anchore / anchore/syft

Map shared lib / executable dependencies

Open
#661 7 comments 2 reactions 0 assignees View on GitHub
binary-analysis enhancement new-cataloger
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:
The ability to list the specific shared lib dependencies for a binary. For example:
```
$ readelf -d ./partx

Dynamic section at offset 0x1c908 contains 29 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libblkid.so.1]
0x0000000000000001 (NEEDED) Shared library: [libsmartcols.so.1]
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
0x000000000000000c (INIT) 0x4000
0x000000000000000d (FINI) 0x15304
0x0000000000000019 (INIT_ARRAY) 0x1d530
...
```

We could specifically note that there are shared lib dependencies: `libblkid.so.1`, `libsmartcols.so.1`, and `libc.so.6`

These files could be cross correlated with other packages that provide these files to discover relationships between packages and files (or files and files if there is no representative packaging metadata available). We can additionally discover other shared libs and do the same analysis, in which case we can build a tree of dependencies for executables.

The missing part of this is being able to reconcile runtime attributes that may change the structure of the tree (such as `LD_LIBRARY_PATH`). However, as long as the files are present the superset of dependencies can be created without issue (no need to consider these runtime constraints).

There is a lot more thought needed here; does this imply a separate binary cataloger? are those findings considered packages? if they are not (thus considered only files) how do you keep extra binary format info around? or do we only focus on creating relationships between files? does this overlap with the golang bin cataloger or is it in a separate-enough of a domain?

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing Go binary cataloger and the questions about a separate binary cataloger, package findings, and file relationships. Determine the scope for recording shared-library dependencies such as the readelf NEEDED entries, including whether recursive dependencies are included. Done should make executable-to-library relationships discoverable while accounting for the stated runtime-attribute limitations.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.