grsec: denied RWX mprotect of /opt/googleearth/libIGGfx.so by /opt/googleearth/googleearth-bin[googleearth-bin:16921] uid/euid:1000/1000 gid/egid:1000/1000, parent /opt/googleearth/googleearth[googleearth:16915] uid/euid:1000/1000 gid/egid:1000/1000 The usual 'fix' fails #paxctl -m /opt/googleearth/libIGGfx.so file /opt/googleearth/libIGGfx.so is not a valid ELF executable (invalid SHT_ entry:1) # file /opt/googleearth/libIGGfx.so /opt/googleearth/libIGGfx.so: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=0xd6127766bf4b4c3c17901341d8597a95c604eff1, stripped emerge --info =sci-geosciences/googleearth-6.2.2.6613 Portage 2.2.0_alpha135 (hardened/linux/amd64, gcc-4.7.2, glibc-2.15-r3, 3.5.4-hardened-r2 x86_64) ================================================================= System Settings ================================================================= System uname: Linux-3.5.4-hardened-r2-x86_64-Intel-R-_Core-TM-_i5-2320_CPU_@_3.00GHz-with-gentoo-2.2 Timestamp of tree: Fri, 05 Oct 2012 16:45:01 +0000 app-shells/bash: 4.2_p37 dev-java/java-config: 2.1.12 dev-lang/python: 2.7.3-r2, 3.2.3-r1 dev-util/cmake: 2.8.9-r1 dev-util/pkgconfig: 0.27.1 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.10.5 sys-apps/sandbox: 2.6 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.11.6, 1.12.4 sys-devel/binutils: 2.22.90 sys-devel/gcc: 4.6.3, 4.7.2 sys-devel/gcc-config: 1.7.3 sys-devel/libtool: 2.4.2 sys-devel/make: 3.82-r4 sys-kernel/linux-headers: 3.6 (virtual/os-headers) sys-libs/glibc: 2.15-r3 Repositories: gentoo raw raiagent x11 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -mtune=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/openvpn/easy-rsa /var/bind" CONFIG_PROTECT_MASK="${EPREFIX}/etc/gconf /etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/games/angband/edit/ /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.4/ext-active/ /etc/php/cgi-php5.4/ext-active/ /etc/php/cli-php5.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=native -mtune=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps y" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg config-protect-if-modified distlocks ebuild-locks fixlafiles news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch xattr" FFLAGS="-march=native -mtune=native -O2 -pipe" GENTOO_MIRRORS="http://mirrors.linuxant.fr/distfiles.gentoo.org/ http://mirror.qubenet.net/mirror/gentoo/ http://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/ ftp://mirrors.linuxant.fr/distfiles.gentoo.org/ ftp://mirror.qubenet.net/mirror/gentoo/" LANG="en_GB.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="en_GB en fr" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/raw /var/lib/layman/raiagent /var/lib/layman/x11" SYNC="rsync://rsync.uk.gentoo.org/gentoo-portage" USE="X a52 aac acl alsa amd64 apache2 berkdb branding bzip2 cairo caps cdda cddb cli cracklib crypt cups cxx dbus directfb doc dri dts dvd emacs encode examples exif fam ffmpeg flac fontconfig fortran gd gdbm geoip gif gmp gnome gnome-keyring gnutls gpm gstreamer gtk hardened iconv icu imagemagick ipv6 java jpeg jpeg2k justify kde lcms libnotify lua lzma mad matroska milter mmx mng modules mp3 mpeg mudflap multilib mysql ncurses nls nptl nsplugin ogg opengl openmp pam pax_kernel pcre perl pfd png policykit postgres ppds pppd pulseaudio python qt4 raw readline sdl semantic-desktop session speex spell sqlite sqlite3 sse sse2 sse3 ssl ssse3 startup-notification svg tcpd theora threads tiff tk truetype udev unicode urandom usb vim-syntax vorbis x264 xattr xcb xml xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="braindump flow karbon kexi krita sheets words" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_GB en fr" PHP_TARGETS="php5-3" PYTHON_TARGETS="python3_2 python2_7" RUBY_TARGETS="ruby18 ruby19" USERLAND="GNU" VIDEO_CARDS="nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON ================================================================= Package Settings ================================================================= sci-geosciences/googleearth-6.2.2.6613 was built with the following: USE="(multilib) qt-bundled -mdns-bundled"
add full build log
(In reply to comment #1) > add full build log * Package: sci-geosciences/googleearth-6.2.2.6613 * Repository: gentoo * Maintainer: caster@gentoo.org * USE: amd64 elibc_glibc kernel_linux multilib qt-bundled userland_GNU * FEATURES: preserve-libs sandbox >>> cfg-update-1.8.2-r1: Creating checksum index... >>> Unpacking source... >>> Unpacking GoogleEarthLinux-6.2.2.6613_amd64.deb to /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work >>> Unpacking data.tar.lzma to /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work removed ‘libcurl.so.4’ removed ‘libnss_mdns4_minimal.so.2’ >>> Source unpacked in /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work >>> Preparing source in /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work/opt/google/earth/free ... >>> Source prepared. >>> Configuring source in /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work/opt/google/earth/free ... >>> Source configured. >>> Compiling source in /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/work/opt/google/earth/free ... >>> Source compiled. >>> Test phase [not enabled]: sci-geosciences/googleearth-6.2.2.6613 >>> Install googleearth-6.2.2.6613 into /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/image/ category sci-geosciences >>> Completed installing googleearth-6.2.2.6613 into /var/tmp/portage/sci-geosciences/googleearth-6.2.2.6613/image/ * QA Notice: This package installs one or more .desktop files that do not * pass validation. * * /usr/share/applications/google-earth.desktop: error: file contains key "MultipleArgs" in group "Desktop Entry", but keys extending the format should start with "X-" * /usr/share/applications/google-earth.desktop: error: value "Application;Network" for string list key "Categories" in group "Desktop Entry" does not have a semicolon (';') as trailing character * /usr/share/applications/google-earth.desktop: error: value "application/vnd.google-earth.kml+xml;application/vnd.google-earth.kmz;application/earthviewer;application/keyhole" for string list key "MimeType" in group "Desktop Entry" does not have a semicolon (';') as trailing character * >>> Done. * Updating desktop mime database ... * Updating shared mime info database ... * The qt-bundled flag is now enabled by default due to crashes on startup with system Qt. * Testing and reporting outcome with/without the flag is welcome (bug #319813). * If it crashes in both cases, disabling tips is reported to help (bug #354281): * * When you get a crash starting Google Earth, try adding a file ~./config/Google/GoogleEarthPlus.conf * the following options: * lastTip = 4 * enableTips = false * * In addition, the use of free video drivers may be problems associated with using the Mesa * library. In this case, Google Earth 6x likely only works with the Gallium3D variant. * To select the 32bit graphic library use the command: * eselect mesa list * For example, for Radeon R300 (x86): * eselect mesa set r300 2 * For Intel Q33 (amd64): * eselect mesa set 32bit i965 2 * You may need to restart X afterwards /var/log/portage/sci-geosciences:googleearth-6.2.2.6613:20121005-205215.log lines 1-51/51 (END)
*** Bug 456206 has been marked as a duplicate of this bug. ***
+ 10 Feb 2013; Julian Ospald <hasufell@gentoo.org> + googleearth-7.0.2.8415-r1.ebuild: + pax-mark for hardened wrt #437336
