Skip to content

Commit 7e61dc9

Browse files
cataphractcataphract
authored
Merge pull request #4027 from DataDog/glopes/libunwind-glibc-opt
update appsec musl image to use _dl_find_object in glibc
2 parents f99efe3 + f8bc36f commit 7e61dc9

6 files changed

Lines changed: 137 additions & 6 deletions

File tree

‎.gitlab/generate-package.php‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,26 @@
7272
],
7373
];
7474

75+
$appsec_helper_rust_image_tag = "nginx-fpm-php-8.5-release-musl";
76+
$appsec_helper_rust_image = appsec_image_from_tag_mapping($appsec_helper_rust_image_tag);
77+
78+
function appsec_image_from_tag_mapping(string $tag): string
79+
{
80+
$tag_mappings_file = __DIR__ . "/../appsec/tests/integration/gradle/tag_mappings.gradle";
81+
$tag_mappings = file_get_contents($tag_mappings_file);
82+
if ($tag_mappings === false) {
83+
throw new RuntimeException("Failed to read $tag_mappings_file");
84+
}
85+
86+
if (!preg_match("/['\"]" . preg_quote($tag, "/") . "['\"]\\s*:\\s*['\"]([^'\"]+)['\"]/", $tag_mappings, $matches)) {
87+
throw new RuntimeException("Tag $tag not found in $tag_mappings_file");
88+
}
89+
90+
$repo = "registry.ddbuild.io/images/mirror/datadog/dd-appsec-php-ci";
91+
$image_ref = $matches[1];
92+
return str_starts_with($image_ref, "sha256:") ? "$repo@$image_ref" : "$repo:$image_ref";
93+
}
94+
7595
?>
7696

7797
stages:
@@ -309,7 +329,7 @@
309329

310330
"compile appsec helper rust":
311331
stage: appsec
312-
image: "registry.ddbuild.io/images/mirror/datadog/dd-appsec-php-ci:nginx-fpm-php-8.5-release-musl"
332+
image: "<?= $appsec_helper_rust_image ?>"
313333
tags: [ "arch:$ARCH" ]
314334
needs: [ "prepare code" ]
315335
parallel:

‎appsec/tests/integration/gradle/images.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ tasks.register('buildNginxFpm-8.5-release-musl', Exec) {
212212
description = "Build the musl-nginx image for Alpine testing"
213213
inputs.file file('src/docker/nginx-fpm-musl/Dockerfile')
214214
inputs.file file('src/docker/nginx-fpm-musl/nginx.conf')
215+
inputs.dir 'src/docker/nginx-fpm-musl/llvm-runtimes'
215216
outputs.upToDateWhen imageUpToDate(inputs, image)
216217

217218
commandLine(*dockerBuildCommand, *dockerMirrorArgs,

‎appsec/tests/integration/gradle/tag_mappings.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ ext.tag_mappings = [
3737
'php-7.1-release': 'sha256:d52f126a9101785afe08aeb8af45ebc9393f6007fa9ad20f847fceb4dfe00ef6',
3838
'php-8.4-release': 'sha256:8dd60fd881701c66853820ca7bbbfa5554a91a6007c372444d3203f30d7eae4f',
3939
'apache2-mod-php-8.4-release-zts': 'sha256:d0974677d0f1e12dc59a217a07045afd9649bdc42e680df7d6f7c718ad07c9ed',
40-
'nginx-fpm-php-8.5-release-musl': 'sha256:0ab409dfc415b0c035414b89efdb34218faa1850e99ad3fcf7b52bd5fc042e0c',
40+
'nginx-fpm-php-8.5-release-musl': 'sha256:e455d450af85e1b0723ae3cc7e48b0e32b01b6000b619751b2b60597648671e4',
4141
'apache2-mod-php-8.3-release-zts': 'sha256:0ddb8cdc827b9a3dc271a35712346c66ab5a70aa34ae4f2fdf73e3632d0fd1f0',
4242
'apache2-mod-php-8.5-release-zts': 'sha256:33aa76b5ee683d9eb3a1c199b01f3dc998671c0d27ea465ac67943ccda0ad017',
4343
'php-7.2-debug': 'sha256:b809a751f79a4a5b8dedaa57b08c1e9ad407805732f67609a015370867691b79',

