fix: detect arm64 Linux kernel images in the kernel cataloger - #5145
Open
l46983284-cpu wants to merge 1 commit into
Open
fix: detect arm64 Linux kernel images in the kernel cataloger#5145l46983284-cpu wants to merge 1 commit into
l46983284-cpu wants to merge 1 commit into
Conversation
The linux-kernel cataloger only handled x86 bzImage layouts, so arm64 kernel images (raw Image, whole-file gzip, and EFI zboot PE wrappers with embedded gzip/zstd/xz streams) produced no linux-kernel component. Detect the arm64 header magic, search through embedded compressed streams with vendored decoders under bounded reads, and extract the version from the Linux version banner, keeping the x86 path first. Refs anchore#5126 Signed-off-by: Alex Chen <l46983284@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The linux-kernel cataloger recognizes x86
bzImagelayouts, but arm64 kernel images produce nolinux-kernelcomponent at all — while kernel modules from the same system are cataloged normally. Reported cases: raw arm64Image, whole-file gzip-compressed images (Ubuntu), and EFI zboot PE wrappers with embedded gzip/zstd/xz streams (Amazon Linux, RHEL).Fixes #5126
Fix
Keep the existing x86/deitch-magic path first, then fall back to an arm64 parser:
ARM\x64at 0x38);extract-vmlinuxdoes, with bounded reads (64MB file / 256MB decompressed);Linux versionbanner, preserving the x86 empty-version behavior when no banner is present.Tests
New
parse_arm64_linux_kernel_file_test.go: 5 positive matrix rows (raw, gzip, zboot+gzip, zboot+zstd, zboot+xz), 4 negative cases (no false positives on random non-kernel data, no-banner parity with the x86 empty-version rule, pre-existing magic-error behavior preserved), plus an x86 bzImage regression test. At head: the fullsyft/pkg/cataloger/kernelpackage suite passes; the only failure in the wider cataloger run is the pre-existing docker-dependentTest_KernelCataloger, unavailable on this host.