Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 253393 - sys-boot/grub - executable stacks
Summary: sys-boot/grub - executable stacks
Status: RESOLVED UPSTREAM
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: All Linux
: High QA (vote)
Assignee: Gentoo's Team for Core System packages
URL: http://www.gentoo.org/proj/en/hardene...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-01-01 23:51 UTC by Roger
Modified: 2009-01-05 20:37 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Roger 2009-01-01 23:51:39 UTC
* QA Notice: The following files contain executable stacks
 *  Files with executable stacks will not work properly (or at all!)
 *  on some architectures/operating systems.  A bug should be filed
 *  at http://bugs.gentoo.org/ to make sure the file is fixed.
 *  For more information, see http://hardened.gentoo.org/gnu-stack.xml
 *  Please include the following list of files in your report:
 * RWX --- --- sbin/grub-probe-9999
 * RWX --- --- sbin/grub-setup-9999


Reproducible: Always

Actual Results:  
append-flags option (per gnu-stack.xml) does not allow configure to pass it's tests.

append-ldflags -Wl,-z,noexecstack does providea a working Grub2, even after stripping (See Bug #231935).




I've also filed a bug to Grub Bugs concerning this issue:
https://savannah.gnu.org/bugs/index.php?25220

I'll provide a diff/ebuild when I sync to get the latest and greatest grub-9999.ebuild.

(I've also enabled multislot for grub-9999.ebuild.  However, if grub-2.xx.ebuild series start, they'll conflict as I only added --program-suffix=-${SLOT}, as such, collision protect is going to complain about files other then bin & sbin. Or should I file the multislot feature separately?)
Comment 1 SpanKY gentoo-dev 2009-01-03 09:41:10 UTC
you changed the ebuild which is why QA_EXECSTACK isnt working anymore

as mentioned in the other bug, i'm not going to touch the execstack status ... it needs to be sorted out upstream