2021-11-16 09:59:41 +00:00
|
|
|
---
|
|
|
|
|
inspections:
|
|
|
|
|
# xml files shipped are GDB register set descriptions which can only be
|
|
|
|
|
# verified with gdb/features/gdb-target.dtd, provided in GDB sources.
|
|
|
|
|
xml: off
|
|
|
|
|
|
|
|
|
|
annocheck:
|
2021-11-19 13:24:49 +00:00
|
|
|
# Currently lto is disabled globally for valgrind, it should be able
|
|
|
|
|
# to be enabled through upstream configure --enable-lto in the future.
|
2022-04-19 16:52:08 +00:00
|
|
|
# Note that all (default hardened) flags need to be repeated here, if
|
2021-11-19 13:24:49 +00:00
|
|
|
# you override some config flags it will completely overwrite the
|
|
|
|
|
# defaults (--ignore-unknown --verbose).
|
2022-04-12 15:07:11 +00:00
|
|
|
jobs:
|
|
|
|
|
- hardened: --ignore-unknown --verbose --skip-lto
|
2021-11-16 09:59:41 +00:00
|
|
|
# Ignore files built specially without hardening flags
|
|
|
|
|
ignore:
|
|
|
|
|
# Valgrind tools themselves (memcheck, cachegrind, massif, etc) are
|
|
|
|
|
# statically linked and need to be built without PIE to be loaded at
|
|
|
|
|
# a fixed address in the program's address space.
|
|
|
|
|
# Also need to be built without stack protection so the generated
|
|
|
|
|
# code (valgrind VEX jit) interacts correctly with their own static code.
|
|
|
|
|
- /usr/libexec/valgrind/*-*-linux
|
|
|
|
|
# Wrappers for various string and mem functions such as memcpy, strlen, etc
|
|
|
|
|
# that valgrind uses to keep track of memory usage. Hardening settings such
|
|
|
|
|
# as optimizations need to be disabled so they don't interfere or break
|
|
|
|
|
# the checks that valgrind does internally.
|
|
|
|
|
- /usr/libexec/valgrind/vgpreload*so
|
|
|
|
|
# libmpiwrap is special since it is a LD_PRELOAD wrapper used by valgrind
|
|
|
|
|
# memcheck for MPI using programs, the wrapper is against a specific MPI
|
|
|
|
|
# implementation though, in our case openmpi. We don't want to have a hard
|
|
|
|
|
# dependency on openmpi however, so a user can use the wrapper without
|
|
|
|
|
# explicitly pulling in openmpi unless the program explicitly uses it.
|
|
|
|
|
- /usr/lib*/openmpi/valgrind/libmpiwrap-*-linux.so
|
2021-11-19 13:24:49 +00:00
|
|
|
# These static archives (to create custom valgrind tools) are only
|
|
|
|
|
# distributed in valgrind-tools-devel and don't have hardening flags
|
|
|
|
|
# for the same reason as the standard tools (see above).
|
|
|
|
|
- /usr/lib*/valgrind/*-*linux.a
|
2021-11-16 09:59:41 +00:00
|
|
|
|
|
|
|
|
runpath:
|
|
|
|
|
allowed_paths:
|
|
|
|
|
# As described above, libmpiwrap is a wrapper against openmpi
|
|
|
|
|
# so we set DT_RUNPATH to openmpi libs path
|
|
|
|
|
- /usr/lib/openmpi/lib
|
|
|
|
|
- /usr/lib64/openmpi/lib
|
