Crate linux_abi_scan 

Static inspection of a built x86_64 Linux executable or shared object against a target’s glibc and kernel floors: tier 1 of the testing tiers.

Tier	How	Reliability
1. Inspect (this crate)	Read the ELF file; nothing runs	Exact for symbols, versions, and ELF notes; heuristic for syscalls in code
2. Simulate	Run tests under a seccomp filter or in a container (kernel-abi-tools)	Catches what actually executes; syscall availability and madvise only
3. Qualify	Run on a real host at the target’s minimums (e.g. SLES 12 SP5)	The only qualification

A scan reports what the file could do, not what it does: it cannot see syscalls made inside the C library, numbers computed at run time, libraries loaded with dlopen, new flags on old syscalls, or whether a program falls back when a call fails. Findings carry a Confidence.

The kernel data is the same that the seccomp profiles are built from (kernel_abi_tools::syscalls, madvise_advice, and a preset’s backports), so tiers 1 and 2 cannot disagree about what a kernel has.

Example

Scan a file against the CentOS 7 preset (glibc 2.17, Linux 3.10). The bytes here are a minimal x86_64 ELF file with no imports and no code; use scan_file for a file on disk.

use linux_abi_scan::{scan, ScanTarget, Severity};
use linux_targets::{Request, Selection};

let selection = Selection::resolve(&Request {
    distro: Some("centos-7"),
    ..Request::default()
})?;
let target = ScanTarget::from_selection(&selection);

// ELF header (64 bytes) and one empty section header (64 bytes).
let mut elf = vec![0u8; 128];
elf[..7].copy_from_slice(b"\x7fELF\x02\x01\x01"); // ELF64, little-endian
elf[16] = 2; // executable
elf[18] = 62; // x86_64
elf[40] = 64; // section headers at offset 64
elf[58] = 64; // section header size
elf[60] = 1; // one section header

let report = scan(&elf, &target)?;
assert_eq!(report.count(Severity::Error), 0);
assert_eq!(report.exit_code(false), 0);
print!("{}", report.to_text(true));

// Input that is not an x86_64 ELF file is an error, not a report.
assert!(scan(b"#!/bin/sh\n", &target).is_err());

A report without errors means only that the scan found nothing: it is not evidence that the file runs on the target. Confirm with tiers 2 and 3.

Modules

elf

A small, bounds-checked reader for x86_64 ELF64 little-endian executables and shared objects: just what the scan needs. Malformed input returns an error; nothing panics on untrusted bytes.

Structs

Finding

One thing the scan established about the file.

Report

The result of scanning one file.

ScanTarget

What to check against. None skips that side’s checks (host glibc or host kernel), and the report says so.

Enums

Confidence

How a finding was established.

Severity

How serious a finding is, from most to least serious.

Functions

scan

Scans an x86_64 ELF64 executable or shared object against target: its GLIBC_* requirements against the glibc floor, and its imported syscall wrappers, constant syscall() numbers, syscall instructions, madvise advice, ABI note and DT_RELR use against the kernel. A side whose floor is None is skipped, with a scope finding saying so.

scan_file

Scans the ELF file at path; see scan.