Makefile.am | 18 ++++++++++++-
configure.ac | 3 +-
ldap/admin/src/scripts/start-dirsrv.in | 25 ++++++++++++------
rpm/389-ds-base.spec.in | 41 +++++++++++++++++++++++++++---
wrappers/systemd.template.asan.service.in | 35 +++++++++++++++++++++++++
5 files changed, 108 insertions(+), 14 deletions(-)
New commits:
commit c9e49213f816ddef19bc0bda8727ddf5576f7368
Author: William Brown <firstyear(a)redhat.com>
Date: Thu Apr 28 14:35:42 2016 +1000
Ticket 48350 - Integrate ASAN into our rpm build process
Bug Description: To improve our QE, we need to be more aggresive during our
tests in QE for detecting issues.
Fix Description: This improves our ASAN integration with our rpms and systemd.
This way, we can give ASAN builds to QE for testing, and we can produce
non-instrumented builds for production releases.
Note that if you run ./configure --enable-asan; make rpms, this will create
an ASAN instrumented RPM.
https://fedorahosted.org/389/ticket/48350
Author: wibrown
Review by: nhosoi (Thanks!)
diff --git a/Makefile.am b/Makefile.am
index 0e9939a..e715fba 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -26,6 +26,12 @@ NUNC_STANS_ON = 0
endif
DS_INCLUDES = -I$(srcdir)/ldap/include -I$(srcdir)/ldap/servers/slapd -I$(srcdir)/include
-I. $(NUNC_STANS_INCLUDES)
+if enable_asan
+ASAN_ON = 1
+else
+ASAN_ON = 0
+endif
+
# these paths are dependent on the settings of prefix and exec_prefix which may be
specified
# at make time. So we cannot use AC_DEFINE in the configure.ac because that would set
the
# values prior to their being defined. Defining them here ensures that they are
properly
@@ -1797,6 +1803,7 @@ fixupcmd = sed \
-e 's,@enable_autobind\@,$(enable_autobind),g' \
-e 's,@enable_auto_dn_suffix\@,$(enable_auto_dn_suffix),g' \
-e 's,@enable_presence\@,$(enable_presence),g' \
+ -e 's,@enable_asan\@,$(ASAN_ON),g' \
-e 's,@ECHO_N\@,$(ECHO_N),g' \
-e 's,@ECHO_C\@,$(ECHO_C),g' \
-e 's,@brand\@,$(brand),g' \
@@ -1864,6 +1871,7 @@ fixupcmd = sed \
-e 's,@enable_autobind\@,$(enable_autobind),g' \
-e 's,@enable_auto_dn_suffix\@,$(enable_auto_dn_suffix),g' \
-e 's,@enable_presence\@,$(enable_presence),g' \
+ -e 's,@enable_asan\@,$(ASAN_ON),g' \
-e 's,@ECHO_N\@,$(ECHO_N),g' \
-e 's,@ECHO_C\@,$(ECHO_C),g' \
-e 's,@brand\@,$(brand),g' \
@@ -1925,10 +1933,18 @@ endif
if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
$(fixupcmd) $^ > $@
+
+if enable_asan
+# yes, that is an @ in the filename . . .
+%/$(PACKAGE_NAME)@.service: %/systemd.template.asan.service.in
+ if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
+ $(fixupcmd) $^ > $@
+else
# yes, that is an @ in the filename . . .
%/$(PACKAGE_NAME)@.service: %/systemd.template.service.in
if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
$(fixupcmd) $^ > $@
+endif
%/$(PACKAGE_NAME).systemd: %/systemd.template.sysconfig
if [ ! -d $(dir $@) ] ; then mkdir -p $(dir $@) ; fi
@@ -1974,7 +1990,7 @@ rpmbrprep: dist-bzip2 rpmroot
cp $(distdir).tar.bz2 $(RPMBUILD)/SOURCES
cp $(srcdir)/rpm/389-ds-base-git.sh $(RPMBUILD)/SOURCES
cp $(srcdir)/rpm/389-ds-base-devel.README $(RPMBUILD)/SOURCES
- sed -e "s/__VERSION__/$(RPM_VERSION)/" -e
"s/__RELEASE__/$(RPM_RELEASE)/" -e
"s/__NUNC_STANS_ON__/$(NUNC_STANS_ON)/" <
$(abs_builddir)/rpm/389-ds-base.spec > $(RPMBUILD)/SPECS/389-ds-base.spec
+ sed -e "s/__VERSION__/$(RPM_VERSION)/" -e
"s/__RELEASE__/$(RPM_RELEASE)/" -e
"s/__NUNC_STANS_ON__/$(NUNC_STANS_ON)/" -e "s/__ASAN_ON__/$(ASAN_ON)/"
