Skip to content

Commit b436343

Browse files
yashugargyashugarg
authored
feat: added libseccomp checker (fixes #1493) (#1556)
1 parent 184b4e8 commit b436343

File tree

8 files changed

+69
-20
lines changed

8 files changed

+69
-20
lines changed

‎.github/actions/spelling/allow.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ libnss
182182
libpng
183183
libraryname
184184
librsvg
185+
libseccomp
185186
libsndfile
186187
libsoup
187188
libsqlite

‎README.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -194,23 +194,23 @@ The following checkers are available for finding components in binary files:
194194

195195
<!--CHECKERS TABLE BEGIN-->
196196
| | | | Available checkers | | | |
197-
|--------------- |--------------- |--------- |------------- |------------- |---------- |---------- |
197+
|--------------- |------------ |--------------- |---------- |------------- |---------- |---------- |
198198
| accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap |
199199
| busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus |
200200
| dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius |
201201
| ftp |gcc |gimp |glibc |gnomeshell |gnupg |gnutls |
202202
| gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell |
203203
| icecast |icu |irssi |kbd |kerberos |kexectools |libarchive |
204204
| libbpg |libdb |libgcrypt |libical |libjpeg_turbo |liblas |libnss |
205-
| librsvg |libsndfile |libsoup |libsrtp |libssh2 |libtiff |libvirt |
206-
| libvncserver |libxslt |lighttpd |logrotate |lua |mariadb |mdadm |
207-
| memcached |mtr |mysql |nano |ncurses |nessus |netpbm |
208-
| nginx |node |ntp |open_vm_tools |openafs |openjpeg |openldap |
209-
| openssh |openssl |openswan |openvpn |p7zip |pcsc_lite |pigz |
210-
| png |polarssl_fedora |poppler |postgresql |pspp |python |qt |
211-
| radare2 |rsyslog |samba |sane_backends |sqlite |strongswan |subversion |
212-
| sudo |syslogng |systemd |tcpdump |trousers |varnish |webkitgtk |
213-
| wireshark |wpa_supplicant |xerces |xml2 |zlib |zsh | |
205+
| librsvg |libseccomp |libsndfile |libsoup |libsrtp |libssh2 |libtiff |
206+
| libvirt |libvncserver |libxslt |lighttpd |logrotate |lua |mariadb |
207+
| mdadm |memcached |mtr |mysql |nano |ncurses |nessus |
208+
| netpbm |nginx |node |ntp |open_vm_tools |openafs |openjpeg |
209+
| openldap |openssh |openssl |openswan |openvpn |p7zip |pcsc_lite |
210+
| pigz |png |polarssl_fedora |poppler |postgresql |pspp |python |
211+
| qt |radare2 |rsyslog |samba |sane_backends |sqlite |strongswan |
212+
| subversion |sudo |syslogng |systemd |tcpdump |trousers |varnish |
213+
| webkitgtk |wireshark |wpa_supplicant |xerces |xml2 |zlib |zsh |
214214
<!--CHECKERS TABLE END-->
215215

216216
All the checkers can be found in the checkers directory, as can the

‎cve_bin_tool/checkers/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
"liblas",
6262
"libnss",
6363
"librsvg",
64+
"libseccomp",
6465
"libsndfile",
6566
"libsoup",
6667
"libsrtp",

‎cve_bin_tool/checkers/libseccomp.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright (C) 2022 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
"""
5+
CVE checker for libseccomp
6+
7+
https://www.cvedetails.com/vulnerability-list/vendor_id-19760/product_id-53398/Libseccomp-Project-Libseccomp.html
8+
"""
9+
from cve_bin_tool.checkers import Checker
10+
11+
12+
class LibseccompChecker(Checker):
13+
CONTAINS_PATTERNS = []
14+
FILENAME_PATTERNS = [r"libseccomp"]
15+
VERSION_PATTERNS = [
16+
r"libseccomp.so.([0-9]+\.[0-9]+\.[0-9]+)"
17+
] # patterns like this aren't ideal
18+
VENDOR_PRODUCT = [("libseccomp_project", "libseccomp")]

‎doc/MANUAL.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -118,23 +118,23 @@ which is useful if you're trying the latest code from
118118

