rust: validate glibc symbol versions

We want to ensure that we only reference glibc versions older than a
threshold.

Author: indygreg

Cargo.lock

@@ -11,4 +11,10 @@ goblin = "0.3"
 lazy_static = "1.4"
 scroll = "0.10"
 tar = "0.4"
+version-compare = "0.0.11"
 zstd = "0.6"
+
+[dependencies.tugger-binary-analysis]
+version = "0.1.0-pre"
+git = "https://github.com/indygreg/PyOxidizer.git"
+rev = "e86b2f46ed6b449bdb912900b0ac83576ad5ebe9"

Cargo.toml

@@ -14,6 +14,7 @@ use {
     std::{
         convert::TryInto,
         io::Read,
+        ops::Deref,
         path::{Path, PathBuf},
     },
 };
@@ -85,6 +86,8 @@ const PE_ALLOWED_LIBRARIES: &[&str] = &[
 ];
 
 lazy_static! {
+    static ref GLIBC_MAX_VERSION: version_compare::Version<'static> =
+        version_compare::Version::from("2.19").unwrap();
     static ref MACHO_ALLOWED_DYLIBS: Vec<MachOAllowedDylib> = {
         [
             MachOAllowedDylib {
@@ -174,7 +177,7 @@ lazy_static! {
     };
 }
 
-fn validate_elf(path: &Path, elf: &goblin::elf::Elf) -> Result<Vec<String>> {
+fn validate_elf(path: &Path, elf: &goblin::elf::Elf, bytes: &[u8]) -> Result<Vec<String>> {
     let mut errors = vec![];
 
     for lib in &elf.libraries {
@@ -183,6 +186,30 @@ fn validate_elf(path: &Path, elf: &goblin::elf::Elf) -> Result<Vec<String>> {
         }
     }
 
+    let mut undefined_symbols = tugger_binary_analysis::find_undefined_elf_symbols(&bytes, elf);
+    undefined_symbols.sort();
+
+    for symbol in undefined_symbols {
+        if let Some(version) = &symbol.version {
+            let parts: Vec<&str> = version.splitn(2, '_').collect();
+
+            if parts.len() == 2 {
+                if parts[0] == "GLIBC" {
+                    let v =
+                        version_compare::Version::from(parts[1]).expect("unable to parse version");
+
+                    if &v > GLIBC_MAX_VERSION.deref() {
+                        errors.push(format!(
+                            "{} references too new glibc symbol {:?}",
+                            path.display(),
+                            symbol
+                        ))
+                    }
+                }
+            }
+        }
+    }
+
     Ok(errors)
 }
 
@@ -253,7 +280,7 @@ fn validate_distribution(dist_path: &Path) -> Result<Vec<String>> {
         if let Ok(object) = goblin::Object::parse(&data) {
             match object {
                 goblin::Object::Elf(elf) => {
-                    errors.extend(validate_elf(path.as_ref(), &elf)?);
+                    errors.extend(validate_elf(path.as_ref(), &elf, &data)?);
                 }
                 goblin::Object::Mach(mach) => match mach {
                     goblin::mach::Mach::Binary(macho) => {