Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 133427 - xorg-x11 doesn't run when built with GCC Hardened (PIE patches)
Summary: xorg-x11 doesn't run when built with GCC Hardened (PIE patches)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: AMD64 Linux
: High normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-05-15 17:21 UTC by BlaisorBlade
Modified: 2006-05-15 23:19 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Xorg.0.log of the broken binary (Xorg.0.log-relocations,34.06 KB, text/plain)
2006-05-15 17:23 UTC, BlaisorBlade
Details

Note You need to log in before you can comment on or make changes to this bug.
Description BlaisorBlade 2006-05-15 17:21:59 UTC
I had:
# gcc-config -l
 [1] x86_64-pc-linux-gnu-3.4.5 *
 [2] x86_64-pc-linux-gnu-3.4.5-hardenednopie
 [3] x86_64-pc-linux-gnu-3.4.5-hardenednopiessp
 [4] x86_64-pc-linux-gnu-3.4.5-hardenednossp
 [5] x86_64-pc-linux-gnu-3.4.5-vanilla
I emerged xorg-x11 for a security update and on reboot it didn't start due to a lot of such errors:

(II) Loading /usr/lib64/modules/fonts/libbitmap.a
Elf_RelocateEntry() Unsupported relocation type 4
Elf_RelocateEntry() Unsupported relocation type 9

I know for sure that gcc hardened (which enables -fpie and -fstack-protector by default - that's the only difference with -vanilla spec above) uses different relocations than gcc without PIE.

I re-switched to vanilla gcc and recompiled xorg-x11, and it works fine since then.
(complete log attached in next comment).
Comment 1 BlaisorBlade 2006-05-15 17:23:26 UTC
Created attachment 86830 [details]
Xorg.0.log of the broken binary
Comment 2 BlaisorBlade 2006-05-15 17:24:28 UTC
This could also relate (?) to #115570.
Comment 3 solar (RETIRED) gentoo-dev 2006-05-15 17:25:09 UTC
You failed to include the output of 'emerge --info'
We need to know exact versions of everything and to see your USE= flags in order for bug reporting to be useful.
Also chances are you are not using USE=dlloader (the hardened profile should set this by default)
Comment 4 BlaisorBlade 2006-05-15 18:00:50 UTC
Ok, I don't use the hardened profile, and this issue is documented in "Xorg on hardened" howto(http://www.gentoo.org/proj/en/hardened/hardenedxorg.xml). I'm reading all docs. But two notes:

*) could such a check be added to all archs experiencing the problem? (from /usr/portage/x11-base/xorg-x11/xorg-x11-6.8.2-r7.ebuild:343); also probably needs to be changed the policy.

        sparc)  filter-flags "-fomit-frame-pointer" "-momit-leaf-frame-pointer"
            if has_hardened && ! use dlloader; then
                einfo "Softening gcc for sparc."
*) the amd64 hardened profile fails to enable dlloader by default. Verify by comparing the output of these two commands.

$ find /usr/portage/profiles/hardened/ |xargs grep dlloader
$ find /usr/portage/profiles/hardened/ |xargs grep dlloader|grep amd64

Output of emerge --info:

# emerge --info
Portage 2.0.54 (default-linux/amd64/2005.0, gcc-3.4.5-vanilla, glibc-2.3.5-r2, 2.6.16.14-bs3-swsusp2 x86_64)
=================================================================
System uname: 2.6.16.14-bs3-swsusp2 x86_64 AMD Athlon 64 Processor 3000+
Gentoo Base System version 1.6.14
ccache version 2.3 [disabled]
dev-lang/python:     2.4.2
dev-python/pycrypto: [Not Present]
dev-util/ccache:     2.3
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -O2 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib64/mozilla/defaults/pref /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/eselect/compiler /etc/gconf /etc/terminfo /etc/texmf/web2c /etc/env.d"
CXXFLAGS="-march=athlon64 -O2 -pipe"
DISTDIR="/home/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict userpriv usersandbox"
GENTOO_MIRRORS="http://gentoo.blueyonder.co.uk http://www.ibiblio.org/pub/Linux/distributions/gentoo http://pandemonium.tiscali.de/pub/gentoo/ ftp://pandemonium.tiscali.de/pub/gentoo/ ftp://ftp.tu-clausthal.de/pub/linux/gentoo/ ftp://mir.zyrianes.net/gentoo/"
LANG="it_IT"
LINGUAS="it en"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="amd64 X X509 a52 aac aalib acl acpi aim alsa apache apache2 arts artswrappersuid asf audiofile avi bash-completion berkdb bitmap-fonts bzip2 bzlib cddb cdr cli crypt cscope cups curl dba dga dri dv dvb dvd dvdr dvdread eds emboss encode erandom esd ethereal exif expat fam ffmpeg flac foomaticdb ftp gd gdbm gif glut gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml hal iconv icq idea idn ieee1394 imagemagick imap imlib innodb irda isdnlog jabber java jpeg jpeg2k junit kde kerberos krb4 lcms ldap libcaca libwww live logrotate lzo lzw lzw-tiff mad maildir mbox md5sum mhash mime mng motif mozilla mp3 mpeg mpeg4 msn musicbrainz mysql mythtv ncurses nls nptl nsplugin nvidia ogg oggvorbis opengl pam pcmcia pcre pda pdflib perl php pic png pnp postgres ppds pppd python qt quicktime readline reflection rtc ruby samba scanner sdl session slang slp smime spl sqlite ssl svg sysvipc tcltk tcpd tetex tga tiff truetype truetype-fonts type1-fonts udev unicode usb v4l v4l2 vim-with-x vorbis wifi winbind wmf xanim xine xml xml2 xmms xorg xosd xpm xprint xsl xv xvid xvmc yahoo yaz zip zlib linguas_it linguas_en userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, INSTALL_MASK, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTAGE_RSYNC_OPTS
Comment 5 Kevin F. Quinn (RETIRED) gentoo-dev 2006-05-15 23:17:50 UTC
Thanks for the report - amd64 profile is now fixed.  Regarding other arches, we'll deal with them if and when someone has a problem :)

Either switch to the hardened/amd64 profile (best, but you'll need to sync in an hour or so to get the change) or add dlloader to your USE in make.conf.

BTW for future reference, if a bug you raised has been set "RESOLVED NEEDINFO", when you provide the info select "Reopen bug" otherwise we may miss it.
Comment 6 Kevin F. Quinn (RETIRED) gentoo-dev 2006-05-15 23:19:39 UTC
Fixed in CVS - sync up in an hour or so, and don't forget to switch back to the hardened compiler.  Re-open if the fix doesn't work for you.