wazuh-packages icon indicating copy to clipboard operation
wazuh-packages copied to clipboard

RPM debug packages does not contain debug symbols

Open DFolchA opened this issue 2 years ago • 2 comments

Wazuh version Install type Action performed Platform
X.Y.Z-rev Manager/API/Agent Install/Upgrade/Remove OS version

We noticed that when building an RPM package with the debug mode activated the binaries does not contain the debug symbols:

[root@rhel9 vagrant]# readelf -S /var/ossec/bin/wazuh-analysisd | grep .debug
  [27] .gnu_debuglink    PROGBITS         0000000000000000  00203bc8

DFolchA avatar Sep 06 '22 15:09 DFolchA

Update

Modified SPEC files to contain the right binaries when generating debug packages:

[root@rhel9 vagrant]# yum install ./wazuh-manager-4.3.8-2.debug.x86_64.rpm 
...

Installed:
  wazuh-manager-4.3.8-2.debug.x86_64                                                                                                        

Complete!
[root@rhel9 vagrant]# readelf -S /var/ossec/bin/wazuh-analysisd | grep .debug
  [28] .debug_aranges    PROGBITS         0000000000000000  00203bf5
  [29] .debug_pubnames   PROGBITS         0000000000000000  00206325
  [30] .debug_info       PROGBITS         0000000000000000  0020f712
  [31] .debug_abbrev     PROGBITS         0000000000000000  00304a20
  [32] .debug_line       PROGBITS         0000000000000000  0031bc37
  [33] .debug_str        PROGBITS         0000000000000000  0034bdb8
  [34] .debug_pubtypes   PROGBITS         0000000000000000  0036ddc5
  [35] .debug_ranges     PROGBITS         0000000000000000  00385e98
[root@rhel9 vagrant]# file /var/ossec/bin/wazuh-analysisd
/var/ossec/bin/wazuh-analysisd: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=08884225dcf735c2327b146262f2c4c530d5ef50, with debug_info, not stripped

DFolchA avatar Sep 06 '22 15:09 DFolchA

Check new packages

I have checked that the debug symbols come correctly in the packages:

  • Agent:
[root@centos7 vagrant]# objdump -h /var/ossec/bin/wazuh-logcollector | grep debug
 27 .debug_aranges 00001ad0  0000000000000000  0000000000000000  000fdc85  2**0
 28 .debug_pubnames 00004977  0000000000000000  0000000000000000  000ff755  2**0
 29 .debug_info   0007e54d  0000000000000000  0000000000000000  001040cc  2**0
 30 .debug_abbrev 0000ee55  0000000000000000  0000000000000000  00182619  2**0
 31 .debug_line   0001a2ef  0000000000000000  0000000000000000  0019146e  2**0
 32 .debug_str    00013eae  0000000000000000  0000000000000000  001ab75d  2**0
 33 .debug_pubtypes 0000e626  0000000000000000  0000000000000000  001bf60b  2**0
 34 .debug_ranges 00000990  0000000000000000  0000000000000000  001cdc31  2**0
  • Manager:
[root@centos7 vagrant]# objdump -h /var/ossec/bin/wazuh-analysisd | grep debug
 27 .debug_aranges 00002730  0000000000000000  0000000000000000  00203bf5  2**0
 28 .debug_pubnames 000093ed  0000000000000000  0000000000000000  00206325  2**0
 29 .debug_info   000f530e  0000000000000000  0000000000000000  0020f712  2**0
 30 .debug_abbrev 00017217  0000000000000000  0000000000000000  00304a20  2**0
 31 .debug_line   00030181  0000000000000000  0000000000000000  0031bc37  2**0
 32 .debug_str    0002200d  0000000000000000  0000000000000000  0034bdb8  2**0
 33 .debug_pubtypes 000180d3  0000000000000000  0000000000000000  0036ddc5  2**0
 34 .debug_ranges 00001af0  0000000000000000  0000000000000000  00385e98  2**0

jotacarma90 avatar Sep 08 '22 15:09 jotacarma90

Finally not necessary, debug packages are correctly generated right now.

alberpilot avatar Nov 23 '22 14:11 alberpilot