Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 591872 - app-emulation/containerd for Hardened Gentoo
Summary: app-emulation/containerd for Hardened Gentoo
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Tianon
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-22 16:38 UTC by K3A
Modified: 2018-08-19 23:04 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
support for hardened gentoo (containerd-0.2.3.ebuild.patch,648 bytes, patch)
2016-08-22 17:19 UTC, K3A
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description K3A 2016-08-22 16:38:06 UTC
The current ebuild compiles fine on hardened gentoo (with PaX) but they won't run by default as the binaries contain relocations:

# readelf -d /usr/bin/containerd-shim | grep TEXT
 0x0000000000000016 (TEXTREL)            0x0
 0x000000000000001e (FLAGS)              TEXTREL BIND_NOW

When trying to run them on default PaX settings:

# containerd-shim --help
containerd-shim: error while loading shared libraries: cannot make segment writable for relocation: Permission denied

( permission is denied for mprotect(0x79f5d3d000, 3522560, PROT_READ|PROT_WRITE) )


I was able to compile "containerd" binary without relocations similarly to how app-emulation/docker ebuild is doing it by setting -extldflags:

LDFLAGS="-extldflags -fno-PIC" emake GIT_COMMIT="$EGIT_COMMIT" BUILDTAGS="${options[@]}"

... that compiled containerd without relocations but containerd-shim binary still contains them and I don't know why :(

FYI app-emulation/docker is using this -extldflags only if gcc-specs-pie; then

Hope it helps, thanks for adding hardened gentoo support for containerd if possible.
Comment 1 K3A 2016-08-22 17:19:24 UTC
Created attachment 443870 [details, diff]
support for hardened gentoo

I figured it out. Upstream is not adding LDFLAGS into shim build line (https://github.com/docker/containerd/blob/master/Makefile). When added using sed, it compiles correctly without relocations.
Comment 2 K3A 2018-08-19 23:04:28 UTC
It was solved by my accepted pull request (https://github.com/docker/containerd/commit/403ccb155bb1d4e5d1b32cad029fb26ec21172b4) so closing the bug report.