Date: Wed, 26 Mar 2003 06:10:41 -0600 From: D J Hawkey Jr <hawkeyd@visi.com> To: Simon Barner <barner@in.tum.de>, "Jeremy C. Reed" <reed@reedmedia.net> Cc: security at FreeBSD <freebsd-security@freebsd.org> Subject: Re: what actually uses xdr_mem.c? Message-ID: <20030326061041.A17052@sheol.localdomain> In-Reply-To: <20030326102057.GC657@zi025.glhnet.mhn.de>; from barner@in.tum.de on Wed, Mar 26, 2003 at 11:20:57AM %2B0100 References: <Pine.LNX.4.43.0303252144400.21019-100000@pilchuck.reedmedia.net> <20030326102057.GC657@zi025.glhnet.mhn.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mar 26, at 11:20 AM, Simon Barner wrote:
>
> Hi Jeremy,
>
> > The recent XDR fixes the xdrmem_getlong_aligned(),
> > xdrmem_putlong_aligned(), xdrmem_getlong_unaligned(),
> > xdrmem_putlong_unaligned(), xdrmem_getbytes(), and/or xdrmem_putbytes()
> > functions, but it is difficult to know what uses these (going backwards
> > manually).
>
> I would not rely on the binaries to find out, which programs make use of the
> above functions. That's one of the advantages of an open source os ;-)
>
> Something like
>
> cd /usr/src
> grep -rl 'xdrmem_getlong_aligned' *
>
> will print all the files that contain the string 'xdrmem_getlong_aligned'. Based
> on the path name of those file, you will be able to find out which programs use
> the xdr* functions.
Actually, I _would_ check the binaries. Scanning /usr/src doesn't cover
anything installed via the ports collection (/usr/ports), from other
sources, or "home-grown" software.
A week or so ago, I posted a command that scans the binaries:
find $DIR -type f \
|xargs readelf -a 2>/dev/null \
|awk '/^File:/ { name = $2; printed = 0; } \
/XDR|xdr/ { if (!printed) { print name; printed = 1; } }' \
|xargs ldd 2>/dev/null
If it reports a pathed file without listing any shared libraries, then
it is statically-linked.
I can't say this is the definitive answer, but it worked in a controlled
environment (i.e., known binaries), as well as a live system. You can
break down it's components to see what each pipe does.
> HTH,
> Simon
HTH too,
Dave
--
______________________ ______________________
\__________________ \ D. J. HAWKEY JR. / __________________/
\________________/\ hawkeyd@visi.com /\________________/
http://www.visi.com/~hawkeyd/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030326061041.A17052>