Debian Bug report logs - #1034429
coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: наб <nabijaczleweli@nabijaczleweli.xyz>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Date: Sat, 15 Apr 2023 04:13:21 +0200

[Message part 1 (text/plain, inline)]

Package: coreutils
Version: 8.32-4+b1
Version: 9.1-1
Severity: normal

Dear Maintainer,

-- >8 --
$ install -vs /bin/install -- q
removed 'q/install'
'/bin/install' -> 'q/install'
$ install -vs /bin/install -- -v
'/bin/install' -> '-v'
Usage: strip <option(s)> in-file(s)
 Removes symbols and sections from files
 The options are:
  -I --input-target=<bfdname>      Assume input file is in format <bfdname>
  -O --output-target=<bfdname>     Create an output file in format <bfdname>
  -F --target=<bfdname>            Set both input and output format to <bfdname>
  -p --preserve-dates              Copy modified/access timestamps to the output
  -D --enable-deterministic-archives
                                   Produce deterministic output when stripping archives (default)
  -U --disable-deterministic-archives
                                   Disable -D behavior
  -R --remove-section=<name>       Also remove section <name> from the output
     --remove-relocations <name>   Remove relocations from section <name>
  -s --strip-all                   Remove all symbol and relocation information
  -g -S -d --strip-debug           Remove all debugging symbols & sections
     --strip-dwo                   Remove all DWO sections
     --strip-unneeded              Remove all symbols not needed by relocations
     --only-keep-debug             Strip everything but the debug information
  -M  --merge-notes                Remove redundant entries in note sections (default)
      --no-merge-notes             Do not attempt to remove redundant notes
  -N --strip-symbol=<name>         Do not copy symbol <name>
     --keep-section=<name>         Do not strip section <name>
  -K --keep-symbol=<name>          Do not strip symbol <name>
     --keep-file-symbols           Do not strip file symbol(s)
  -w --wildcard                    Permit wildcard in symbol comparison
  -x --discard-all                 Remove all non-global symbols
  -X --discard-locals              Remove any compiler-generated symbols
  -v --verbose                     List all object files modified
  -V --version                     Display this program's version number
  -h --help                        Display this output
     --info                        List object formats & architectures supported
  -o <file>                        Place stripped output into <file>
strip: supported targets: elf64-x86-64 elf32-i386 elf32-iamcu elf32-x86-64 pei-i386 pei-x86-64 elf64-l1om elf64-k1om elf64-little elf64-big elf32-little elf32-big pe-x86-64 pe-bigobj-x86-64 pe-i386 srec symbolsrec verilog tekhex binary ihex plugin
install: strip process terminated abnormally
-- >8 --

Probably don't do that.


It would also be nice for $STRIP to provide a default if -S isn't set;
the usefulness of install -s is doubtful if
  install -s binary $DESTDIR/bin
only works if binary happens to match the host arch.


Best,
наб

-- System Information:
Debian Release: 11.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-20-amd64 (SMP w/24 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages coreutils depends on:
ii  libacl1      2.2.53-10
ii  libattr1     1:2.4.48-6
ii  libc6        2.31-13+deb11u5
ii  libgmp10     2:6.2.1+dfsg-1+deb11u1
ii  libselinux1  3.1-3

coreutils recommends no packages.

coreutils suggests no packages.

-- no debconf information

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 1034429@bugs.debian.org (full text, mbox, reply):

From: Pádraig Brady <P@draigBrady.com>

To: наб <nabijaczleweli@nabijaczleweli.xyz>, 1034429@bugs.debian.org

Subject: Re: Bug#1034429: coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Date: Sat, 15 Apr 2023 14:04:18 +0100

On 15/04/2023 03:13, наб wrote:
> Package: coreutils
> Version: 8.32-4+b1
> Version: 9.1-1
> Severity: normal
> 
> Dear Maintainer,
> 
> -- >8 --
> $ install -vs /bin/install -- q
> removed 'q/install'
> '/bin/install' -> 'q/install'
> $ install -vs /bin/install -- -v
> '/bin/install' -> '-v'
> Usage: strip <option(s)> in-file(s)

> install: strip process terminated abnormally
> -- >8 --
> 
> Probably don't do that.

Fair point.
But perhaps the strip program doesn't handle the convention
that -- indicates end of option processing?
Perhaps a more portable workaround would be to prepend "./"
if the name starts with "-".

> It would also be nice for $STRIP to provide a default if -S isn't set;
> the usefulness of install -s is doubtful if
>    install -s binary $DESTDIR/bin
> only works if binary happens to match the host arch.

