SDK: Consider disabling elfutils debuginfod and dependencies

Value

Reduce attack surface (update: in the SDK)

Description

We currently include remote debugging debuginfod with libmicrohttpd. Possibly not needed. This is in the SDK (target packages)

Applicable Market Segments

• All

Applicable Personas

• Product Integrator

changed milestone to %goofy beta

added teamsecurity label

set weight to 2

added to epic &107 (closed)

Related to #170 (closed)

changed iteration to Oniro Core Iterations Aug 1, 2022 - Aug 31, 2022

CC @landgraf @idlethread @agherzan @bero

Agree on disabling

assigned to @mrybczyn

What pulls in efitools, @mrybczyn?

elfutils, brought by iproute2, linux and rpm

@mrybczyn we should not have rpm installed on base images

It doesn't make much sense to have dnf and rpm installed. So we decided to drop package-management feature all together. Is it back for some reason?

The rpm is in the native version. iproute2 and linux depend on elfutils in the image version, however. I confirm that we do not seem to have rpm in the base image now.

So linux pulls it in? What pulls efitools in the rootfs?

elfutils @agherzan. There was a typo. I was doing optee stuff just in another terminal.

And yes, linux is pulling elfutils according to the deps

It seems possible to compile elfutils without debuginfo. Will be worth having a look at what else it enables by default

I don't see elfutils installed in the default base image. And looks like nothing depends on it either.

I have that (x86 qemu, a fragment of course):

"iproute2.do_package" -> "elfutils.do_packagedata"
"iproute2.do_package_write_rpm" -> "elfutils.do_packagedata"
"iproute2.do_prepare_recipe_sysroot" -> "elfutils.do_populate_sysroot"
"linux-oniro.do_prepare_recipe_sysroot" -> "elfutils-native.do_populate_sysroot"
"oniro-image-base.do_populate_lic_deploy" -> "elfutils-native.do_populate_lic"
[...]
"oniro-image-base.do_rootfs" -> "elfutils.do_cve_check"
"oniro-image-base.do_rootfs" -> "elfutils.do_package_qa"
"oniro-image-base.do_rootfs" -> "elfutils.do_package_write_rpm"

Can you confirm that the package is in the final rootfs and not just a build tool?

$ rpm -qpl core2_64/elfutils-0.186-r0.core2_64.rpm 
/etc
/etc/debuginfod
/etc/profile.d
/etc/profile.d/debuginfod.csh
/etc/profile.d/debuginfod.sh
/usr
/usr/bin
/usr/bin/debuginfod
/usr/bin/debuginfod-find
/usr/bin/eu-ar
/usr/bin/eu-elfclassify
/usr/bin/eu-elfcmp
/usr/bin/eu-elfcompress
/usr/bin/eu-elflint
/usr/bin/eu-findtextrel
/usr/bin/eu-make-debug-archive
/usr/bin/eu-objdump
/usr/bin/eu-ranlib
/usr/bin/eu-stack
/usr/bin/eu-strings
/usr/bin/eu-unstrip

neither one of the files is in rootfs

@mrybczyn I was confused by this too. If do_rootfs depends on something this doesn't mean this package will be installed in the rootfs. Try grep do_rootfs task-depends.dot | grep native for example.

This thread is exact use cases why I've asked Davide to add package-management feature into debug builds.. We should be able to build the image and run rpm -qa there if needed.

@landgraf The fact that is in the SDK is also a reason to get rid of extra things we do not need. There's also an easier way to find if it is in the image but @ghassaneben is working on the subject and I prefer he does some discoveries in this task so won't tell him now :)

This is new info that is not reflected in the body of this ticket. So, before engaging in fixing/implementing this, please clarify the problem statement by revamping this issue ticket.

changed title from Consider disabling efitools debuginfod and dependencies to Consider disabling elftools debuginfod and dependencies

changed title from Consider disabling elftools debuginfod and dependencies to Consider disabling elfutils debuginfod and dependencies

changed the description

mentioned in issue #170 (closed)

assigned to @ghassaneben

changed title from Consider disabling elfutils debuginfod and dependencies to SDK: Consider disabling elfutils debuginfod and dependencies

changed the description

added Doing label

Implementation: !263 (72f69d4d)

changed iteration to Oniro Core Iterations Sep 1, 2022 - Sep 30, 2022

closed