Error: SHELLCHECK_WARNING (CWE-156): [#def1] /usr/bin/fixfiles:46:7: warning[SC2046]: Quote this to prevent word splitting. # 44| FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" # 45| for i in $FS; do # 46|-> if [ `useseclabel` -ge 0 ] # 47| then # 48| grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i Error: SHELLCHECK_WARNING (CWE-569): [#def2] /usr/bin/fixfiles:157:103: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 155| LogReadOnly # 156| for m in `echo $FILESYSTEMSRW`; do # 157|-> find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${FORCEFLAG} ${VERBOSE} ${THREADS} $* -i -0 -f - # 158| done; # 159| } Error: SHELLCHECK_WARNING (CWE-477): [#def3] /usr/bin/fixfiles:172:18: warning[SC2166]: Prefer [ p ] && [ q ] as [ p -a q ] is not well defined. # 170| LogExcluded # 171| # 172|-> if [ -f ${PREFC} -a -x /usr/bin/diff ]; then # 173| TEMPFILE=`mktemp ${FC}.XXXXXXXXXX` # 174| test -z "$TEMPFILE" && exit Error: SHELLCHECK_WARNING (CWE-569): [#def4] /usr/bin/fixfiles:201:66: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 199| fi; # 200| done | # 201|-> ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -i -R -f -; # 202| rm -f ${TEMPFILE} ${PREFCTEMPFILE} # 203| fi Error: SHELLCHECK_WARNING (CWE-569): [#def5] /usr/bin/fixfiles:224:64: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 222| mkdir -p "${TMP_MOUNT}${m}" || exit 1 # 223| mount --bind "${m}" "${TMP_MOUNT}${m}" || exit 1 # 224|-> ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}" # 225| umount "${TMP_MOUNT}${m}" || exit 1 # 226| rm -rf "${TMP_MOUNT}" || echo "Error cleaning up." Error: SHELLCHECK_WARNING (CWE-569): [#def6] /usr/bin/fixfiles:240:18: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 238| # [-B | -N time ] # 239| if [ -n "$BOOTTIME" ]; then # 240|-> newer $BOOTTIME $* # 241| return # 242| fi Error: SHELLCHECK_WARNING (CWE-569): [#def7] /usr/bin/fixfiles:246:19: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 244| # -C PREVIOUS_FILECONTEXT # 245| if [ "$RESTORE_MODE" == PREFC ]; then # 246|-> diff_filecontext $* # 247| return # 248| fi Error: SHELLCHECK_WARNING (CWE-569): [#def8] /usr/bin/fixfiles:258:83: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 256| RPMFILES) # 257| for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do # 258|-> rpmlist $i | ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -i -R -f - # 259| done # 260| ;; Error: SHELLCHECK_WARNING (CWE-569): [#def9] /usr/bin/fixfiles:262:66: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 260| ;; # 261| FILEPATH) # 262|-> ${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} ${THREADS} $* -R -- "$FILEPATH" # 263| ;; # 264| *) Error: SHELLCHECK_WARNING (CWE-569): [#def10] /usr/bin/fixfiles:270:61: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 268| # 269| if [ -z "$BIND_MOUNT_FILESYSTEMS" ]; then # 270|-> ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${THREADS} ${FC} ${FILESYSTEMSRW} # 271| else # 272| # we bind mount so we can fix the labels of files that have already been Error: SHELLCHECK_WARNING (CWE-569): [#def11] /usr/bin/fixfiles:281:43: warning[SC2048]: Use "$@" (with quotes) to prevent whitespace problems. # 279| else # 280| trap umount_TMP_MOUNT EXIT # 281|-> fix_labels_on_mountpoint $* # 282| trap EXIT # 283| fi Error: SHELLCHECK_WARNING (CWE-477): [#def12] /usr/bin/fixfiles:314:29: warning[SC2166]: Prefer [ p ] && [ q ] as [ p -a q ] is not well defined. # 312| # 313| relabel() { # 314|-> if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then # 315| usage # 316| exit 1 Error: SHELLCHECK_WARNING (CWE-477): [#def13] /usr/bin/fixfiles:331:24: warning[SC2166]: Prefer [ p ] || [ q ] as [ p -o q ] is not well defined. # 329| Do you wish to clean out the /tmp directory [N]? " # 330| read answer # 331|-> if [ "$answer" = y -o "$answer" = Y ]; then # 332| fullrelabel # 333| else Error: SHELLCHECK_WARNING (CWE-477): [#def14] /usr/bin/fixfiles:348:26: warning[SC2166]: Prefer [ p ] && [ q ] as [ p -a q ] is not well defined. # 346| relabel) relabel;; # 347| onboot) # 348|-> if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then # 349| usage # 350| exit 1 Error: SHELLCHECK_WARNING (CWE-569): [#def15] /usr/bin/fixfiles:352:2: warning[SC2188]: This redirection doesn't have a command. Move to its command (or use 'true' as no-op). # 350| exit 1 # 351| fi # 352|-> > /.autorelabel || exit $? # 353| [ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel # 354| [ -z "$BOOTTIME" ] || echo -n "-N $BOOTTIME " >> /.autorelabel Error: SHELLCHECK_WARNING (CWE-156): [#def16] /usr/libexec/selinux/selinux-autorelabel:78:16: warning[SC2046]: Quote this to prevent word splitting. # 76| # Check to see if a full relabel is needed # 77| if [ "$READONLY" != "yes" ]; then # 78|-> restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1 # 79| relabel_selinux # 80| fi Error: SHELLCHECK_WARNING (CWE-571): [#def17] /usr/share/sandbox/sandboxX.sh:4:8: warning[SC2155]: Declare and assign separately to avoid masking return values. # 2| trap "" TERM # 3| context=`id -Z | secon -t -l -P` # 4|-> export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8-80`" # 5| [ -z $1 ] && export WAYLAND_NATIVE="no" || export WAYLAND_NATIVE="$1" # 6| [ -z $2 ] && export SCREENSIZE="1000x700" || export SCREENSIZE="$2" Error: COMPILER_WARNING (CWE-704): [#def18] selinux-3.10/policycoreutils/secon/secon.c: scope_hint: In function ‘my_getXcon_raw’ selinux-3.10/policycoreutils/secon/secon.c:365:29: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type # 365 | char *tmp = strchr(ptr, '\n'); # | ^~~~~~ # 363| *con = NULL; # 364| if (ptr) { /* return *con = NULL, when proc file is empty */ # 365|-> char *tmp = strchr(ptr, '\n'); # 366| # 367| if (tmp) Error: COMPILER_WARNING (CWE-704): [#def19] selinux-3.10/policycoreutils/secon/secon.c:365:29: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type # 363| *con = NULL; # 364| if (ptr) { /* return *con = NULL, when proc file is empty */ # 365|-> char *tmp = strchr(ptr, '\n'); # 366| # 367| if (tmp) Error: GCC_ANALYZER_WARNING (CWE-476): [#def20] selinux-3.10/policycoreutils/setsebool/setsebool.c:283:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘value_ptr’ selinux-3.10/policycoreutils/setsebool/setsebool.c:229:12: branch_false: following ‘false’ branch (when ‘vallist’ is non-NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:229:12: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:235:20: branch_false: following ‘false’ branch (when ‘value_ptr’ is non-NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:241:17: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:259:20: branch_false: following ‘false’ branch... selinux-3.10/policycoreutils/setsebool/setsebool.c:261:17: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:269:12: branch_false: following ‘false’ branch... selinux-3.10/policycoreutils/setsebool/setsebool.c:273:21: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:273:20: branch_false: following ‘false’ branch... selinux-3.10/policycoreutils/setsebool/setsebool.c:278:15: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:280:16: branch_true: following ‘true’ branch (when ‘i < end’)... selinux-3.10/policycoreutils/setsebool/setsebool.c:281:28: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:283:17: danger: dereference of NULL ‘value_ptr’ # 281| name = list[i]; # 282| value_ptr = strchr(name, '='); # 283|-> *value_ptr = '\0'; # 284| value_ptr++; # 285| if (pwd && pwd->pw_name) Error: GCC_ANALYZER_WARNING (CWE-401): [#def21] selinux-3.10/policycoreutils/setsebool/setsebool.c:308:17: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’ selinux-3.10/policycoreutils/setsebool/setsebool.c:229:12: branch_false: following ‘false’ branch (when ‘vallist’ is non-NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:229:12: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:232:16: branch_true: following ‘true’ branch (when ‘i < end’)... selinux-3.10/policycoreutils/setsebool/setsebool.c:233:28: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:235:20: branch_false: following ‘false’ branch (when ‘value_ptr’ is non-NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:241:17: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:243:20: branch_true: following ‘true’ branch (when the strings are equal)... selinux-3.10/policycoreutils/setsebool/setsebool.c:257:24: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:258:35: acquire_memory: allocated here selinux-3.10/policycoreutils/setsebool/setsebool.c:259:20: branch_false: following ‘false’ branch... selinux-3.10/policycoreutils/setsebool/setsebool.c:261:17: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:232:16: branch_true: following ‘true’ branch (when ‘i < end’)... selinux-3.10/policycoreutils/setsebool/setsebool.c:233:28: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:235:20: branch_true: following ‘true’ branch (when ‘value_ptr’ is NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:236:25: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:305:12: branch_true: following ‘true’ branch (when ‘vallist’ is non-NULL)... selinux-3.10/policycoreutils/setsebool/setsebool.c:305:12: branch_true: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:306:29: branch_false: following ‘false’ branch (when ‘i >= boolcnt’)... selinux-3.10/policycoreutils/setsebool/setsebool.c:308:17: branch_false: ...to here selinux-3.10/policycoreutils/setsebool/setsebool.c:308:17: danger: ‘<unknown>’ leaks here; was allocated at [(10)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/9) # 306| for (i = 0; i < boolcnt; i++) # 307| free(vallist[i].name); # 308|-> free(vallist); # 309| } # 310| return -1; Error: GCC_ANALYZER_WARNING (CWE-401): [#def22] selinux-3.10/sandbox/seunshare.c:753:20: warning[-Wanalyzer-malloc-leak]: leak of ‘new_pid_table’ selinux-3.10/sandbox/seunshare.c:726:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:730:21: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:731:12: branch_false: following ‘false’ branch (when ‘pid_table’ is non-NULL)... selinux-3.10/sandbox/seunshare.c:736:25: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:737:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:742:33: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:744:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:750:13: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:756:20: branch_false: following ‘false’ branch (when ‘pids != max_pids’)... selinux-3.10/sandbox/seunshare.c:772:27: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:756:20: branch_true: following ‘true’ branch (when ‘pids == max_pids’)... selinux-3.10/sandbox/seunshare.c:757:25: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:758:28: branch_false: following ‘false’ branch (when ‘pids < max_pids’)... selinux-3.10/sandbox/seunshare.c:764:48: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:764:48: acquire_memory: allocated here selinux-3.10/sandbox/seunshare.c:765:28: branch_false: following ‘false’ branch (when ‘new_pid_table’ is non-NULL)... selinux-3.10/sandbox/seunshare.c:772:27: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:753:20: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:756:20: branch_true: following ‘true’ branch (when ‘pids == max_pids’)... selinux-3.10/sandbox/seunshare.c:757:25: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:758:28: branch_false: following ‘false’ branch (when ‘pids < max_pids’)... selinux-3.10/sandbox/seunshare.c:764:48: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:765:28: branch_true: following ‘true’ branch (when ‘new_pid_table’ is NULL)... selinux-3.10/sandbox/seunshare.c:766:33: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:753:20: danger: ‘new_pid_table’ leaks here; was allocated at [(21)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/20) # 751| printf("mcs=%s type=%s\n", mcs, type); # 752| while ((de = readdir (dir)) != NULL) { # 753|-> if (!(pid = (pid_t)atoi(de->d_name)) || pid == self) # 754| continue; # 755| Error: GCC_ANALYZER_WARNING (CWE-762): [#def23] selinux-3.10/sandbox/seunshare.c:764:48: warning[-Wanalyzer-mismatching-deallocation]: ‘pid_table’ should have been deallocated with ‘free’ but was deallocated with ‘reallocarray’ selinux-3.10/sandbox/seunshare.c:726:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:730:21: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:730:21: acquire_memory: allocated here (expects deallocation with ‘free’) selinux-3.10/sandbox/seunshare.c:731:12: branch_false: following ‘false’ branch (when ‘pid_table’ is non-NULL)... selinux-3.10/sandbox/seunshare.c:736:25: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:737:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:742:33: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:744:12: branch_false: following ‘false’ branch... selinux-3.10/sandbox/seunshare.c:750:13: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:756:20: branch_false: following ‘false’ branch (when ‘pids != max_pids’)... selinux-3.10/sandbox/seunshare.c:772:27: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:752:16: branch_true: following ‘true’ branch... selinux-3.10/sandbox/seunshare.c:753:41: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:756:20: branch_true: following ‘true’ branch (when ‘pids == max_pids’)... selinux-3.10/sandbox/seunshare.c:757:25: branch_true: ...to here selinux-3.10/sandbox/seunshare.c:758:28: branch_false: following ‘false’ branch (when ‘pids < max_pids’)... selinux-3.10/sandbox/seunshare.c:764:48: branch_false: ...to here selinux-3.10/sandbox/seunshare.c:764:48: danger: deallocated with ‘reallocarray’ here; allocation at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2) expects deallocation with ‘free’ # 762| return -1; # 763| } # 764|-> pid_t *new_pid_table = reallocarray(pid_table, max_pids, sizeof(pid_t)); # 765| if (!new_pid_table) { # 766| free(pid_table);
| analyzer-version-clippy | 1.95.0 |
| analyzer-version-cppcheck | 2.20.0 |
| analyzer-version-gcc | 16.1.1 |
| analyzer-version-gcc-analyzer | 16.1.1 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-90.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | policycoreutils-3.10-4.fc45 |
| store-results-to | /tmp/tmp31ss2m5t/policycoreutils-3.10-4.fc45.tar.xz |
| time-created | 2026-06-01 15:54:15 |
| time-finished | 2026-06-01 15:55:46 |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmp31ss2m5t/policycoreutils-3.10-4.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp31ss2m5t/policycoreutils-3.10-4.fc45.src.rpm' |
| tool-version | csmock-3.8.5.20260529.133039.g6f3b5c6-1.el9 |