Yes it's a fair point that calling strip without options is quite restrictive.
Though I suppose --strip-program can point to a script that calls strip appropriately.
There are some security issues with env vars that impact what is executed.
I do see that FreeBSD install(1) does support $STRIPBIN, though they
don't support --strip-program, so functionality is equivalent from that point of view.

cheers,
Pádraig

Message #15 received at 1034429@bugs.debian.org (full text, mbox, reply):

From: наб <nabijaczleweli@nabijaczleweli.xyz>

To: Pádraig Brady <P@draigBrady.com>

Cc: 1034429@bugs.debian.org

Subject: Re: Bug#1034429: coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Date: Sat, 15 Apr 2023 16:47:39 +0200

[Message part 1 (text/plain, inline)]

On Sat, Apr 15, 2023 at 02:04:18PM +0100, Pádraig Brady wrote:
> But perhaps the strip program doesn't handle the convention
> that -- indicates end of option processing?
Inasmuch as "perhaps strip doesn't use getopt(3)" /and/
            "perhaps strip doesn't conform to the XCU"
(https://pubs.opengroup.org/onlinepubs/9699919799/utilities/strip.html;
 note no changes since Issue 2, which means this has been a requirement
 realistically since 1989
 (it's in my copy of XSI Issue 3, saying it's equivalent to Issue 2,
  but it's only Volume 1, and it's unclear to me if the XBD USG
  was fully developed; Issue 2 hasn't been archived),
 and definitely since SUSv1, whose Guideline 10 and Utility Description
 Defaults, OPTIONS, Default Behaviour are both as present-day)
can both hold at the same time, I guess?
You can probably tell I'm quite sceptical any such strip exists.

> > It would also be nice for $STRIP to provide a default if -S isn't set;
> > the usefulness of install -s is doubtful if
> >    install -s binary $DESTDIR/bin
> > only works if binary happens to match the host arch.
> Yes it's a fair point that calling strip without options is quite restrictive.
> Though I suppose --strip-program can point to a script that calls strip appropriately.
My target usecase is for third-party programs running install -s,
which, without modification, cannot be made to work if strip is binutils
strip and the binary is non-native.

Of course I can edit them to be install --strip-program=llvm-strip -s ...,
but, y'know, at some point using install instead of cp and strip
stops making sense. I guess it'd just be nice if ${CC:-cc}
synergised with ${STRIP:-strip}.

> There are some security issues with env vars that impact what is executed.
> I do see that FreeBSD install(1) does support $STRIPBIN, though they
> don't support --strip-program, so functionality is equivalent from that point of view.
Functionality is greatly improved since the target is no longer
effectively hard-coded into the caller. The impact of this is reduced on
FreeBSD since it uses elftoolchain strip, which appears to be
target-agnostic.

Best,
наб

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 1034429@bugs.debian.org (full text, mbox, reply):

From: Pádraig Brady <P@draigBrady.com>

To: наб <nabijaczleweli@nabijaczleweli.xyz>, 1034429@bugs.debian.org

Subject: Re: Bug#1034429: coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Date: Thu, 20 Apr 2023 17:59:50 +0100

On 15/04/2023 15:47, наб wrote:
> On Sat, Apr 15, 2023 at 02:04:18PM +0100, Pádraig Brady wrote:
>> But perhaps the strip program doesn't handle the convention
>> that -- indicates end of option processing?
> Inasmuch as "perhaps strip doesn't use getopt(3)" /and/
>              "perhaps strip doesn't conform to the XCU"
> (https://pubs.opengroup.org/onlinepubs/9699919799/utilities/strip.html;
>   note no changes since Issue 2, which means this has been a requirement
>   realistically since 1989
>   (it's in my copy of XSI Issue 3, saying it's equivalent to Issue 2,
>    but it's only Volume 1, and it's unclear to me if the XBD USG
>    was fully developed; Issue 2 hasn't been archived),
>   and definitely since SUSv1, whose Guideline 10 and Utility Description
>   Defaults, OPTIONS, Default Behaviour are both as present-day)
> can both hold at the same time, I guess?
> You can probably tell I'm quite sceptical any such strip exists.

I was thinking of the more general case where the strip program
may be a shell wrapper or something that doesn't handle -- appropriately.
The main point is that we should fix this issue in any case.

>>> It would also be nice for $STRIP to provide a default if -S isn't set;
>>> the usefulness of install -s is doubtful if
>>>     install -s binary $DESTDIR/bin
>>> only works if binary happens to match the host arch.
>> Yes it's a fair point that calling strip without options is quite restrictive.
>> Though I suppose --strip-program can point to a script that calls strip appropriately.
> My target usecase is for third-party programs running install -s,
> which, without modification, cannot be made to work if strip is binutils
> strip and the binary is non-native.

Well one could adjust the $PATH so an appropriate strip wrapper is found.

cheers,
Pádraig

Message #25 received at 1034429@bugs.debian.org (full text, mbox, reply):

From: Pádraig Brady <P@draigBrady.com>

To: наб <nabijaczleweli@nabijaczleweli.xyz>, 1034429@bugs.debian.org

Subject: Re: Bug#1034429: coreutils: install: -s runs ["strip", $f] instead of ["strip", "--", $f]; should use strip from $STRIP

Date: Fri, 21 Apr 2023 19:17:48 +0100

On 15/04/2023 03:13, наб wrote:
> Package: coreutils
> Version: 8.32-4+b1
> Version: 9.1-1
> Severity: normal
> 
> Dear Maintainer,
> 
> -- >8 --
> $ install -vs /bin/install -- q
> removed 'q/install'
> '/bin/install' -> 'q/install'
> $ install -vs /bin/install -- -v
> '/bin/install' -> '-v'
> Usage: strip <option(s)> in-file(s)

Proposed upstream patch:
https://lists.gnu.org/archive/html/coreutils/2023-04/msg00037.html

cheers,
Pádraig

Send a report that this bug log contains spam.