Skip to content

Security: Checksec JSON output keys are not reliable #94

@Wenzel

Description

@Wenzel

Checksec's JSON should contain a key which is the filepath:

~/Projets/oswatcher/tools/checksec/checksec --output=json --file=/usr/bin/xz | jq .

{
  "/usr/bin/xz": {
    "relro": "full",
    "canary": "yes",
    "nx": "yes",
    "pie": "yes",
    "rpath": "no",
    "runpath": "no",
    "symbols": "no",
    "fortify_source": "yes",
    "fortified": "5",
    "fortify-able": "8"
  }
}

However, some files are indexed by a file key, and not by their filepath:

~/Projets/oswatcher/tools/checksec/checksec --output=json --file=klibc-usBAintlt99f0TITo98H_trqH2c.so | jq .

{
  "file": {
    "relro": "no",
    "canary": "no",
    "nx": "no",
    "pie": "no",
    "rpath": "no",
    "runpath": "no",
    "symbols": "no",
    "fortify_source": "no",
    "fortified": "0",
    "fortify-able": "0"
  }
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    UpstreamUpstream bug in a librarychecksecchecksec related issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions