Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add binary cataloger for Nginx built from source #1945

Closed
blang9238 opened this issue Jul 17, 2023 · 1 comment · Fixed by #1988
Closed

Add binary cataloger for Nginx built from source #1945

blang9238 opened this issue Jul 17, 2023 · 1 comment · Fixed by #1988
Labels
binary-analysis enhancement New feature or request

Comments

@blang9238
Copy link

What would you like to be added:
Many organizations build Nginx (and other technologies) from source but when generating an SBOM using Syft on an image with Nginx built from source, no artifacts are included in the SBOM.

Why is this needed:
Vulnerability matches do not occur for packages built from source like Nginx.

Additional context:
Example make command in Dockerfile:

module=/tmp/nginx-upload-module-2.3.0 && \
    make && \
    make install
@blang9238 blang9238 added the enhancement New feature or request label Jul 17, 2023
@wagoodman
Copy link
Contributor

An initial glance shows it could be possible:

$ strings $(which nginx) | grep -i nginx

NGINX_BPI
/var/run/nginx.pid
nginx
getpwnam("nginx") failed
getgrnam("nginx") failed
/var/run/nginx.lock
/etc/nginx/
/etc/nginx/nginx.conf
/var/log/nginx/error.log
nginx version: nginx/1.25.1
NGINX
Usage: nginx [-?hvVtTq] [-s signal] [-p prefix]
  -p prefix     : set prefix path (default: /etc/nginx/)
  -e filename   : set error log file (default: /var/log/nginx/error.log)
  -c filename   : set configuration file (default: /etc/nginx/nginx.conf)
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -ffile-prefix-map=/data/builder/debuild/nginx-1.25.1/debian/debuild-base/nginx-1.25.1=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'
invalid socket number "%s" in NGINX environment variable, ignoring the rest of the variable
invalid socket number "%s" in NGINX environment variable, ignoring
nginx: [%V]
nginx was built without debug support
"debug_connection" is ignored, you need to rebuild nginx using --with-debug option to enable it
nginx_shared_zone
nginx:
nginx/1.25.1
nginx was built with Session Tickets support, however, now it is linked dynamically to an OpenSSL library which has no tlsext support, therefore Session Tickets are not available
NGINX_BPF_MAPS
ngx_quic_bpf_module failed to initialize properly, ignored.please check limits and note that nginx state now can be inconsistent and restart may be required
/var/cache/nginx/client_temp
/var/log/nginx/access.log
nginx_version
nginx was built with SNI support, however, now it is linked dynamically to an OpenSSL library which has no tlsext support, therefore SNI is not available
/var/cache/nginx/proxy_temp
/var/cache/nginx/fastcgi_temp
/var/cache/nginx/uwsgi_temp
/var/cache/nginx/scgi_temp
<hr><center>nginx</center>
<hr><center>nginx/1.25.1</center>
<hr><center>nginx/1.25.1</center>
Server: nginx/1.25.1
Server: nginx/1.25.1
Server: nginx

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
binary-analysis enhancement New feature or request
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

2 participants