Summary: | sys-devel/llvm-2.9-r2 fails test on hardened | ||
---|---|---|---|
Product: | Gentoo Linux | Reporter: | Nikoli <nikoli> |
Component: | [OLD] Core system | Assignee: | Bernard Cafarelli <voyageur> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | gentoo, hardened, ryao, wuodan-gentoo |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Package list: | Runtime testing required: | --- | |
Attachments: |
dmesg
llvm-2.9-r2.ebuild.diff llvm-3.0-r2.ebuild.diff llvm-3.1-r1.ebuild.diff llvm-9999.ebuild.diff |
Description
Nikoli
2012-01-23 12:58:21 UTC
Created attachment 299611 [details]
dmesg
llvm + hardened = welcome to a world of pain! Okay, joking aside, here's what's going. On pax hardened kernel with CONFIG_PAX_MPROTECT enable, RWX mmappings are going to lead to the process being killed. You have one of two choices: 1) either use paxctl to exempt that binary from having mprotect enforced (in an ebuild inherit pax-utils and pax-mark -m) or 2) disable CONFIG_PAX_MPROTECT. The former is the better solution because it relaxes security on just one/some binaries rather than the whole system. However, the story does not end with just pax marking llvm's binaries, because binaries generated by llvm may themselves contain RWX mmappings in which case they will also be killed under MPROTECT. This is the case with mesa/gallium. Just to add on what blueness said, here is the status with LLVM. LLVM (and its libraries) does RWX mappings to support JIT code execution of the code being compiled, this is the case for example with gallium shaders. LLVM has code, for Mac OS X systems, to do instead RW then RX following the restrictions of the W^X applied on some *BSD kernels. This code could be used if Pax had a way to support JIT code, but Pax explicitly disables the execution of any JIT code, so any mapping which was once writable cannot be turned executable. Finally on systems (and for users) not enforced by grsec TPE. You can try to modify the code to mmap the pages from a file (maybe on shm) and when changing permissions unmap them and mmap them again (which means they may end up in other address) I'm not sure of how well can LLVM cope with this address change and I still think this could be a performance killer if linux tries to copy the pages on kernel space from either disk or the memory device. Then we also have the fact that the TLB is flushed each time a system call is done on a hardened kernel with amd64 which means we want to reduce those to reduce pressure on memory. llvm on hardened definitely sounds fun :) On llvm itself, I'm not sure we can easily tweak the test system to separate build and run steps (so we can do pax-marking) Though from klondike's comment, the pax-marking may be required on llvm library and binaries themselves? (In reply to comment #4) > llvm on hardened definitely sounds fun :) > > On llvm itself, I'm not sure we can easily tweak the test system to separate > build and run steps (so we can do pax-marking) > > Though from klondike's comment, the pax-marking may be required on llvm library > and binaries themselves? For now only on binaries, once revdep-pax is out the library will need to be marked too. Someone in IRC informed me that this can no longer be reproduced. Please try to reproduce it with the latest software and let us know if this is still a problem. That person informed me that this bug is still valid. I am reopening it. That was me. I can confirm that this still happens with llvm versions: 2.9-r2 ~3.0-r2 ~3.1 on both kernels: - linux-3.2.2-hardened-r1 - linux-3.4.2-hardened Errors are like: LLVM ERROR: Allocation failed when allocating new memory in the JIT Can't allocate RWX Memory: Operation not permitted From my understanding the original poster Nikoli is correct: Calls to JIT do not work unless MPROTECT is disabled. Something like he suggested might fix this. I found that adding the following to src_compile() fixes the test-phase: pax-mark m Release/bin/lli if use test; then pax-mark m unittests/ExecutionEngine/JIT/Release/JITTests fi This works on amd64 for ebuilds: - llvm-2.9-r2.ebuild - llvm-3.0-r2.ebuild - llvm-3.1-r1.ebuild - llvm-9999.ebuild Does not work on llvm-2.8-r2.ebuild. I not bored enough to provide a patch for this also unless specifically asked for. Adding diff files for the mentioned versions next. Created attachment 316967 [details, diff]
llvm-2.9-r2.ebuild.diff
Created attachment 316969 [details]
llvm-3.0-r2.ebuild.diff
Created attachment 316971 [details]
llvm-3.1-r1.ebuild.diff
Created attachment 316973 [details]
llvm-9999.ebuild.diff
Thanks! Don't worry about 2.8, going back to 2.9 is more than enough. I've updated the other versions All tests work fine for sys-devel/llvm-3.1, thank you :) |