‎appsec/tests/integration/src/docker/nginx-fpm-musl/Dockerfile‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@ FROM php:8.5-fpm-alpine
33
# doubles as php/toolchain image for musl
44

55
RUN apk add --no-cache \
6-
autoconf automake bash bison clang clang-dev cmake curl curl-dev \
7-
g++ gcc gdb git libc-dev linux-headers llvm-libunwind-static make \
8-
musl-dev nginx oniguruma-dev openssl-dev patchelf pkgconf re2c libtool \
9-
libxml2-dev libzip-dev xz-static zlib-dev \
6+
abuild autoconf automake bash bison clang clang-dev cmake curl curl-dev \
7+
build-base g++ gcc gdb git libc-dev linux-headers llvm22-dev llvm22-static make \
8+
musl-dev nginx oniguruma-dev openssl-dev patch patchelf pkgconf re2c libtool \
9+
libxml2-dev libzip-dev python3 samurai xz xz-static zlib-dev \
1010
vim
1111

1212

@@ -24,6 +24,19 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
2424
rustup toolchain install nightly-$(uname -m)-unknown-linux-musl && \
2525
rustup component add rust-src --toolchain nightly-$(uname -m)-unknown-linux-musl
2626

27+
COPY llvm-runtimes /tmp/llvm-runtimes
28+
RUN RUST_TARGET="$(uname -m)-unknown-linux-musl" && \
29+
RUST_TOOLCHAIN="/usr/local/rustup/toolchains/nightly-${RUST_TARGET}" && \
30+
apk update && \
31+
cd /tmp/llvm-runtimes && \
32+
abuild-keygen -an && \
33+
cp /root/.abuild/*.rsa.pub /etc/apk/keys/ && \
34+
abuild -F -r && \
35+
package="$(find /root/packages -name 'llvm-libunwind-static-patched-*.apk' -print -quit)" && \
36+
apk add --allow-untrusted "$package" && \
37+
cp /usr/lib/libunwind.a "${RUST_TOOLCHAIN}/lib/rustlib/${RUST_TARGET}/lib/self-contained/libunwind.a" && \
38+
rm -rf /tmp/llvm-runtimes /root/packages /var/cache/distfiles/*
39+
2740
RUN mkdir -p /run/nginx && \
2841
mkdir -p /var/www/public && \
2942
chown -R linux_user:linux_user /var/www && \

