From 1bb89e5d6e9d883a27d3b21a9212cdeacfe03887 Mon Sep 17 00:00:00 2001 From: Martin Osvald Date: Mon, 27 Jul 2026 09:07:09 +0200 Subject: [PATCH] Add rpminspect.yaml to ignore inet_aton() and inet_ntoa() Related: RHEL-94932 --- rpminspect.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..9e015b1 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,13 @@ +--- +badfuncs: + allowed: +# This is a rpminspect false positive. Both functions are deprecated in favor of inet_pton/inet_ntop, +# but there is no exploitable security issue in dhcpcd's specific usage: +# - inet_aton() only parses trusted admin config; error returns are checked. +# - inet_ntoa() is used in a single-threaded context with no double-evaluation in any single format call. +# Fixing it would require patching ~40 call sites in the upstream source to use inet_ntop(AF_INET, ...) +# with a local buffer, which is a cosmetic/correctness improvement, not a security fix. + /usr/sbin/dhcpcd: + - inet_aton + - inet_ntoa +