Add rpminspect.yaml to ignore inet_aton() and inet_ntoa()
Related: RHEL-94932
This commit is contained in:
parent
476431d1b1
commit
1bb89e5d6e
13
rpminspect.yaml
Normal file
13
rpminspect.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
---
|
||||
badfuncs:
|
||||
allowed:
|
||||
# This is a rpminspect false positive. Both functions are deprecated in favor of inet_pton/inet_ntop,
|
||||
# but there is no exploitable security issue in dhcpcd's specific usage:
|
||||
# - inet_aton() only parses trusted admin config; error returns are checked.
|
||||
# - inet_ntoa() is used in a single-threaded context with no double-evaluation in any single format call.
|
||||
# Fixing it would require patching ~40 call sites in the upstream source to use inet_ntop(AF_INET, ...)
|
||||
# with a local buffer, which is a cosmetic/correctness improvement, not a security fix.
|
||||
/usr/sbin/dhcpcd:
|
||||
- inet_aton
|
||||
- inet_ntoa
|
||||
|
||||
Loading…
Reference in New Issue
Block a user