Created attachment 268215 [details] Build log $summary * QA Notice: The following files contain writable and executable sections * Files with such sections will not work properly (or at all!) on some * architectures/operating systems. A bug should be filed at * http://bugs.gentoo.org/ to make sure the issue is fixed. * For more information, see http://hardened.gentoo.org/gnu-stack.xml * Please include the following list of files in your report: * Note: Bugs should be filed for the respective maintainers * of the package in question and not hardened@g.o. * RWX --- --- usr/lib64/libgmx.so.6.0.0 ( is not a regression )
sorry, other rwx: * RWX --- --- usr/lib64/libgmx.so.6.0.0 * RWX --- --- usr/lib64/libgmx_mpi.so.6.0.0 * RWX --- --- usr/lib64/libgmx_d.so.6.0.0 * RWX --- --- usr/lib64/libgmx_mpi_d.so.6.0.0
add hardened from zorry's irc request [17:12:14] <Zorry> ago`: can you cc hardened?
Well here is what we have: Most of the files in gromacs seems to be non preprocessable assembly. This is quite bad since the fix needs them to be preprocessable. This can be solved by moving the .s files into .S files and fixing the build system so it recognises them. The next step is marking the stack non executable. For this adding: #if defined(__linux__) && defined(__ELF__) .section .note.GNU-stack,"",%progbits #endif in ATT assembly files and adding %ifidn __OUTPUT_FORMAT__,elf section .note.GNU-stack noalloc noexec nowrite progbits %endif in the intel assembly ones (seem to be the ones with _intel_syntax in the name) should fix the issue.
Ok. I created two patches for gromacs. One for ATT and one for GAS assembly since both patches are huge (~30M each) i put both of them on my devspace http://dev.gentoo.org/~alexxy/gromacs/
Also i commited changes for gromacs-4.5.4-r1
Hi alexxy, the alternative (albeit not as good a solution) would have been to pass -noexecstack ldflag. This doesn't fix the static libs, but it would have avoided the huge patches. Are you passing this along to upstream?
now is ok, fixed for me
Yep. Patch was send upstream
Fixed in gromacs-4.5.4-r1, thanks alexxy. Hopefully it will be included by upstream in 4.5.5.
