Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 36792 - gcc-3.3.2-r5 fails on scanning __guard@GCC symbols
Summary: gcc-3.3.2-r5 fails on scanning __guard@GCC symbols
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Development (show other bugs)
Hardware: All All
: High normal
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-12-30 02:59 UTC by Jan Schubert
Modified: 2004-01-03 11:11 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jan Schubert 2003-12-30 02:59:08 UTC
While updateing a quite new system i get this:

 * Found binaries that are dynamically linked to the libgcc with __guard@@GCC
 * You need to compile these binaries without CFLAGS -fstack-protector/hcc -r

 * Also, you have to make sure that using ccache needs the cache to be flushed
 * wipe out /var/tmp/ccache or /root/.ccache.  This will remove possible saved
 * -fstack-protector arguments that still may reside in such a compiler cache

 * When such binaries are found, gcc cannot remove libgcc propolice functions
 * leading to gcc -static -fstack-protector breaking, see gentoo bug #25299

 * To do a full scan on your system, enter this following command in a shell
 * (Please keep running and remerging broken packages until it do not report
 *  any breakage anymore!):

 *  # /usr/portage/sys-devel/gcc/files/scan_libgcc_linked_ssp.sh


!!! ERROR: sys-devel/gcc-3.3.2-r5 failed.
!!! Function check_glibc_ssp, Line 204, Exitcode 0
!!! Binaires with libgcc __guard@GCC dependencies detected!

time root # /usr/portage/sys-devel/gcc/files/scan_libgcc_linked_ssp.sh
 * Scannig system for __guard@GCC symbols...
 *  Scanning 01 of 14 /lib...
 *  Scanning 02 of 14 /usr/lib...
 *  Scanning 03 of 14 /opt/blackdown-jdk-1.4.1/jre/lib/i386...
 *  Scanning 04 of 14 /usr/local/lib...
 *  Scanning 05 of 14 /bin...
 *  Scanning 06 of 14 /opt/bin...
 *  Scanning 07 of 14 /opt/blackdown-jdk-1.4.1/bin...
 *  Scanning 08 of 14 /opt/blackdown-jdk-1.4.1/jre/bin...
 *  Scanning 09 of 14 /sbin...
 *  Scanning 10 of 14 /usr/bin...
 *  Scanning 11 of 14 /usr/i686-pc-linux-gnu/gcc-bin/3.3...
 *  Scanning 12 of 14 /usr/local/bin...
 *  Scanning 13 of 14 /usr/local/sbin...
 *  Scanning 14 of 14 /usr/sbin...
time root #

I can't remember doing something special, it's just out of the box.
Comment 1 Jan Schubert 2003-12-30 05:34:34 UTC
Seems some people are interessted, so here is more information:

nebula root # emerge info
Portage 2.0.49-r18 (default-x86-1.4, gcc-3.3.2, glibc-2.3.3_pre20031212-r0, 2.6.0-gentoo)
=================================================================
System uname: 2.6.0-gentoo i686 Intel(R) Pentium(R) 4 CPU 3.00GHz
Gentoo Base System version 1.4.3.12
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CFLAGS="-Os -march=pentium4 -funroll-loops -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER="gcc3"
CONFIG_PROTECT="/etc /opt/tomcat/conf /usr/kde/2/share/config /usr/kde/3/share/config /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/env.d"
CXXFLAGS="-Os -march=pentium4 -funroll-loops -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs ccache sandbox"
GENTOO_MIRRORS="http://ftp.easynet.nl/mirror/gentoo/ ftp://gentoo.inode.at/source/ http://gentoo.linux.no/ "
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY=""
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="apache2 apm berkdb crypt encode gdbm gif imlib java jpeg libg++ libwww mikmod motif mpeg ncurses nls pam pdflib perl png python readline sdl slang spell ssl svga tcpd x86 xml2 zlib"
Comment 2 Jeff Breker 2003-12-30 10:46:51 UTC
I am getting the same problem here on my machine...

jbreker@wildebeest jbreker $ emerge info
 
*** You are not in the portage group. You may experience cache problems
*** due to permissions preventing the creation of the on-disk cache.
*** Please add this user to the portage group if you wish to use portage.
 
Portage 2.0.49-r18 (default-x86-1.4, gcc-3.3.2, glibc-2.3.3_pre20031222-r0, 2.4.23)
=================================================================
System uname: 2.4.23 i686 Mobile Intel(R) Pentium(R) 4 - M CPU 1.70GHz
Gentoo Base System version 1.4.3.12
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CFLAGS="-O3 -mcpu=i686 -funroll-loops -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER="gcc3"
CONFIG_PROTECT="/etc /usr/X11R6/lib/X11/xkb /usr/kde/2/share/config /usr/kde/3.1/share/config /usr/kde/3/share/config /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/env.d"
CXXFLAGS="-O3 -mcpu=i686 -funroll-loops -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs ccache sandbox"
GENTOO_MIRRORS="http://gentoo.oregonstate.edu http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY=""
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X apm arts avi berkdb crypt cups encode esd foomaticdb gdbm gif gnome gpm gtk gtk2 imlib jpeg kde libg++ libwww mad mikmod motif mozilla mpeg ncurses nls oggvorbis opengl oss pam pdflib perl png python qt quicktime readline sdl slang spell ssl svga tcpd truetype x86 xml2 xmms xv zlib"
Comment 3 Martin Schlemmer (RETIRED) gentoo-dev 2003-12-30 14:37:20 UTC
Can we get a bigger log please ?
Comment 4 Brad House 2003-12-30 14:47:51 UTC
Az, there's not much more to the log, I got one earlier,
it's just like the output from
 /usr/portage/sys-devel/gcc/files/scan_libgcc_linked_ssp.sh
pasted on top of the error that the original poster showed.
No indication of any files found, just like a return code
barfed or something :/

