The test phase of =dev-libs/glib-2.38.2 aborts with the error message "Hardened adjustment failed" after trying and failing to set PaX flags on ${PORTAGE_TMPDIR}/dev-libs/glib-2.38.2/work/glib-2.38.2-amd64/tests/.libs/assert-msg-test . This fails because that file doesn't exist yet. If I run "find ${PORTAGE_TMPDIR)/dev-libs/glib-2.38.2/work | grep assert-msg-test" after the emerge aborts, this reports ${PORTAGE_TMPDIR}/dev-libs/glib-2.38.2/work/glib-2.38.2/tests/assert-msg-test.gdb , ${PORTAGE_TMPDIR}/dev-libs/glib-2.38.2/work/glib-2.38.2/tests/assert-msg-test.c , and ${PORTAGE_TMPDIR}/dev-libs/glib-2.38.2/work/glib-2.38.2/tests/run-assert-msg-test.sh , but no compiled files. Reproducible: Always Steps to Reproduce: 1. FEATURES=test emerge -1 =dev-libs/glib-2.38.2 Actual Results: Aborts after failing to PaX-mark not-yet-built assert-msg-test Expected Results: Tests should build, run, and pass I'll attach a build log momentarily. emerge --info: Portage 2.2.8-r1 (hardened/linux/amd64, gcc-4.7.3, glibc-2.15-r3, 3.11.7-hardened-r1 x86_64) ================================================================= System Settings ================================================================= System uname: Linux-3.11.7-hardened-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T6670_@_2.20GHz-with-gentoo-2.2 KiB Mem: 6068224 total, 210048 free KiB Swap: 6292476 total, 4020204 free Timestamp of tree: Sun, 09 Mar 2014 16:45:01 +0000 ld GNU ld (GNU Binutils) 2.23.1 distcc 3.1 x86_64-pc-linux-gnu [disabled] app-shells/bash: 4.2_p45 dev-java/java-config: 2.2.0 dev-lang/python: 2.7.5-r3, 3.3.3 dev-util/cmake: 2.8.11.2 dev-util/pkgconfig: 0.28 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.12.4 sys-apps/sandbox: 2.6-r1 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.9.6-r3, 1.11.6, 1.12.6, 1.13.3 sys-devel/binutils: 2.23.1 sys-devel/gcc: 4.7.3-r1 sys-devel/gcc-config: 1.7.3 sys-devel/libtool: 2.4-r1 sys-devel/make: 3.82-r4 sys-kernel/linux-headers: 3.9 (virtual/os-headers) sys-libs/glibc: 2.15-r3 Repositories: gentoo lovelace seden sunrise gentoo-haskell luman x-portage Installed sets: @archivers, @backup-options, @devel, @dicts, @doc-conv, @docs, @emulation, @fonts, @laptop, @maintenance, @office, @sp-devel ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=core2" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="${CONFIG_PROTECT} /etc /etc/idea/conf /usr/share/config /usr/share/gnupg/qualified.txt /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -march=core2" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps y" FCFLAGS="-O2 -pipe -march=core2" FEATURES="assume-digests binpkg-logs candy collision-protect config-protect-if-modified distlocks ebuild-locks fakeroot fixlafiles merge-sync news parallel-fetch parallel-install preserve-libs protect-owned sandbox sfperms strict test unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync webrsync-gpg xattr" FFLAGS="-O2 -pipe -march=core2" GENTOO_MIRRORS="http://lug.mtu.edu/gentoo/ http://gentoo.osuosl.org/ http://gentoo.cites.uiuc.edu/pub/gentoo/ http://distfiles.gentoo.org" LANG="en_US.UTF-8" LC_ALL="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/lovelace /var/lib/layman/seden /var/lib/layman/sunrise /var/lib/layman/haskell /var/lib/layman/luman /usr/local/portage" SYNC="rsync://rsync.namerica.gentoo.org/gentoo-portage" USE="acpi alsa amd64 bash-completion berkdb bzip2 cddb cli cracklib crypt cxx dri gdbm hardened iconv ipv6 jaa java6 jpeg justify libnotify libsecret lm_sensors mmx modules multilib ncurses nls nptl ogg openmp pam pax_kernel pcre png readline session sse sse2 sse3 ssl ssse3 startup-notification tcpd test theora truetype unicode urandom vorbis xcomposite xft xtpax zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="sheets words plan kexi braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="pdfimport wiki-publisher" LINGUAS="en en_US" NETBEANS_MODULES="cnd harness ide java nb javafx groovy profile" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19 ruby18" USERLAND="GNU" VIDEO_CARDS="intel fbdev i915" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Created attachment 372232 [details] Build log showing failure
With glib-2.38.2-r1, I'm getting an assertion failure on ia64. From test-suite.log: ======================================= glib 2.38.2: tests/test-suite.log ======================================= # TOTAL: 28 # PASS: 27 # SKIP: 0 # XFAIL: 0 # FAIL: 1 # XPASS: 0 # ERROR: 0 .. contents:: :depth: 2 FAIL: run-assert-msg-test.sh ============================ Test failed: __glib_assert_msg does not have assertion message It _is_ 2.38.2-r1, not 2.38.2 as recorded in test-suite.log. Émeric
I can confirm the initial report.
