Add rpminspect.yaml to ignore inet_aton() and inet_ntoa()

Related: RHEL-94932
This commit is contained in:
Martin Osvald 2026-07-27 09:07:09 +02:00
parent 476431d1b1
commit 1bb89e5d6e

13
rpminspect.yaml Normal file
View File

@ -0,0 +1,13 @@
---
badfuncs:
allowed:
# This is a rpminspect false positive. Both functions are deprecated in favor of inet_pton/inet_ntop,
# but there is no exploitable security issue in dhcpcd's specific usage:
# - inet_aton() only parses trusted admin config; error returns are checked.
# - inet_ntoa() is used in a single-threaded context with no double-evaluation in any single format call.
# Fixing it would require patching ~40 call sites in the upstream source to use inet_ntop(AF_INET, ...)
# with a local buffer, which is a cosmetic/correctness improvement, not a security fix.
/usr/sbin/dhcpcd:
- inet_aton
- inet_ntoa