Update: Reachability Plugin#426
Open
T0pAc3 wants to merge 26 commits into
Open
Conversation
for more information, see https://pre-commit.ci
for more information, see https://pre-commit.ci
Co-authored-by: Ryan Mast <3969255+nightlark@users.noreply.github.com>
Angrimportfixes
for more information, see https://pre-commit.ci
for more information, see https://pre-commit.ci
Collaborator
Author
|
Ok, now it should be working, thanks for being patient with all of the failed pull requests. |
for more information, see https://pre-commit.ci
for more information, see https://pre-commit.ci
WorkingRobot
approved these changes
Jul 17, 2025
nightlark
reviewed
Jul 24, 2025
| authors = [ | ||
| {name = "Seth Bredbenner", email = "bredbenner1@llnl.gov"}, | ||
| ] | ||
| description = "Surfactant plugin for running grype on files" |
Collaborator
There was a problem hiding this comment.
Description here needs updating
nightlark
reviewed
Jul 24, 2025
| ## Important Licensing Information | ||
| Main Project License (Surfactant): MIT License. | ||
|
|
||
| Plugin License: MIT License, but it includes and uses cve-bin-tool, which is GPL-3.0 licensed. |
Collaborator
There was a problem hiding this comment.
cve-bin-tool line here does not apply to this plugin.
nightlark
reviewed
Jul 24, 2025
Comment on lines
+11
to
+15
| After installing the plugin, run Surfactant to generate an SBOM as usual and entries for ELF | ||
| and PE files will contain a metadata object with the information that checksec.py was able | ||
| to get about security related features. | ||
|
|
||
| After the plugin installation, run Surfactant as you normally would to create an SBOM. For binary files analyzed by this plugin, additional JSON files will be generated containing vulnerability data extracted from the binaries. If there are duplicate hashed files, the extractor will check if they have the exported functions entries and skip remaking the output file if so. |
Collaborator
There was a problem hiding this comment.
These lines don't describe the reachability plugin.
nightlark
reviewed
Jul 24, 2025
Comment on lines
+17
to
+31
| Example: | ||
| Output Filename: `reachability.json` | ||
|
|
||
| ```json | ||
| { | ||
| "filename": { | ||
| "exp_func": { | ||
| "library": [ | ||
| "imp_func1", | ||
| "imp_func2" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| ``` |
Collaborator
There was a problem hiding this comment.
I don't think this description is accurate either -- the json blob looks slightly different if I'm remembering correctly, and is added to the metadata list for software entries rather than being in a separate file.
nightlark
reviewed
Jul 24, 2025
| } | ||
| ``` | ||
|
|
||
| The plugin's functionality can be toggled via Surfactant's plugin management features, using the plugin name `surfactantplugin_reachability.py` as defined in the `pyproject.toml` under the `project.entry-points."surfactant"` section. |
Collaborator
There was a problem hiding this comment.
The plugin name to enable/disable it is surfactantplugin_reachability, without the .py suffix.
✅ No SBOM Changes DetectedFor commit 2f95acc (Run 16634709950) |
Collaborator
|
Testing the file extern "C" {
extern void direct();
extern void indirect();
[[gnu::visibility("hidden")]]
void internal_func()
{
indirect();
}
void exported_func()
{
direct();
internal_func();
}
}with the following command line g++ -shared -o test.so -fPIC test.cppresults in the following SBOM file: {
"systems": [],
"hardware": [],
"software": [
{
"UUID": "eb1ba532-7b4a-41c5-a4f7-964b49ac0280",
"name": null,
"size": 15376,
"fileName": [
"test.so"
],
"installPath": [
"test.so"
],
"containerPath": [],
"captureTime": 1781198489,
"version": "",
"vendor": [],
"description": "",
"sha1": "de60093da48bc0b1482d59c80be1ca79af949ab2",
"sha256": "63c1286c2d2a72d39ba613dd3fdef217696100c0cb363a5918376694d873877d",
"md5": "10215d77c7d448872bdefbe3c825a5ff",
"relationshipAssertion": "Unknown",
"comments": "",
"metadata": [
{
"collectedBy": "Surfactant",
"collectionPlatform": "Linux-6.6.114.1-microsoft-standard-WSL2-x86_64-with-glibc2.39",
"fileInfo": {
"mode": "-rwxr-xr-x",
"hidden": false
}
},
{
"OS": "System V",
"elfIdent": {
"EI_CLASS": 2,
"EI_DATA": 1,
"EI_VERSION": 1,
"EI_OSABI": 0,
"EI_ABIVERSION": 0,
"E_MACHINE": 62
},
"elfDependencies": [],
"elfRpath": [],
"elfRunpath": [],
"elfSoname": [],
"elfInterpreter": [],
"elfDynamicFlags": [],
"elfDynamicFlags1": [],
"elfGnuRelro": true,
"elfComment": [
"GCC: (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0"
],
"elfNote": [
{
"sectionName": ".note.gnu.property",
"name": "GNU",
"type": "NT_GNU_PROPERTY_TYPE_0",
"descdata": "\u0002\u0000\u0000\u00c0\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
},
{
"sectionName": ".note.gnu.build-id",
"name": "GNU",
"type": "NT_GNU_BUILD_ID",
"desc": "7099a706109fc4ba58755a730285049f16c6052e"
}
],
"elfOsAbi": "ELFOSABI_SYSV",
"elfHumanArch": "x64",
"elfArchNumber": 62,
"elfArchitecture": "EM_X86_64",
"elfIsExe": false,
"elfIsLib": true,
"elfIsRel": false,
"elfIsCore": false
},
{
"export_fn_reachability": {
"exported_func": {
"extern-address space": [
"direct"
]
}
}
}
],
"supplementaryFiles": [],
"provenance": null,
"recordedInstitution": null,
"components": []
}
],
"analysisData": [],
"observations": [],
"starRelationships": [],
"relationships": []
} |
Collaborator
|
Attaching the zipped version of test.so (because GitHub doesn't allow direct uploading of an SO) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
a plugin that finds the reachability of imported functions from exported functions
If merged this pull request will
Proposed changes
This is the 1.0 of the plugin. It returns a python dictionary of the imported functions reachable by the exported function of every binary.