Not sure if hardened will know about what is wrong with that pax markings
(In reply to Pacho Ramos from comment #4) > Not sure if hardened will know about what is wrong with that pax markings Off the top of my head, I would guess this is because of the order in which things are built. So you may need to patch the build system so that the pax markings are done immediately after the file is built. We provide /usr/sbin/paxmark.sh from the sys-apps/elfix package which is just a simple bash script that does the same pax markings the eclass does, but can be invoked in the middle of a build.
Uh, paradoxically we try packages to build tests only when needed with make check and, in cases like this, would be better to make them build, later pax-mark and, after that, run the tests :(
Patch run-assert-msg-test.sh so it run paxmark.sh with the needed flags before it run the test.
*** Bug 567510 has been marked as a duplicate of this bug. ***
I get the same failure message in the test-suite.log. However, while I am also on a hardened profile, I have a vanilla kernel. Thus, there should be no interference from PAX on my system, but the test still fails. It looks like there are two issues: one with the pax-markings and another with the test (on hardened systems?) itself. ======================================= glib 2.48.0: tests/test-suite.log ======================================= # TOTAL: 28 # PASS: 27 # SKIP: 0 # XFAIL: 0 # FAIL: 1 # XPASS: 0 # ERROR: 0 .. contents:: :depth: 2 FAIL: run-assert-msg-test.sh ============================ Test failed: __glib_assert_msg does not have assertion message FAIL run-assert-msg-test.sh (exit status: 1)
This failure is still present in glib-2.50.3. I fiddled around a little with tests/run-assert-msg.test.sh and the output of $LIBTOOL --mode=execute gdb --batch -x ${srcdir:-.}/assert-msg-test.gdb ./assert-msg-test (the part of the test which leads to the failure) is ---- warning: Cannot call inferior functions, Linux kernel PaX protection forbids return to non-executable pages! ** GLib:ERROR:/var/tmp/portage/dev-libs/glib-2.50.3/work/glib-2.50.3/tests/assert-msg-test.c:5:main: assertion failed: (42 < 0) Checking if assert message is in __glib_assert_msg [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Program received signal SIGABRT, Aborted. 0x000003fff773221b in raise () from /lib64/libc.so.6 $1 = 0xffffffffaacabef0 <error: Cannot access memory at address 0xffffffffaacabef0> A debugging session is active. Inferior 1 [process 5062] will be killed. Quit anyway? (y or n) [answered Y; input not from terminal] ---- The dmesg entry is (as mentioned already somewhere else): ---- grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /var/tmp/portage/dev-libs/glib-2.50.3/work/glib-2.50.3-abi_x86_64.amd64/tests/.libs/assert-msg-test[assert-msg-test:7609] uid/euid:250/250 gid/egid:250/250, parent /var/tmp/portage/dev-libs/glib-2.50.3/work/glib-2.50.3/tests/run-assert-msg-test.sh[run-assert-msg-:7608] uid/euid:250/250 gid/egid:250/250 PAX: execution attempt in: <anonymous mapping>, 39b566fb000-39b568a7000 39b566fb000 PAX: terminating task: /usr/bin/gdb(gdb):7661, uid/euid: 250/250, PC: 0000039b566fb000, SP: 000003a12f0f7de0 PAX: bytes at PC: cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PAX: bytes at SP-8: 0000039b566fb000 000003a12f0f7e20 48e89f33de75ce00 0000000000000000 000000111aeeffc0 000000111a85d310 0000000000001dea 000000111d9ab4d0 000000111d90c150 000003a12f0f7eb0 000000111a6bb209 grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/bin/gdb[gdb:7661] uid/euid:250/250 gid/egid:250/250, parent /usr/bin/gdb[gdb:7626] uid/euid:250/250 gid/egid:250/250 ---- This is on an amd64 hardened system with PaX enabled in the kernel. Note that for this output I've already modified the PaX markings of tests/.libs/assert-msg-test by hand. The markings are: # paxctl-ng -v /var/tmp/portage/dev-libs/glib-2.50.3/work/glib-2.50.3-abi_x86_64.amd64/tests/.libs/assert-msg-test /var/tmp/portage/dev-libs/glib-2.50.3/work/glib-2.50.3-abi_x86_64.amd64/tests/.libs/assert-msg-test: PT_PAX : -emr- XATTR_PAX : -emr-
Looks like bug 676440 was a duplicate of this. I've removed pax marking from 2.60.6. No, I don't know what that will mean for pax systems, but this is not really supported much anymore, plus this is just a test too, anyways.