‎appsec/tests/integration/src/docker/nginx-fpm-musl/llvm-runtimes/APKBUILD‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Contributor: Eric Molitor <eric@molitor.org>
2+
# Contributor: Jakub Jirutka <jakub@jirutka.cz>
3+
# Contributor: Rasmus Thomsen <oss@cogitri.dev>
4+
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
5+
pkgname=llvm-libunwind-static-patched
6+
pkgver=22.1.3
7+
_pkgver=${pkgver/_/-}
8+
_llvmver=${pkgver%%.*}
9+
pkgrel=0
10+
pkgdesc="LLVM libunwind static library with runtime _dl_find_object probing"
11+
url="https://llvm.org/"
12+
arch="x86_64 aarch64"
13+
license="Apache-2.0"
14+
makedepends="
15+
abuild>=3.15.0-r5
16+
clang
17+
cmake
18+
linux-headers
19+
llvm$_llvmver-dev
20+
llvm$_llvmver-static
21+
python3
22+
samurai
23+
"
24+
source="https://github.com/llvm/llvm-project/releases/download/llvmorg-$_pkgver/llvm-project-$_pkgver.src.tar.xz
25+
llvm-libunwind-dl-find-object-runtime.patch
26+
"
27+
builddir="$srcdir/llvm-project-$_pkgver.src"
28+
options="!check"
29+
30+
prepare() {
31+
default_prepare
32+
}
33+
34+
build() {
35+
CC=clang \
36+
CXX=clang++ \
37+
CFLAGS="$CFLAGS -DNDEBUG -DSANITIZER_CAN_USE_PREINIT_ARRAY=0" \
38+
CXXFLAGS="$CXXFLAGS -DNDEBUG -DSANITIZER_CAN_USE_PREINIT_ARRAY=0" \
39+
cmake -B build -G Ninja -Wno-dev -S runtimes \
40+
-DLLVM_ENABLE_RUNTIMES="libunwind" \
41+
-DCMAKE_BUILD_TYPE=RelWithDebInfo \
42+
-DCMAKE_INSTALL_PREFIX=/usr \
43+
-DLIBCXX_HAS_MUSL_LIBC=ON \
44+
-DLIBUNWIND_HAS_NODEFAULTLIBS_FLAG=OFF \
45+
-DLIBUNWIND_ENABLE_SHARED=OFF \
46+
-DLIBUNWIND_ENABLE_STATIC=ON \
47+
-DLIBUNWIND_INSTALL_HEADERS=OFF \
48+
-DLIBUNWIND_INSTALL_SHARED_LIBRARY=OFF \
49+
-DLIBUNWIND_INSTALL_STATIC_LIBRARY=ON \
50+
-DCMAKE_VERBOSE_MAKEFILE=ON
51+
cmake --build build --target unwind_static
52+
}
53+
54+
package() {
55+
DESTDIR="$pkgdir" cmake --install build
56+
57+
find "$pkgdir" -type f ! -path "$pkgdir/usr/lib/libunwind.a" -delete
58+
find "$pkgdir" -type d -empty -delete
59+
}
60+
61+
sha512sums="
62+
3557a955d55471671ae2f7b9c809affd59a29a6fb1e70a2a5d040dc1c6376246deb0635be8ca36cae09112981760e9afb128c822e5554bd722589fb8dee3f0df llvm-project-22.1.3.src.tar.xz
63+
82fac87a42efd9d4612b03653880ba7d29f6ba05b790d7916dff02cf14c6149c037d81fd0e3303958a9d8052a54e3f094b42fd8e45211d97d91a86aafae1ee7b llvm-libunwind-dl-find-object-runtime.patch
64+
"

‎appsec/tests/integration/src/docker/nginx-fpm-musl/llvm-runtimes/llvm-libunwind-dl-find-object-runtime.patch‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
diff --git a/libunwind/src/AddressSpace.hpp b/libunwind/src/AddressSpace.hpp
2+
--- a/libunwind/src/AddressSpace.hpp
3+
+++ b/libunwind/src/AddressSpace.hpp
4+
@@ -99,6 +99,29 @@
5+
6+
#include <link.h>
7+
8+
+#if defined(__linux__) && defined(_LIBUNWIND_SUPPORT_DWARF_INDEX) && \
9+
+ defined(_LIBUNWIND_USE_DL_ITERATE_PHDR) && \
10+
+ !defined(DLFO_STRUCT_HAS_EH_DBASE) && \
11+
+ (defined(__x86_64__) || defined(__aarch64__))
12+
+// glibc 2.35 added _dl_find_object, and LLVM libunwind already probes for it
13+
+// with dlsym at runtime. musl's <link.h> does not declare the glibc-only ABI,
14+
+// so provide the compatible public layout and keep the runtime fallback to
15+
+// dl_iterate_phdr when _dl_find_object is absent.
16+
+#define DLFO_STRUCT_HAS_EH_DBASE 0
17+
+#define DLFO_STRUCT_HAS_EH_COUNT 0
18+
+#define DLFO_EH_SEGMENT_TYPE PT_GNU_EH_FRAME
19+
+struct dl_find_object {
20+
+ unsigned long long int dlfo_flags;
21+
+ void *dlfo_map_start;
22+
+ void *dlfo_map_end;
23+
+ struct link_map *dlfo_link_map;
24+
+ void *dlfo_eh_frame;
25+
+ unsigned long long int __dlfo_reserved[7];
26+
+};
27+
+
28+
+extern "C" int _dl_find_object(void *, struct dl_find_object *);
29+
+#endif
30+
+
31+
#endif
32+
33+
namespace libunwind {

0 commit comments

Comments
 (0)