-Brad
Comment 5 Jan Schubert 2003-12-30 15:30:11 UTC
Again, including exit-value. I'll also post the emerge.log.

HTH,
Jan

------

nebula root # /usr/portage/sys-devel/gcc/files/scan_libgcc_linked_ssp.sh
 * Scanning system for __guard@GCC symbols...
 *  Scanning 01 of 15 /lib...
 *  Scanning 02 of 15 /usr/lib...
 *  Scanning 03 of 15 /opt/sun-jdk-1.4.2.03/jre/lib...
 *  Scanning 04 of 15 /usr/local/lib...
 *  Scanning 05 of 15 /bin...
 *  Scanning 06 of 15 /opt/bin...
 *  Scanning 07 of 15 /opt/sun-jdk-1.4.2.03/bin...
 *  Scanning 08 of 15 /opt/sun-jdk-1.4.2.03/jre/bin...
 *  Scanning 09 of 15 /opt/sun-jdk-1.4.2.03/jre/javaws...
 *  Scanning 10 of 15 /sbin...
 *  Scanning 11 of 15 /usr/bin...
 *  Scanning 12 of 15 /usr/i686-pc-linux-gnu/gcc-bin/3.3...
 *  Scanning 13 of 15 /usr/local/bin...
 *  Scanning 14 of 15 /usr/local/sbin...
 *  Scanning 15 of 15 /usr/sbin...
nebula root # echo $?
1
Comment 6 Jan Schubert 2003-12-30 15:40:22 UTC
To be honest, there is no config.log or something like this, because the check is done in src_unpack, so nothing else than the check happened...

Any more infos needed?
Comment 7 Martin Schlemmer (RETIRED) gentoo-dev 2003-12-30 16:43:58 UTC
Werd - what if you run it as your user?
Comment 8 Jan Schubert 2003-12-30 16:54:50 UTC
Actualy, this is a new server and there is no account yet than root. So i've created one just for you. So see for yourself, it's exactly the same:

jan@nebula jan $ /usr/portage/sys-devel/gcc/files/scan_libgcc_linked_ssp.sh

*** You are not in the portage group. You may experience cache problems
*** due to permissions preventing the creation of the on-disk cache.
*** Please add this user to the portage group if you wish to use portage.

 * Scanning system for __guard@GCC symbols...
 *  Scanning 01 of 15 /lib...
 *  Scanning 02 of 15 /usr/lib...
 *  Scanning 03 of 15 /opt/sun-jdk-1.4.2.03/jre/lib...
 *  Scanning 04 of 15 /usr/local/lib...
 *  Scanning 05 of 15 /bin...
 *  Scanning 06 of 15 /opt/bin...
 *  Scanning 07 of 15 /opt/sun-jdk-1.4.2.03/bin...
 *  Scanning 08 of 15 /opt/sun-jdk-1.4.2.03/jre/bin...
 *  Scanning 09 of 15 /opt/sun-jdk-1.4.2.03/jre/javaws...
 *  Scanning 10 of 15 /sbin...
 *  Scanning 11 of 15 /usr/bin...
 *  Scanning 12 of 15 /usr/i686-pc-linux-gnu/gcc-bin/3.3...
 *  Scanning 13 of 15 /usr/local/bin...
 *  Scanning 14 of 15 /usr/local/sbin...
 *  Scanning 15 of 15 /usr/sbin...
jan@nebula jan $ echo $?
1
Comment 9 solar (RETIRED) gentoo-dev 2003-12-30 17:07:33 UTC
Jan,
Please try

/bin/gawk -f /usr/portage/sys-devel/gcc/files/scanforssp.awk ; echo $?
Comment 10 Jan Schubert 2003-12-30 17:46:54 UTC
OK, i guess you forgot an awk in the path. Except the number of files/scans changed nothing new...

