Hi Matheus, On Thu, 2024-04-04 at 16:56 -0300, Matheus Tavares Bernardino wrote: > BTW, just out of curiosity, since the last incident with xz's backdoor > (which apparently involved malicious code disguised as a test binary), > has the elfutils community already considered using something like > Dockerfiles to generate the tests/*.ko.bz2 binaries instead of checking > than in the git repo? Just something that crossed my mind while I was > developing these patches.
Good question. Especially since I have been poking backend developers to add more of them... I think the honest question is, no we haven't considered, or even discussed, getting rid of them. So lets :) In the xz-backdoor case it was actually hidden in a test binary which wasn't actually used in the testsuite. So that is certainly something to watch out for. Does someone add a binary file for no good reason? Also this seems to be a somewhat sophisticated hack and the would probably found some other way to hide something. But you are right of course that hiding something is much easier in a binary file. So it is reasonable to ask what the alternatives are. We do actually have native testcases. So we could just rely on those. But it is really helpful to see if the code works cross-32/64 bit and cross-endian. Because one of the advantages of elfutils is that you can inspect and manipulate binaries from other arches. Another might be what bzip2 does, have all these binaries in a separate test git repo https://sourceware.org/cgit/bzip2-tests/tree/README But that kind of just moves the issue. We would encourage people to always check out that repo and run all tests in it. Another would be what you suggest. Create containers for all arches supported and (re)generate all test binaries in that container. But that would be a lot of containers and for some arches you like to have different versions of the tools to generate them. And can that be done for all arches? e.g. Does hexagon have qemu support? One advantage of this might be that you could just rely on the native tests. Assuming we add them all to builder.sourceware.org and run them on each commit. Finally we might want to only create binary files from some easily understood textual representation. Maybe using GNU Poke ELF pickles? https://jemarch.net/poke-elf-1.0-manual/poke-elf.html That sounds really attractive, but it would be a lot of work recreating the existing binary test files. And nobody has tried yet, so we don't know if this (or some other tool) is expressive enough. Cheers, Mark