< $(abs_builddir)/rpm/389-ds-base.spec > $(RPMBUILD)/SPECS/389-ds-base.spec
# Requires rpmdevtools. Consider making this a dependancy of rpms.
rpmsources: rpmbrprep
diff --git a/configure.ac b/configure.ac
index 9544bbc..85e99f0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -69,7 +69,7 @@ AC_MSG_CHECKING(for --enable-debug)
AC_ARG_ENABLE(debug, AS_HELP_STRING([--enable-debug], [Enable debug features (default:
no)]),
[
AC_MSG_RESULT(yes)
- debug_defs="-g3 -DDEBUG -DMCC_DEBUG"
+ debug_defs="-g3 -DDEBUG -DMCC_DEBUG -O0"
],
[
AC_MSG_RESULT(no)
@@ -88,6 +88,7 @@ AC_ARG_ENABLE(asan, AS_HELP_STRING([--enable-asan], [Enable gcc address
sanitize
asan_defs=""
])
AC_SUBST([asan_defs])
+AM_CONDITIONAL(enable_asan,test "$enable_asan" = "yes")
AM_CONDITIONAL([RPM_HARDEND_CC], [test -f /usr/lib/rpm/redhat/redhat-hardened-cc1])
AC_MSG_CHECKING(for --enable-gcc-security)
diff --git a/ldap/admin/src/scripts/start-dirsrv.in
b/ldap/admin/src/scripts/start-dirsrv.in
index 4bc0ba2..410786b 100755
--- a/ldap/admin/src/scripts/start-dirsrv.in
+++ b/ldap/admin/src/scripts/start-dirsrv.in
@@ -60,6 +60,14 @@ start_instance() {
return 1
fi
else
+ if test 1 -eq @enable_asan@; then
+ echo "NOTICE: Starting instance ${SERV_ID} with ASAN options."
+ echo "This is probably not what you want. Please contact support."
+ : ${ASAN_LOG_PATH:=$RUN_DIR/ns-slapd-${SERV_ID}.asan}
+ echo "Asan errors will go to ${ASAN_LOG_PATH}*"
+ export ASAN_OPTIONS="detect_leaks=1 symbolize=1 detect_deadlocks=1
log_path=${ASAN_LOG_PATH}"
+ export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
+ fi
$SERVERBIN_DIR/ns-slapd -D $CONFIG_DIR -i $PIDFILE "$@"
if [ $? -ne 0 ]; then
return 1
@@ -70,16 +78,17 @@ start_instance() {
max_count=${PID_TIME:-600}
while test $loop_counter -le $max_count; do
loop_counter=`expr $loop_counter + 1`
- if test ! -f $PIDFILE ; then
- if kill -s 0 $PID > /dev/null 2>&1 ; then
- sleep 1
- else
- echo Server failed to start !!! Please check errors log for problems
- return 1
- fi
- else
+ if test -f $PIDFILE ; then
PID=`cat $PIDFILE`
return 0;
+ else
+ # I'm not sure what this meant to achieve, but $PID is 0 here.
+ if kill -s 0 $PID > /dev/null 2>&1 ; then
+ sleep 1
+ else
+ echo Server failed to start !!! Please check errors log for problems
+ return 1
+ fi
fi
done
echo Server not running!! Failed to start ns-slapd process. Please check the errors
log for problems.
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index e4665e8..e3f7e1d 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -1,5 +1,8 @@
%global pkgname dirsrv
+
+# This is used in certain builds to help us know if it has extra features.
+%global variant base
# for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official
release
# also remove the space between % and global - this space is needed because
# fedpkg verrel stupidly ignores comment lines
@@ -25,6 +28,13 @@
%global jemalloc_ver 3.6.0
%endif
+# This enables an ASAN build. This should not go to production, so we rename.
+%global use_asan __ASAN_ON__
+%if 0%{?use_asan:1}
+%global variant base-asan
+%endif
+
+
# fedora 15 and later uses tmpfiles.d
# otherwise, comment this out
%{!?with_tmpfiles_d: %global with_tmpfiles_d %{_sysconfdir}/tmpfiles.d}
@@ -35,7 +45,7 @@
# set PIE flag
%global _hardened_build 1
-Summary: 389 Directory Server (base)
+Summary: 389 Directory Server (%{variant})
Name: 389-ds-base
Version: __VERSION__
Release: __RELEASE__%{?dist}
@@ -79,6 +89,9 @@ BuildRequires: tcp_wrappers
BuildRequires: pam-devel
BuildRequires: systemd-units
BuildRequires: systemd-devel
+%if 0%{?use_asan:1}
+BuildRequires: libasan
+%endif
# this is needed for using semanage from our setup scripts
Requires: policycoreutils-python
@@ -125,6 +138,11 @@ Requires: perl-Socket
Requires: perl-NetAddr-IP
Requires: systemd-libs
+%if 0%{?use_asan:1}
+Requires: libasan
+Requires: llvm
+%endif
+
Source0:
http://port389.org/sources/%{name}-%{version}%{?prerel}.tar.bz2
# 389-ds-git.sh should be used to generate the source tarball from git
Source1: %{name}-git.sh
@@ -137,12 +155,21 @@ Source3:
http://www.port389.org/binaries/jemalloc-%{jemalloc_ver}.tar.b
Source4:
https://git.fedorahosted.org/cgit/nunc-stans.git/snapshot/nunc-stans-%{nu...