119119
<!--CHECKERS TABLE BEGIN-->
120120
| | | | Available checkers | | | |
121-
|--------------- |--------------- |--------- |------------- |------------- |---------- |---------- |
121+
|--------------- |------------ |--------------- |---------- |------------- |---------- |---------- |
122122
| accountsservice |avahi |bash |bind |binutils |bolt |bubblewrap |
123123
| busybox |bzip2 |cronie |cryptsetup |cups |curl |dbus |
124124
| dnsmasq |dovecot |dpkg |enscript |expat |ffmpeg |freeradius |
125125
| ftp |gcc |gimp |glibc |gnomeshell |gnupg |gnutls |
126126
| gpgme |gstreamer |gupnp |haproxy |hdf5 |hostapd |hunspell |
127127
| icecast |icu |irssi |kbd |kerberos |kexectools |libarchive |
128128
| libbpg |libdb |libgcrypt |libical |libjpeg_turbo |liblas |libnss |
129-
| librsvg |libsndfile |libsoup |libsrtp |libssh2 |libtiff |libvirt |
130-
| libvncserver |libxslt |lighttpd |logrotate |lua |mariadb |mdadm |
131-
| memcached |mtr |mysql |nano |ncurses |nessus |netpbm |
132-
| nginx |node |ntp |open_vm_tools |openafs |openjpeg |openldap |
133-
| openssh |openssl |openswan |openvpn |p7zip |pcsc_lite |pigz |
134-
| png |polarssl_fedora |poppler |postgresql |pspp |python |qt |
135-
| radare2 |rsyslog |samba |sane_backends |sqlite |strongswan |subversion |
136-
| sudo |syslogng |systemd |tcpdump |trousers |varnish |webkitgtk |
137-
| wireshark |wpa_supplicant |xerces |xml2 |zlib |zsh | |
129+
| librsvg |libseccomp |libsndfile |libsoup |libsrtp |libssh2 |libtiff |
130+
| libvirt |libvncserver |libxslt |lighttpd |logrotate |lua |mariadb |
131+
| mdadm |memcached |mtr |mysql |nano |ncurses |nessus |
132+
| netpbm |nginx |node |ntp |open_vm_tools |openafs |openjpeg |
133+
| openldap |openssh |openssl |openswan |openvpn |p7zip |pcsc_lite |
134+
| pigz |png |polarssl_fedora |poppler |postgresql |pspp |python |
135+
| qt |radare2 |rsyslog |samba |sane_backends |sqlite |strongswan |
136+
| subversion |sudo |syslogng |systemd |tcpdump |trousers |varnish |
137+
| webkitgtk |wireshark |wpa_supplicant |xerces |xml2 |zlib |zsh |
138138
<!--CHECKERS TABLE END-->
139139

140140
For a quick overview of usage and how it works, you can also see [the readme file](README.md).

‎test/condensed-downloads/libseccomp-2.3.1-4.el7.x86_64.rpm.tar.gz‎

3.14 KB
Binary file not shown.

‎test/condensed-downloads/libseccomp-2.5.0-4.fc34.x86_64.rpm.tar.gz‎

4.22 KB
Binary file not shown.

‎test/test_data/libseccomp.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright (C) 2022 Intel Corporation
2+
# SPDX-License-Identifier: GPL-3.0-or-later
3+
4+
mapping_test_data = [
5+
{
6+
"product": "libseccomp",
7+
"version": "2.3.1",
8+
"version_strings": ["libseccomp.so.2.3.1"],
9+
},
10+
{
11+
"product": "libseccomp",
12+
"version": "2.5.0",
13+
"version_strings": ["libseccomp.so.2.5.0"],
14+
},
15+
]
16+
package_test_data = [
17+
{
18+
"url": "http://mirror.centos.org/centos/7/os/x86_64/Packages/",
19+
"package_name": "libseccomp-2.3.1-4.el7.x86_64.rpm",
20+
"product": "libseccomp",
21+
"version": "2.3.1",
22+
},
23+
{
24+
"url": "https://download-ib01.fedoraproject.org/pub/fedora/linux/releases/34/Everything/x86_64/os/Packages/l/",
25+
"package_name": "libseccomp-2.5.0-4.fc34.x86_64.rpm",
26+
"product": "libseccomp",
27+
"version": "2.5.0",
28+
},
29+
]

0 commit comments

Comments
 (0)