HTH,
Jan

-------------

nebula root # /bin/gawk -f /usr/portage/sys-devel/gcc/files/awk/scanforssp.awk ; echo $?
 *  Scanning 01 of 14 /lib...
 *  Scanning 02 of 14 /usr/lib...
 *  Scanning 03 of 14 /opt/sun-jdk-1.4.2.03/jre/lib...
 *  Scanning 04 of 14 /usr/local/lib...
 *  Scanning 05 of 14 /bin...
 *  Scanning 06 of 14 /opt/bin...
 *  Scanning 07 of 14 /opt/sun-jdk-1.4.2.03/bin...
 *  Scanning 08 of 14 /opt/sun-jdk-1.4.2.03/jre/bin...
 *  Scanning 09 of 14 /opt/sun-jdk-1.4.2.03/jre/javaws...
 *  Scanning 10 of 14 /sbin...
 *  Scanning 11 of 14 /usr/bin...
 *  Scanning 12 of 14 /usr/i686-pc-linux-gnu/gcc-bin/3.3...
 *  Scanning 13 of 14 /usr/local/bin...
 *  Scanning 14 of 14 /usr/sbin...
1
nebula root # su - jan
jan@nebula jan $ /bin/gawk -f /usr/portage/sys-devel/gcc/files/awk/scanforssp.awk ; echo $?
 *  Scanning 01 of 12 /lib...
 *  Scanning 02 of 12 /usr/lib...
 *  Scanning 03 of 12 /opt/sun-jdk-1.4.2.03/jre/lib...
 *  Scanning 04 of 12 /usr/local/lib...
 *  Scanning 05 of 12 /bin...
 *  Scanning 06 of 12 /opt/bin...
 *  Scanning 07 of 12 /opt/sun-jdk-1.4.2.03/bin...
 *  Scanning 08 of 12 /opt/sun-jdk-1.4.2.03/jre/bin...
 *  Scanning 09 of 12 /opt/sun-jdk-1.4.2.03/jre/javaws...
 *  Scanning 10 of 12 /usr/bin...
 *  Scanning 11 of 12 /usr/i686-pc-linux-gnu/gcc-bin/3.3...
 *  Scanning 12 of 12 /usr/local/bin...
1
Comment 11 Natanael Copa 2003-12-30 18:35:17 UTC
I have the same here on one of four computers. The awk script is exiting with "exit(0)" but $? is still 1. http://forums.gentoo.org/viewtopic.php?t=119559
Comment 12 Natanael Copa 2003-12-31 02:28:13 UTC
I thought this was a gawk bug so I looked at the gawk source. There is a close_io finction in io.c that is supposed to close all open files. This function fails on one file and returns a status of 1 that ends up as exit code. So one of the pipes or files in the scanforssp.awk are failing to close upon exit.
Comment 13 Natanael Copa 2003-12-31 02:36:57 UTC
I found the bug. It is in scanforssp.awk

BEGIN {
        # Do we have etcat ?
        pipe = ("which etcat 2>/dev/null")
        if ((((pipe) | getline etcat_data) > 0) && (etcat_data != ""))
                auto_etcat = 1
        else
                auto_etcat = 0

Here on line 58 there is missing a 
        close(pipe)

(How do I provide a patch?)
Comment 14 Jan Schubert 2003-12-31 03:35:09 UTC
Excelent, i was very close to the same solution :-).

The fix is working for my affected box also!
Comment 15 solar (RETIRED) gentoo-dev 2003-12-31 10:26:39 UTC
Added fix from Natanael Copa.
Please rsync and test the -r5 version again. No -r6 was added cuz we are not
adding new functionality vs fixing what was broke.

- Thank you all for helping track down this bug.
Comment 16 Jan Schubert 2003-12-31 16:22:54 UTC
Thx, there is just one question left: Why there are just some boxes affected, not all? At least on my side, all boxes are up to date, but it failed just for one. They are also having he same architectire, the same CFLAGS and similar USE-Flags. It's just that, that the affected box is quite new, but i've installed two more boxes at nearly the same time which are not affected...
Comment 17 Martin Schlemmer (RETIRED) gentoo-dev 2003-12-31 16:32:02 UTC
Thanks Natanael, Ned.  Ok, fixed for every one?

Comment 18 solar (RETIRED) gentoo-dev 2003-12-31 19:25:59 UTC
Jan,

What I assume is be happening is the return value is also set based on the results on the call to 'which etcat' from the pipe.
Perhaps Natanael can answer your questions as he poked around in the code.
If you feel this is a bug in gawk then reports for `gawk' should be sent 
to the gawk bug report mailing list at bug-gawk@gnu.org I however don't 
think it is.
--------------
Martin,

Natanael's bugfix should clear up this problem and allow us to remove 
the -* masking.

On another note it looks like we no longer have "pic" in IUSE or anywhere 
else in any of the gcc ebuilds that I can find. 
If we no longer support this flag for prelinking then I would like to 
reserve this flag for future use as having the meaning of 
(Position Independent Code) respectively.
Comment 19 Martin Schlemmer (RETIRED) gentoo-dev 2003-12-31 19:34:37 UTC
Ned, right, on it - just waiting for confirmation.  Also, I cannot remember
ever using 'pic' in the gcc ebuilds ...

Anyhow, this should be resolved.
Comment 20 solar (RETIRED) gentoo-dev 2003-12-31 21:12:57 UTC
Sorry about that I had mixed up my toolchain components (gcc/glibc)
You can ignore request for now.
Comment 21 Jan Schubert 2004-01-02 06:05:34 UTC
fixed confirmed for my affected box also
Comment 22 Jeff Breker 2004-01-03 11:11:57 UTC
Works for me now, thank you all for your help.