check_binary_dependencies.py

#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())
#!/usr/bin/env python3
# Copyright (c) Meta Platforms, Inc. and affiliates.
# All rights reserved.
#
# This source code is licensed under the BSD-style license found in the
# LICENSE file in the root directory of this source tree.

# pyre-strict

"""
A script to help check binary dependencies and disallowed symbols in intermediate build files.
"""

importargparse
importos
importre
importsubprocess
importsys
fromdataclassesimportdataclass
frompathlibimportPath
fromtypingimportDict, Iterable, List, NoReturn, Optional, Tuple

# Script output statuses.
STATUS_OK=0
STATUS_SCRIPT_ERROR=1
STATUS_ERROR=2
STATUS_WARNING=3

# Object file suffix.
OBJECT_SUFFIX=".o"

# Project root, assuming this script is in `<root>/scripts/`
PROJECT_ROOT=Path(__file__).parent.parent.resolve()

# Regex to strip info from nm and readelf.
NM_REGEX=re.compile(r"\d*\s+(?P<status>\S)\s+(?P<symbol>.*)")
READELF_DEP_REGEX=re.compile(r".*\(NEEDED\)\s+(?P<so>.*)")
READELF_DYN_SYM_REGEX=re.compile(r"(UND|\d+)\s+(?P<symbol>[^@\s:]+)(@.*)?$")

# Disallow list of prefixes for standard library symbols.
DISALLOW_LIST= [
"operator new",
"operator delete",
"std::__cxx11::basic_string",
"std::__throw",
"std::deque",
"std::exception",
"std::forward_list",
"std::list",
"std::map",
"std::multimap",
"std::multiset",
"std::priority_queue",
"std::queue",
"std::set",
"std::stack",
"std::unordered_map",
"std::unordered_multimap",
"std::unordered_multiset",
"std::unordered_set",
"std::vector",
]


@dataclass
classSymbol:
"""Symbol scraped from ELF binary object."""

mangled: str
demangled: str
defined: bool
disallowed: bool
sources: List[Path]


# Cached symbols dictionary.
symbols_cache: Optional[Dict[str, Symbol]] =None


deferror(message: str) ->NoReturn:
"""Emit an error message and kill the script."""
print(message)
sys.exit(STATUS_SCRIPT_ERROR)


defget_tool_output(args: List[str]) ->str:
"""Execute a command in the shell and return the output."""
result=subprocess.run(args, stdout=subprocess.PIPE)
output=result.stdout.decode("utf-8")
returnoutput


defread_nm(
nm: str, file: Path, exclude: Optional[List[str]] =None
) ->List[Tuple[str, str]]:
"""Read a set of symbols using the nm tool."""
ifexcludeisNone:
exclude= ["N"]

output=get_tool_output([nm, file])
result= []
forlineinoutput.splitlines():
match=re.search(NM_REGEX, line)
ifnotmatch:
continue

status=match.group("status").upper()
ifexcludeisNoneorstatusnotinexclude:
result.append((status, match.group("symbol")))
returnresult


defget_object_symbols(
nm: str, symbols: Dict[str, Symbol], object_file: Path, source_file: Path
) ->None:
"""Scrape symbols from a binary object."""
symbol_table=read_nm(nm, object_file)
fort, symbolinsymbol_table:
ifsymbolnotinsymbols:
symbols[symbol] =Symbol(
mangled=symbol,
demangled="",
defined=(t!="U"),
disallowed=False,
sources=[],
 )
ifsource_fileinsymbols[symbol].sources:
continue
symbols[symbol].sources.append(source_file)


defget_elf_dependencies(readelf: str, binary_file: Path) ->List[str]:
"""Get the shared object dependencies of a binary executable."""
shared_objects= []
output=get_tool_output([readelf, "-d", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DEP_REGEX, line)
ifnotmatch:
continue
shared_objects.append(match.group("so"))

returnshared_objects


defget_binary_dynamic_symbols(readelf: str, binary_file: Path) ->List[str]:
"""Get the dynamic symbols required by a binary executable."""
dynamic_symbols= []
output=get_tool_output([readelf, "--dyn-syms", "--wide", binary_file])
forlineinoutput.splitlines():
match=re.search(READELF_DYN_SYM_REGEX, line)
ifnotmatch:
continue
dynamic_symbols.append(match.group("symbol"))
returnlist(set(dynamic_symbols))


defdemangle_symbols(cxxfilt: str, mangled_symbols: Iterable[Symbol]) ->None:
"""Demangle a collection of symbols using the cxxfilt tool."""
output=get_tool_output([cxxfilt] + [symbol.mangledforsymbolinmangled_symbols])
forsymbol, demangledinzip(mangled_symbols, output.splitlines()):
symbol.demangled=demangled


defcheck_disallowed_symbols(cxxfilt: str, symbols: Iterable[Symbol]) ->None:
"""Check a collection of symbols for disallowed prefixes."""
forsymbolinsymbols:
assertlen(symbol.demangled) >0
ifsymbol.demangled.startswith(tuple(DISALLOW_LIST)):
symbol.disallowed=True


defget_cached_symbols(nm: str, build_root: Path) ->Dict[str, Symbol]:
"""Return a dictionary of symbols scraped from build files"""
globalsymbols_cache

ifsymbols_cacheisnotNone:
returnsymbols_cache
symbols= {}

ifnotbuild_root.is_dir():
error("Specified buck-out is not a directory")

forroot, _, filesinos.walk(build_root):
root_path=Path(root)
forfile_nameinfiles:
file_path=root_path/file_name
iffile_path.suffix==OBJECT_SUFFIX:
object_file_path=file_path
source_file_name=object_file_path.name[: -len(OBJECT_SUFFIX)]

