Sysinternals / SysmonForLinux

MIT License
1.68k stars 180 forks source link

Builds fail on GCC 12+ #130

Closed alexhaydock closed 1 year ago

alexhaydock commented 1 year ago

Describe the bug Builds fail on GCC 12+ (as is shipped with Fedora 36+) but not GCC 11.x (RHEL 9, Fedora <35).

On GCC 12+, builds fail with this error:

[ 57%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/usage.c.o
[ 58%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/parsecommandline.c.o
[ 59%] Building C object CMakeFiles/sysmon.dir/sysmonCommon/printSchema.c.o
[ 59%] Building CXX object CMakeFiles/sysmon.dir/sysmonCommon/xml.cpp.o
/tmp/SysmonForLinux/sysmonCommon/xml.cpp: In member function 'HRESULT RuleBuilder::AddData(PVOID, ULONG)':
/tmp/SysmonForLinux/sysmonCommon/xml.cpp:232:42: error: comparing the result of pointer addition '(((PBYTE)((RuleBuilder*)this)->RuleBuilder::blob) + ((sizetype)((RuleBuilder*)this)->RuleBuilder::blobSize))' and NULL [-Werror=address]
  232 |                 if( (PBYTE)blob+blobSize == 0 ) {
      |                     ~~~~~~~~~~~~~~~~~~~~~^~~~
cc1plus: all warnings being treated as errors
make[2]: *** [CMakeFiles/sysmon.dir/build.make:1018: CMakeFiles/sysmon.dir/sysmonCommon/xml.cpp.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:133: CMakeFiles/sysmon.dir/all] Error 2
make: *** [Makefile:91: all] Error 2
Error: building at STEP "RUN LD_LIBRARY_PATH=/usr/local/lib make": while running runtime: exit status 2

To Reproduce Dockerfile for a build that fails using Fedora 36, 37, 38 (shipping GCC 12+) but succeeds with Fedora 35 (shipping GCC 11.3.1). To reproduce and test across Fedora releases, just change the container tag in the first line:

FROM registry.fedoraproject.org/fedora:38 as buildbin

# Configure Sysmon Git tag here
ARG VER='1.2.0.0'

# Prereqs (ones I worked out)
RUN dnf install -y clang cmake g++ gcc git llvm mono-devel monodevelop-devel dotnet-sdk-6.0

# Prereqs (from Rocky 9 instructions at: https://github.com/Sysinternals/SysmonForLinux/blob/main/BUILD.md)
RUN dotnet tool install --global dotnet-t4 --version 2.3.1
RUN dnf install -y gcc gcc-c++ make cmake llvm clang elfutils-libelf-devel rpm-build json-glib-devel python3 libxml2-devel gtest-devel gmock gmock-devel glibc-devel.i686

# Clone SysinternalsEBPF source
RUN git clone https://github.com/Sysinternals/SysinternalsEBPF.git /tmp/SysinternalsEBPF
RUN mkdir /tmp/SysinternalsEBPF/build
WORKDIR /tmp/SysinternalsEBPF/build

# Build SysinternalsEBPF
RUN cmake ..
RUN make

# Install SysinternalsEBPF
RUN make install

# Clone SysmonForLinux source
RUN git clone --recurse-submodules --branch ${VER} https://github.com/Sysinternals/SysmonForLinux.git /tmp/SysmonForLinux
RUN mkdir /tmp/SysmonForLinux/build
WORKDIR /tmp/SysmonForLinux/build

# Build SysmonForLinux
RUN cmake ..
# (we need to specify LD_LIBRARY_PATH here so that the make process for Sysmon finds the .so we built and installed
# earlier for SysinternalsEBPF)
RUN LD_LIBRARY_PATH=/usr/local/lib make

Sysmon version 1.2.0.0

Distro/kernel version Tested not working:

Tested working:

Additional context I can't be sure this is definitely due to the change in GCC version but since that's specifically a compiler error that's where my suspicion lies. Seems like this is either down to the change in compiler version (or possibly some additional compiler hardening flags that were added in Fedora 36 onwards, but I can't find specific evidence of that with a cursory search).

MarioHewardt commented 1 year ago

Hi - thanks for reporting this. This should now be fixed.