# Copyright 1999-2012 Gentoo Foundation

# Copyright 1999-2011 Gentoo Foundation

# whether the system is using legacy PT_PAX markings or the newer XATTR_PAX.

# wrapping the use of the paxctl and scanelf utilities.  It decides which to

# The eclass wraps the use of paxctl-ng, paxctl, set/getattr and scanelf utilities,

# use depending on what is installed on the build host, preferring paxctl to

# deciding which to use depending on what's installed on the build host, and

# scanelf.  If paxctl is not installed, we fall back to scanelf since it is

# whether we're working with PT_PAX, XATTR_PAX or both.

# always present.  However, currently scanelf doesn't do all that paxctl can.

#

#

# To control what markings are made, set PAX_MARKINGS in /etc/portage/make.conf

# To control what markings are made, set PAX_MARKINGS in /etc/make.conf to

# to contain either "PT", "XT" or "none".  The default is to attempt both

# contain either "PT" or "none".  If PAX_MARKINGS is set to "PT", and the

# PT_PAX and XATTR_PAX.

# necessary utility is installed, the PT_PAX_FLAGS markings will be made.  If

# PAX_MARKINGS is set to "none", no markings will be made.

PAX_MARKINGS=${PAX_MARKINGS:="PT XT"}

PAX_MARKINGS=${PAX_MARKINGS:="PT"}

# Flags are passed directly to the utilities unchanged

# Flags are passed directly to the utilities unchanged.  Possible flags at the

# time of writing, taken from /sbin/paxctl, are:

	local f flags fail=0 failures="" zero_load_alignment

	local f								# loop over paxables

	# Ignore '-' characters - in particular so that it doesn't matter if

	local flags							# pax flags

	# the caller prefixes with -

	local pt_fail=0 pt_failures=""		# record PT_PAX failures

	local xt_fail=0 xt_failures=""		# record xattr PAX marking failures

	local ret=0							# overal return code of this function

	# You can call pax-mark with/out leading '-' on flags

	# Try paxctl, then scanelf.  paxctl is preferred.

	if has PT ${PAX_MARKINGS}; then

	if type -p paxctl > /dev/null && has PT ${PAX_MARKINGS}; then

		# Try paxctl, the upstream supported tool.

		#First try paxctl-ng

		einfo "PT PaX marking -${flags}"

		if type -p paxctl-ng > /dev/null && paxctl-ng -L ; then

		_pax_list_files einfo "$@"

			einfo "PT PaX marking -${flags}"

		for f in "$@"; do

			_pax_list_files einfo "$@"

			# First, try modifying the existing PAX_FLAGS header

			for f in "$@"; do

			paxctl -q${flags} "${f}" && continue

				paxctl-ng -L -${flags} "${f}" && continue

			# Second, try stealing the (unused under PaX) PT_GNU_STACK header

				pt_fail=1

			paxctl -qc${flags} "${f}" && continue

				pt_failures="${pt_failures} ${f}"

			# Third, try pulling the base down a page, to create space and

			done

			# insert a PT_GNU_STACK header (works on ET_EXEC)

			paxctl -qC${flags} "${f}" && continue

		#Next try paxctl

			#

		elif type -p paxctl > /dev/null; then

			# prelink is masked on hardened so we wont use this method.

			einfo "PT PaX marking -${flags}"

			# We're working on a new utiity to try to do the same safely. See

			_pax_list_files einfo "$@"

			# http://git.overlays.gentoo.org/gitweb/?p=proj/elfix.git;a=summary

			for f in "$@"; do

			#

				# First, try modifying the existing PAX_FLAGS header

			# Fourth - check if it loads to 0 (probably an ET_DYN) and if so,

				paxctl -q${flags} "${f}" && continue

			# try rebasing with prelink first to give paxctl some space to

				# Second, try stealing the (unused under PaX) PT_GNU_STACK header

			# grow downwards into.

				paxctl -qc${flags} "${f}" && continue

			#if type -p objdump > /dev/null && type -p prelink > /dev/null; then

				# Third, creating a PT_PAX header (works on ET_EXEC)

			#	zero_load_alignment=$(objdump -p "${f}" | \

				paxctl -qC${flags} "${f}" && continue

			#		grep -E '^[[:space:]]*LOAD[[:space:]]*off[[:space:]]*0x0+[[:space:]]' | \

				pt_fail=1

			#		sed -e 's/.*align\(.*\)/\1/')

				pt_failures="${pt_failures} ${f}"

			#	if [[ ${zero_load_alignment} != "" ]]; then

			done

			#		prelink -r $(( 2*(${zero_load_alignment}) )) &&

			#		paxctl -qC${flags} "${f}" && continue

		#Finally fall back on scanelf

			#	fi

		elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then

			#fi

			einfo "Fallback PaX marking -${flags}"

			fail=1

			_pax_list_files einfo "$@"

			failures="${failures} ${f}"

			scanelf -Xxz ${flags} "$@"

		done

	elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then

		#We failed to set PT_PAX flags

		# Try scanelf, the Gentoo swiss-army knife ELF utility

		elif [[ ${PAX_MARKINGS} != "none" ]]; then

		# Currently this sets PT if it can, no option to control what it does.

			pt_failures="$*"

		einfo "Fallback PaX marking -${flags}"

			pt_fail=1

		_pax_list_files einfo "$@"

		fi

		scanelf -Xxz ${flags} "$@"

	elif [[ ${PAX_MARKINGS} != "none" ]]; then

		if [[ ${pt_fail} == 1 ]]; then

		# Out of options!

			ewarn "Failed to set XT_PAX markings -${flags} for:"

		failures="$*"

			_pax_list_files ewarn ${pt_failures}

		fail=1

			ret=1

		fi

	if [[ ${fail} == 1 ]]; then

	if has XT ${PAX_MARKINGS}; then

		ewarn "Failed to set PaX markings -${flags} for:"

		_pax_list_files ewarn ${failures}

		#First try paxctl-ng

		ewarn "Executables may be killed by PaX kernels."

		if type -p paxctl-ng > /dev/null && paxctl-ng -l ; then

			einfo "XT PaX marking -${flags}"

			_pax_list_files einfo "$@"

			for f in "$@"; do

				paxctl-ng -l -${flags} "${f}" && continue

				xt_fail=1

				xt_failures="${tx_failures} ${f}"

			done

		#Next try setfattr

		elif type -p setfattr > /dev/null; then

			einfo "XT PaX marking -${flags}"

			_pax_list_files einfo "$@"

			for f in "$@"; do

				setfattr -n "user.pax.flags" -v "${flags}" "${f}" && continue

				xt_fail=1

				xt_failures="${tx_failures} ${f}"

			done

		#We failed to set PT_PAX flags

		elif [[ ${PAX_MARKINGS} != "none" ]]; then

			pt_failures="$*"

			pt_fail=1

		fi

		if [[ ${xt_fail} == 1 ]]; then

			ewarn "Failed to set XT_PAX markings -${flags} for:"

			_pax_list_files ewarn ${xt_failures}

			ret=1

		fi

	return ${fail}

	[[ ${ret} == 1 ]] && ewarn "Executables may be killed by PaX kernels."

	return ${ret}