.gitignore

@@ -1 +1 @@
-SOURCES/bcc-0.25.0.tar.gz
+SOURCES/bcc-0.25.0.tar.gz

SOURCES/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch

@@ -1,33 +0,0 @@
-From 509b05f2790fd1f9e725e353521a5a555ca57aaf Mon Sep 17 00:00:00 2001
-From: Chunsheng Luo <48231204+luochenglcs@users.noreply.github.com>
-Date: Mon, 18 Mar 2024 00:09:21 +0800
-Subject: [PATCH] clang: Fix file_exists_and_ownedby return value (#4935)
-
-commit 008ea09 (clang: check header ownership) updates file_exists()
-to file_exists_and_ownedby(), add verifies onwer, but the return value
-is different from before, causing problems with the original code.
-
-Signed-off-by: Chunsheng Luo <luochunsheng@ustc.edu>
-Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
----
- src/cc/frontends/clang/kbuild_helper.cc | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
-index 1b291469..0387f872 100644
---- a/src/cc/frontends/clang/kbuild_helper.cc
-+++ b/src/cc/frontends/clang/kbuild_helper.cc
-@@ -143,8 +143,8 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
- static inline int file_exists_and_ownedby(const char *f, uid_t uid)
- {
-   struct stat buffer;
--  int ret;
--  if ((ret = stat(f, &buffer)) == 0) {
-+  int ret = stat(f, &buffer) == 0;
-+  if (ret) {
-     if (buffer.st_uid != uid) {
-       std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
-       return -1;
--- 
-2.44.0
-

SOURCES/bcc-0.25.0-clang-check-header-ownership-4928.patch

@@ -1,68 +0,0 @@
-From d6a5130c5f18499da26eef88f52da75c9e33d63d Mon Sep 17 00:00:00 2001
-From: Brendan Gregg <brendan@intel.com>
-Date: Thu, 7 Mar 2024 05:27:14 +1100
-Subject: [PATCH] clang: check header ownership (#4928)
-
-Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message):
-
-~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop
-ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal
-<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
-#include "./include/linux/kconfig.h"
-         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
-1 error generated.
-Traceback (most recent call last):
-  File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
-    b = BPF(text=bpf_text)
-  File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__
-Exception: Failed to compile BPF module <text>
-~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal
-drwxrwxr-x 2 brendan dev 4.0K Mar  6 02:50 /tmp/kheaders-5.15.47-internal
-
-No error when chown'd back to root.
----
- src/cc/frontends/clang/kbuild_helper.cc | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
-index 933aec8e..1b291469 100644
---- a/src/cc/frontends/clang/kbuild_helper.cc
-+++ b/src/cc/frontends/clang/kbuild_helper.cc
-@@ -140,15 +140,22 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
-   return 0;
- }
- 
--static inline int file_exists(const char *f)
-+static inline int file_exists_and_ownedby(const char *f, uid_t uid)
- {
-   struct stat buffer;
--  return (stat(f, &buffer) == 0);
-+  int ret;
-+  if ((ret = stat(f, &buffer)) == 0) {
-+    if (buffer.st_uid != uid) {
-+      std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
-+      return -1;
-+    }
-+  }
-+  return ret;
- }
- 
- static inline int proc_kheaders_exists(void)
- {
--  return file_exists(PROC_KHEADERS_PATH);
-+  return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
- }
- 
- static inline int extract_kheaders(const std::string &dirpath,
-@@ -214,7 +221,7 @@ int get_proc_kheaders(std::string &dirpath)
-   snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
-   dirpath = std::string(dirpath_tmp);
- 
--  if (file_exists(dirpath_tmp))
-+  if (file_exists_and_ownedby(dirpath_tmp, 0))
-     return 0;
- 
-   // First time so extract it
--- 
-2.43.2
-

SOURCES/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch

@@ -1,76 +0,0 @@
-From 1d504ac46d2a0210813147b6a57d657b6c2a5d2e Mon Sep 17 00:00:00 2001
-From: Jerome Marchand <jmarchan@redhat.com>
-Date: Fri, 17 May 2024 15:36:07 +0200
-Subject: [PATCH] clang: fail when the kheaders ownership is wrong (#4928)
- (#4985)
-
-file_exists_and_ownedby() returns -1 when the file exists but its
-ownership is unexpected, which is very misleading since anything non
-zero is interpreted as true and a function with such a name is
-expected to return a boolean. So currently all this does, is write a
-warning message, and continues as if nothing is wrong.
-
-Make file_exists_and_ownedby() returns false when the ownership is
-wrong and have get_proc_kheaders() fails when this happen. Also have
-all the *exists* functions return bool to avoid such issues in the
-future.
-
-Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
----
- src/cc/frontends/clang/kbuild_helper.cc | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
-index 0387f872..9dd3c3c8 100644
---- a/src/cc/frontends/clang/kbuild_helper.cc
-+++ b/src/cc/frontends/clang/kbuild_helper.cc
-@@ -140,20 +140,26 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
-   return 0;
- }
- 
--static inline int file_exists_and_ownedby(const char *f, uid_t uid)
-+static inline bool file_exists(const char *f)
-+{
-+  struct stat buffer;
-+  return (stat(f, &buffer) == 0);
-+}
-+
-+static inline bool file_exists_and_ownedby(const char *f, uid_t uid)
- {
-   struct stat buffer;
-   int ret = stat(f, &buffer) == 0;
-   if (ret) {
-     if (buffer.st_uid != uid) {
-       std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
--      return -1;
-+      return false;
-     }
-   }
-   return ret;
- }
- 
--static inline int proc_kheaders_exists(void)
-+static inline bool proc_kheaders_exists(void)
- {
-   return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
- }
-@@ -221,8 +227,14 @@ int get_proc_kheaders(std::string &dirpath)
-   snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
-   dirpath = std::string(dirpath_tmp);
- 
--  if (file_exists_and_ownedby(dirpath_tmp, 0))
--    return 0;
-+  if (file_exists(dirpath_tmp)) {
-+    if (file_exists_and_ownedby(dirpath_tmp, 0))
-+      return 0;
-+    else
-+      // The path exists, but is owned by a non-root user
-+      // Something fishy is going on
-+      return -EEXIST;
-+  }
- 
-   // First time so extract it
-   return extract_kheaders(dirpath, uname_data);
--- 
-2.44.0
-

SPECS/bcc.spec

@@ -9,7 +9,7 @@
 
 Name:           bcc
 Version:        0.25.0
-Release:        9%{?dist}
+Release:        7%{?dist}
 Summary:        BPF Compiler Collection (BCC)
 License:        ASL 2.0
 URL:            https://github.com/iovisor/bcc
@@ -29,9 +29,7 @@ Patch11:        %{name}-%{version}-Fix-a-llvm-compilation-error.patch
 Patch12:        %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch
 Patch13:        %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch
 Patch14:        %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch
-Patch15:        %{name}-%{version}-clang-check-header-ownership-4928.patch
+
-Patch16:        %{name}-%{version}-clang-Fix-file_exists_and_ownedby-return-value-4935.patch
-Patch17:        %{name}-%{version}-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
 
 # Arches will be included as upstream support is added and dependencies are
 # satisfied in the respective arches
@@ -229,12 +227,6 @@ done
 
 
 %changelog
-* Tue May 28 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-9
-- Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314)
-
-* Tue Mar 12 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-8
-- Check header ownership (RHEL-28768)
-
 * Wed Nov 08 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-7
 - Fix repo URL in tests.yml