __xstat(_STAT_VER, path, buf); -} - -int fstat(int fd, void *buf) -{ - int __fxstat(int, int, void *); - return __fxstat(_STAT_VER, fd, buf); -} - -int lstat(const char *restrict path, void *restrict buf) -{ - int __lxstat(int, const char *restrict, void *restrict); - return __lxstat(_STAT_VER, path, buf); -} - -// glibc doesn't define pthread_atfork on aarch64. We need to delegate to -// glibc's __register_atfork() instead. __register_atfork() takes an extra -// argument, __dso_handle, which is a pointer to the DSO that is registering the -// fork handlers. This is used to ensure that the handlers are not called after -// the DSO is unloaded. glibc on amd64 also implements pthread_atfork() in terms -// of __register_atfork(). (musl never unloads modules so that potential -// problem doesn't exist) - -// On amd64, even though pthread_atfork is exported by glibc, it should not be -// used. Code that uses pthread_atfork will compile to an import to -// __register_atfork(), but here we're compiling against musl, resulting in an -// an import to pthread_atfork. This will cause a runtime error after the test -// that unloads our module. The reason is that when we call pthread_atfork in -// glibc, __register_atfork() is called with the __dso_handle of libc6.so, not -// the __dso_handle of our module. So the fork handler is not unregistered when -// our module is unloaded. - -extern void *__dso_handle __attribute__((weak)); -int __register_atfork(void (*prepare)(void), void (*parent)(void), - void (*child)(void), void *__dso_handle) __attribute__((weak)); - -int pthread_atfork( - void (*prepare)(void), void (*parent)(void), void (*child)(void)) -{ - // glibc - if (__dso_handle && __register_atfork) { - return __register_atfork(prepare, parent, child, __dso_handle); - } - - static int (*real_atfork)(void (*)(void), void (*)(void), void (*)(void)); - - if (!real_atfork) { - // dlopen musl -# ifdef __aarch64__ - void *handle = dlopen("ld-musl-aarch64.so.1", RTLD_LAZY); - if (!handle) { - (void)fprintf( - // NOLINTNEXTLINE(concurrency-mt-unsafe) - stderr, "dlopen of ld-musl-aarch64.so.1 failed: %s\n", - dlerror()); - abort(); - } -# else - void *handle = dlopen("libc.musl-x86_64.so.1", RTLD_LAZY); - if (!handle) { - (void)fprintf( - // NOLINTNEXTLINE(concurrency-mt-unsafe) - stderr, "dlopen of libc.musl-x86_64.so.1 failed: %s\n", - dlerror()); - abort(); - } -# endif - real_atfork = dlsym(handle, "pthread_atfork"); - if (!real_atfork) { - (void)fprintf( - // NOLINTNEXTLINE(concurrency-mt-unsafe) - stderr, "dlsym of pthread_atfork failed: %s\n", dlerror()); - abort(); - } - } - - return real_atfork(prepare, parent, child); -} - -// the symbol strerror_r in glibc is not the POSIX version; it returns char * -// __xpg_sterror_r is exported by both glibc and musl -int strerror_r(int errnum, char *buf, size_t buflen) -{ - int __xpg_strerror_r(int, char *, size_t); - return __xpg_strerror_r(errnum, buf, buflen); -} - -// when compiling with --coverage, some references to atexit show up. -// glibc doesn't provide atexit for similar reasons as pthread_atfork presumably -int __cxa_atexit(void (*func)(void *), void *arg, void *dso_handle); -int atexit(void (*function)(void)) -{ - if (!__dso_handle) { - (void)fprintf(stderr, "Aborting because __dso_handle is NULL\n"); - abort(); - } - - // the cast is harmless on amd64 and aarch64. Passing an extra argument to a - // function that expects none causes no problems - return __cxa_atexit((void (*)(void *))function, 0, __dso_handle); -} - -// introduced in glibc 2.25 -ssize_t getrandom(void *buf, size_t buflen, unsigned int flags) { - // SYS_getrandom is 318 (amd64) or 278 (aarch64) - // This was only added in Linux 3.17 (2014), so don't use it - // return syscall(SYS_getrandom, buf, buflen, flags); - int fd; - size_t bytes_read = 0; - - fd = open("/dev/urandom", O_RDONLY); - if (fd < 0) { - return -1; - } - - while (bytes_read < buflen) { - ssize_t result = read(fd, (char*)buf + bytes_read, buflen - bytes_read); - if (result < 0) { - if (errno == EINTR) { - continue; - } - close(fd); - return -1; - } - bytes_read += result; - } - - close(fd); - return (ssize_t)bytes_read; -} - -#endif diff --git a/appsec/tests/integration/src/docker/toolchain/locale.h.diff b/appsec/tests/integration/src/docker/toolchain/locale.h.diff deleted file mode 100644 index 52d046665a..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/locale.h.diff +++ /dev/null @@ -1,23 +0,0 @@ ---- /usr/include/locale.h -+++ /usr/include/locale.h -@@ -157,19 +157,7 @@ - # define LC_TELEPHONE_MASK (1 << __LC_TELEPHONE) - # define LC_MEASUREMENT_MASK (1 << __LC_MEASUREMENT) - # define LC_IDENTIFICATION_MASK (1 << __LC_IDENTIFICATION) --# define LC_ALL_MASK (LC_CTYPE_MASK \ -- | LC_NUMERIC_MASK \ -- | LC_TIME_MASK \ -- | LC_COLLATE_MASK \ -- | LC_MONETARY_MASK \ -- | LC_MESSAGES_MASK \ -- | LC_PAPER_MASK \ -- | LC_NAME_MASK \ -- | LC_ADDRESS_MASK \ -- | LC_TELEPHONE_MASK \ -- | LC_MEASUREMENT_MASK \ -- | LC_IDENTIFICATION_MASK \ -- ) -+# define LC_ALL_MASK 0x1fbf - - /* Return a duplicate of the set of locale in DATASET. All usage - counters are increased if necessary. */ diff --git a/appsec/tests/integration/src/docker/toolchain/wchar.h.diff b/appsec/tests/integration/src/docker/toolchain/wchar.h.diff deleted file mode 100644 index 60dc2a04d5..0000000000 --- a/appsec/tests/integration/src/docker/toolchain/wchar.h.diff +++ /dev/null @@ -1,11 +0,0 @@ ---- /usr/include/wchar.h 2024-10-31 15:25:55.995768004 +0000 -+++ /usr/include/wchar.h.fix 2024-10-31 15:25:35.478137009 +0000 -@@ -485,7 +485,7 @@ - int __base, locale_t __loc) __THROW; - - __extension__ --extern unsigned long long int wcstoull_l (const wchar_t *__restrict __nptr, -+extern long long wcstoull_l (const wchar_t *__restrict __nptr, - wchar_t **__restrict __endptr, - int __base, locale_t __loc) - __THROW;