object_file_rel=Path(os.path.relpath(object_file_path, build_root))
if"codegen"instr(object_file_path):
source_file_path=source_file_name+" (generated)"
else:
source_file_path= (
PROJECT_ROOT/object_file_rel.parent.parent/source_file_name
 )
get_object_symbols(nm, symbols, object_file_path, source_file_path)

symbols_cache=symbols
returnsymbols_cache


defcheck_dependencies(readelf: str, binary_file: Path) ->int:
"""Check that there are no shared object dependencies of a binary executable."""
elf_dependencies=get_elf_dependencies(readelf, binary_file)
iflen(elf_dependencies) >0:
print("Found the following shared object dependencies:")
fordependencyinelf_dependencies:
print(" *", dependency)
print()
returnSTATUS_ERROR
returnSTATUS_OK


defcheck_disallowed_symbols_build_dir(nm: str, cxxfilt: str, build_root: Path) ->int:
"""Check that there are no disallowed symbols used in intermediate build files."""
symbols=get_cached_symbols(nm, build_root)
symbol_list=list(symbols.values())
demangle_symbols(cxxfilt, symbol_list)
check_disallowed_symbols(cxxfilt, symbol_list)
disallowed_symbols=filter(lambdasymbol: symbol.disallowed, symbol_list)

disallowed_by_file= {}
forsymbolindisallowed_symbols:
forfileinsymbol.sources:
iffilenotindisallowed_by_file:
disallowed_by_file[file] = []
disallowed_by_file[file].append(symbol)

forfile, symbolsindisallowed_by_file.items():
print(f"{file} contains disallowed symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(disallowed_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defcheck_dynamic(
nm: str, readelf: str, cxxfilt: str, binary_file: Path, build_root: Optional[Path]
) ->int:
"""Check for dynamic symbols required by an executable, categorizing them from the
 intermediate files that may have included those symbols.
 """
symbols=get_cached_symbols(nm, build_root) ifbuild_rootisnotNoneelse {}

dynamic_symbols= []
binary_dyn_sym=get_binary_dynamic_symbols(readelf, binary_file)
forsymbolinbinary_dyn_sym:
ifsymbolsisnotNoneandsymbolinsymbols:
dynamic_symbols.append(symbols[symbol])
else:
dynamic_symbols.append(Symbol(symbol, "", False, False, []))
demangle_symbols(cxxfilt, dynamic_symbols)
check_disallowed_symbols(cxxfilt, dynamic_symbols)

dynamic_by_file= {}
global_dynamic= []
forsymbolindynamic_symbols:
iflen(symbol.sources) ==0:
global_dynamic.append(symbol)
continue

forfileinsymbol.sources:
iffilenotindynamic_by_file:
dynamic_by_file[file] = []
dynamic_by_file[file].append(symbol)

print("Executable relies on the following dynamic symbols:")
forfile, symbolsindynamic_by_file.items():
print(f"{file} contains dynamic symbols:")
forsymbolinsymbols:
print(" *", symbol.demangled)
print()

iflen(dynamic_by_file) >0:
returnSTATUS_ERROR

returnSTATUS_OK


defbubble_error(program_status, routine_status) ->int:
"""Bubble a routine's error status up to the program status."""
# A non-OK error status overrides an OK error status.
ifroutine_status==STATUS_OK:
returnprogram_status
elifprogram_status==STATUS_OK:
returnroutine_status
else:
returnmin(program_status, routine_status)


defmain() ->int:
"""Parse command line arguments and execute tool."""
parser=argparse.ArgumentParser(
description="A tool to help check binary dependencies and statically included symbols."
 )
parser.add_argument(
"--nm",
metavar="executable",
type=str,
help="Path of the nm tool executable",
default="nm",
 )
parser.add_argument(
"--readelf",
metavar="executable",
type=str,
help="Path of the readelf tool executable",
default="readelf",
 )
parser.add_argument(
"--cxxfilt",
metavar="executable",
type=str,
help="Path of the cxxfilt tool executable",
default="c++filt",
 )
parser.add_argument("--binary", metavar="binary", type=str, help="Binary to check")
parser.add_argument(
"--buck-out", metavar="dir", type=str, help="Buck output directory"
 )
parser.add_argument(
"--check-dependencies",
action="store_true",
help="Check shared library dependencies for a binary",
 )
parser.add_argument(
"--check-disallowed-symbols",
action="store_true",
help="Check for usage of disallowed symbols",
 )
parser.add_argument(
"--check-dynamic",
action="store_true",
help="Check for usage of dynamic symbols",
 )

args=parser.parse_args()

exit_status=STATUS_OK

ifargs.check_dependencies:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dependencies")
status=check_dependencies(args.readelf, Path(args.binary))
exit_status=bubble_error(exit_status, status)

ifargs.check_disallowed_symbols:
ifargs.buck_outisNone:
error("--buck-out flag must be specified when checking disallowed symbols")
status=check_disallowed_symbols_build_dir(
args.nm, args.cxxfilt, Path(args.buck_out)
 )
exit_status=bubble_error(exit_status, status)

ifargs.check_dynamic:
ifargs.binaryisNone:
error("--binary flag must be specified when checking dynamic symbol usage")
status=check_dynamic(
args.nm,
args.readelf,
args.cxxfilt,
Path(args.binary),
Path(args.buck_out) ifargs.buck_outisnotNoneelseNone,
 )
exit_status=bubble_error(exit_status, status)

returnexit_status


if__name__=="__main__":
sys.exit(main())