Created attachment 469370 [details] Failed build log net-firewall/ipset-6.30[modules] doesn't build against a hardened-sources-4.8.17-r2 that has CONFIG_PAX_CONSTIFY_PLUGIN=y, failing with: make[1]: Entering directory '/usr/src/linux-4.8.17-hardened-r2' CC [M] /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/xt_set.o CC [M] /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/ipset/ip_set_core.o CC [M] /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/ipset/ip_set_getport.o CC [M] /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/ipset/pfxlen.o /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/ipset/ip_set_core.c:2042:30: error: constified variable ‘so_set’ placed into writable section ".data..read_mostly" static struct nf_sockopt_ops so_set __read_mostly = { ^ make[4]: *** [scripts/Makefile.build:290: /var/tmp/portage/net-firewall/ipset-6.30/work/ipset-6.30/kernel/net/netfilter/ipset/ip_set_core.o] Error 1 Setting CONFIG_PAX_CONSTIFY_PLUGIN=n or building ipset with USE=-modules works.
Created attachment 469372 [details] emerge --info net-firewall/ipset
Created attachment 469374 [details] grep CONFIG_PAX /usr/src/linux-4.8.17-hardened-r2/.config
Hardened sources is being discontinued, but I'll block CONFIG_PAX_CONSTIFY_PLUGIN for now; please report upstream as well so they can actually fix the constified variables.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=07380791d1f4739ba21be6bcc986b575c6fb8b27 commit 07380791d1f4739ba21be6bcc986b575c6fb8b27 Author: Robin H. Johnson <robbat2@gentoo.org> AuthorDate: 2017-11-30 20:33:14 +0000 Commit: Robin H. Johnson <robbat2@gentoo.org> CommitDate: 2017-11-30 20:35:50 +0000 net-firewall/ipset: block modules & CONFIG_PAX_CONSTIFY_PLUGIN Closes: https://bugs.gentoo.org/614896 Package-Manager: Portage-2.3.16, Repoman-2.3.6 Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> net-firewall/ipset/ipset-6.34.ebuild | 2 ++ 1 file changed, 2 insertions(+)