%endif
+%if 0%{?use_asan:1}
+%description
+389 Directory Server is an LDAPv3 compliant server. The base package includes
+the LDAP server and command line utilities for server administration.
+WARNING! This build is linked to Address Sanitisation libraries. This probably
+isn't what you want. Please contact support immediately.
+Please see
http://seclists.org/oss-sec/2016/q1/363 for more information.
+%else
%description
389 Directory Server is an LDAPv3 compliant server. The base package includes
the LDAP server and command line utilities for server administration.
+%endif
%package libs
-Summary: Core libraries for 389 Directory Server
+Summary: Core libraries for 389 Directory Server (%{variant})
Group: System Environment/Daemons
BuildRequires: nspr-devel
BuildRequires: nss-devel
@@ -179,7 +206,7 @@ are used by the main package and the -devel package. This allows the
-devel
package to be installed with just the -libs package and without the main package.
%package devel
-Summary: Development libraries for 389 Directory Server
+Summary: Development libraries for 389 Directory Server (%{variant})
Group: Development/Libraries
Requires: %{name}-libs = %{version}-%{release}
Requires: pkgconfig
@@ -246,14 +273,20 @@ OPENLDAP_FLAG="--with-openldap"
%{?with_tmpfiles_d: TMPFILES_FLAG="--with-tmpfiles-d=%{with_tmpfiles_d}"}
# hack hack hack
https://bugzilla.redhat.com/show_bug.cgi?id=833529
NSSARGS="--with-svrcore-inc=%{_includedir} --with-svrcore-lib=%{_libdir}
--with-nss-lib=%{_libdir} --with-nss-inc=%{_includedir}/nss3"
+
%if %{use_nunc_stans}
NUNC_STANS_FLAGS="--enable-nunc-stans
--with-nunc-stans=../nunc-stans-%{nunc_stans_ver}"
%endif
+
+%if 0%{?use_asan:1}
+ASAN_FLAGS="--enable-asan --enable-debug"
+%endif
+
%configure --enable-autobind --with-selinux $OPENLDAP_FLAG $TMPFILES_FLAG \
--with-systemdsystemunitdir=%{_unitdir} \
--with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
--with-systemdgroupname=%{groupname} $NSSARGS $NUNC_STANS_FLAGS \
- --with-systemd
+ --with-systemd $ASAN_FLAGS
# Generate symbolic info for debuggers
export XCFLAGS=$RPM_OPT_FLAGS
diff --git a/wrappers/systemd.template.asan.service.in
b/wrappers/systemd.template.asan.service.in
new file mode 100644
index 0000000..af91f16
--- /dev/null
+++ b/wrappers/systemd.template.asan.service.in
@@ -0,0 +1,35 @@
+# you usually do not want to edit this file - instead, edit the
+# @initconfigdir@/@package_name@.systemd file instead - otherwise,
+# do not edit this file in /lib/systemd/system - instead, do the following:
+# cp /lib/systemd/system/dirsrv\@.service /etc/systemd/system/dirsrv\@.service
+# mkdir -p /etc/systemd/system/@systemdgroupname@.wants
+# edit /etc/systemd/system/dirsrv\@.service - uncomment the LimitNOFILE=8192 line
+# where %i is the name of the instance
+# you may already have a symlink in
+# /etc/systemd/system/@systemdgroupname@.wants/dirsrv(a)%i.service pointing to
+# /lib/systemd/system/dirsrv\@.service - you will have to change it to link
+# to /etc/systemd/system/dirsrv\@.service instead
+# ln -s /etc/systemd/system/dirsrv\@.service
/etc/systemd/system/@systemdgroupname@.wants/dirsrv(a)%i.service
+# systemctl daemon-reload
+# systemctl (re)start @systemdgroupname@
+[Unit]
+Description=@capbrand@ Directory Server with ASAN %i.
+PartOf=@systemdgroupname@
+After=chronyd.service network.service
+
+[Service]
+Type=notify
+EnvironmentFile=@initconfigdir@/@package_name@
+EnvironmentFile=@initconfigdir@/@package_name@-%i
+PIDFile=@localstatedir@/run/@package_name(a)/slapd-%i.pid
+# We can't symbolize here, as llvm symbolize crashes when it goes near systemd.
+Environment='ASAN_OPTIONS="detect_leaks=1 symbolize=0
log_path=@localstatedir@/run/@package_name(a)/ns-slapd-%i.asan
detect_deadlocks=1"'
+LimitCORE=infinity
+ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i
@localstatedir@/run/@package_name(a)/slapd-%i.pid
+# if you need to set other directives e.g. LimitNOFILE=8192
+# set them in this file
+.include @initconfigdir@/@package_name@.systemd
+
+[Install]
+WantedBy=dirsrv.target
+