Instead of the ever-messier text parsing of the output of the readelf tool (which is clearly meant for human consumption not to be machine parseable), parse the ELF binaries directly.
Add a small dependency-less ELF parser specific to the checks.
This is slightly more secure, too, because it removes potential ambiguity due to misparsing and changes in the output format of elfread
. It also allows for stricter and more specific ELF format checks in the future.
This removes the build-time dependency for readelf
.
It passes the test-security-check for me locally, though I haven’t checked on all platforms. I’ve checked that this works on the cross-compile output for all ELF platforms supported by Bitcoin Core at the moment, as well as PPC64 LE and BE.