Describe the bug
Builds fail on GCC 12+ (as is shipped with Fedora 36+) but not GCC 11.x (RHEL 9, Fedora <35).
On GCC 12+, builds fail with this error:
[ 57%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/usage.c.o
[ 58%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/parsecommandline.c.o
[ 59%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/printSchema.c.o
[ 59%] Building CXX object CMakeFiles/sysmon.dir/sysmonCommon/xml.cpp.o
/tmp/SysmonForLinux/sysmonCommon/xml.cpp: In member function 'HRESULT RuleBuilder::AddData(PVOID, ULONG)':
/tmp/SysmonForLinux/sysmonCommon/xml.cpp:232:42: error: comparing the result of pointer addition '(((PBYTE)((RuleBuilder*)this)->RuleBuilder::blob) + ((sizetype)((RuleBuilder*)this)->RuleBuilder::blobSize))' and NULL [-Werror=address]
232 | if( (PBYTE)blob+blobSize == 0 ) {
| ~~~~~~~~~~~~~~~~~~~~~^~~~
cc1plus: all warnings being treated as errors
make[2]: *** [CMakeFiles/sysmon.dir/build.make:1018: CMakeFiles/sysmon.dir/sysmonCommon/xml.cpp.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:133: CMakeFiles/sysmon.dir/all] Error 2
make: *** [Makefile:91: all] Error 2
Error: building at STEP "RUN LD_LIBRARY_PATH=/usr/local/lib make": while running runtime: exit status 2
To Reproduce
Dockerfile for a build that fails using Fedora 36, 37, 38 (shipping GCC 12+) but succeeds with Fedora 35 (shipping GCC 11.3.1). To reproduce and test across Fedora releases, just change the container tag in the first line:
FROM registry.fedoraproject.org/fedora:38 as buildbin
# Configure Sysmon Git tag here
ARG VER='1.2.0.0'
# Prereqs (ones I worked out)
RUN dnf install -y clang cmake g++ gcc git llvm mono-devel monodevelop-devel dotnet-sdk-6.0
# Prereqs (from Rocky 9 instructions at: https://github.com/Sysinternals/SysmonForLinux/blob/main/BUILD.md)
RUN dotnet tool install --global dotnet-t4 --version 2.3.1
RUN dnf install -y gcc gcc-c++ make cmake llvm clang elfutils-libelf-devel rpm-build json-glib-devel python3 libxml2-devel gtest-devel gmock gmock-devel glibc-devel.i686
# Clone SysinternalsEBPF source
RUN git clone https://github.com/Sysinternals/SysinternalsEBPF.git /tmp/SysinternalsEBPF
RUN mkdir /tmp/SysinternalsEBPF/build
WORKDIR /tmp/SysinternalsEBPF/build
# Build SysinternalsEBPF
RUN cmake ..
RUN make
# Install SysinternalsEBPF
RUN make install
# Clone SysmonForLinux source
RUN git clone --recurse-submodules --branch ${VER} https://github.com/Sysinternals/SysmonForLinux.git /tmp/SysmonForLinux
RUN mkdir /tmp/SysmonForLinux/build
WORKDIR /tmp/SysmonForLinux/build
# Build SysmonForLinux
RUN cmake ..
# (we need to specify LD_LIBRARY_PATH here so that the make process for Sysmon finds the .so we built and installed
# earlier for SysinternalsEBPF)
RUN LD_LIBRARY_PATH=/usr/local/lib make
Sysmon version
1.2.0.0
Distro/kernel version
Tested not working:
Fedora Rawhide (GCC 13.1.1)
Fedora 38 (GCC 13.0.1)
Fedora 37 (GCC 12.2.1)
Fedora 36 (GCC 12.0.1)
Tested working:
Fedora 35 (GCC 11.3.1)
Rocky 9 (GCC 11.3.1)
Additional context
I can't be sure this is definitely due to the change in GCC version but since that's specifically a compiler error that's where my suspicion lies. Seems like this is either down to the change in compiler version (or possibly some additional compiler hardening flags that were added in Fedora 36 onwards, but I can't find specific evidence of that with a cursory search).
Describe the bug Builds fail on GCC 12+ (as is shipped with Fedora 36+) but not GCC 11.x (RHEL 9, Fedora <35).
On GCC 12+, builds fail with this error:
To Reproduce Dockerfile for a build that fails using Fedora 36, 37, 38 (shipping GCC 12+) but succeeds with Fedora 35 (shipping GCC 11.3.1). To reproduce and test across Fedora releases, just change the container tag in the first line:
Sysmon version 1.2.0.0
Distro/kernel version Tested not working:
Tested working:
Additional context I can't be sure this is definitely due to the change in GCC version but since that's specifically a compiler error that's where my suspicion lies. Seems like this is either down to the change in compiler version (or possibly some additional compiler hardening flags that were added in Fedora 36 onwards, but I can't find specific evidence of that with a cursory search).