# Copyright 1999-2011 Gentoo Foundation

# Copyright 1999-2012 Gentoo Foundation

# wrapping the use of the paxctl and scanelf utilities.  It decides which to

# whether the system is using legacy PT_PAX markings or the newer XATTR_PAX.

# use depending on what is installed on the build host, preferring paxctl to

# The eclass wraps the use of paxctl-ng, paxctl, set/getattr and scanelf utilities,

# scanelf.  If paxctl is not installed, we fall back to scanelf since it is

# deciding which to use depending on what's installed on the build host, and

# always present.  However, currently scanelf doesn't do all that paxctl can.

# whether we're working with PT_PAX, XATTR_PAX or both.

#

#

# To control what markings are made, set PAX_MARKINGS in /etc/make.conf to

# To control what markings are made, set PAX_MARKINGS in /etc/portage/make.conf

# contain either "PT" or "none".  If PAX_MARKINGS is set to "PT", and the

# to contain either "PT", "XT" or "none".  The default is to attempt both

# necessary utility is installed, the PT_PAX_FLAGS markings will be made.  If

# PT_PAX and XATTR_PAX.

# PAX_MARKINGS is set to "none", no markings will be made.

PAX_MARKINGS=${PAX_MARKINGS:="PT"}

PAX_MARKINGS=${PAX_MARKINGS:="PT XT"}

# Flags are passed directly to the utilities unchanged.  Possible flags at the

# Flags are passed directly to the utilities unchanged

# time of writing, taken from /sbin/paxctl, are:

	local f flags fail=0 failures="" zero_load_alignment

	# Ignore '-' characters - in particular so that it doesn't matter if

	local f								# loop over paxables

	# the caller prefixes with -

	local flags							# pax flags

	flags=${1//-}

	local pt_fail=0 pt_failures=""		# record PT_PAX failures

	local xt_fail=0 xt_failures=""		# record xattr PAX marking failures

	local ret=0							# overal return code of this function

	flags="$(sanitize-flags $1)"

	# Try paxctl, then scanelf.  paxctl is preferred.

	if type -p paxctl > /dev/null && has PT ${PAX_MARKINGS}; then

	if has PT ${PAX_MARKINGS}; then

		# Try paxctl, the upstream supported tool.

		einfo "PT PaX marking -${flags}"

		#First try paxctl -> this might try to create/convert program headers

		_pax_list_files einfo "$@"

		if type -p paxctl > /dev/null; then

		for f in "$@"; do

			einfo "PT PaX marking -${flags} with paxctl"

			# First, try modifying the existing PAX_FLAGS header

			_pax_list_files einfo "$@"

			paxctl -q${flags} "${f}" && continue

			for f in "$@"; do

			# Second, try stealing the (unused under PaX) PT_GNU_STACK header

				# First, try modifying the existing PAX_FLAGS header

			paxctl -qc${flags} "${f}" && continue

				paxctl -q${flags} "${f}" && continue

			# Third, try pulling the base down a page, to create space and

				# Second, try stealing the (unused under PaX) PT_GNU_STACK header

			# insert a PT_GNU_STACK header (works on ET_EXEC)

				paxctl -qc${flags} "${f}" && continue

			paxctl -qC${flags} "${f}" && continue

				# Third, creating a PT_PAX header (works on ET_EXEC)

			#

				paxctl -qC${flags} "${f}" && continue

			# prelink is masked on hardened so we wont use this method.

				pt_fail=1

			# We're working on a new utiity to try to do the same safely. See

				pt_failures="${pt_failures} ${f}"

			# http://git.overlays.gentoo.org/gitweb/?p=proj/elfix.git;a=summary

			done

			#

			# Fourth - check if it loads to 0 (probably an ET_DYN) and if so,

		#Next try paxctl-ng -> this will not create/convert any program headers

			# try rebasing with prelink first to give paxctl some space to

		elif type -p paxctl-ng > /dev/null && paxctl-ng -L ; then

			# grow downwards into.

			einfo "PT PaX marking -${flags} with paxctl-ng"

			#if type -p objdump > /dev/null && type -p prelink > /dev/null; then

			_pax_list_files einfo "$@"

			#	zero_load_alignment=$(objdump -p "${f}" | \

			for f in "$@"; do

			#		grep -E '^[[:space:]]*LOAD[[:space:]]*off[[:space:]]*0x0+[[:space:]]' | \

				paxctl-ng -L -${flags} "${f}" && continue

			#		sed -e 's/.*align\(.*\)/\1/')

				pt_fail=1

			#	if [[ ${zero_load_alignment} != "" ]]; then

				pt_failures="${pt_failures} ${f}"

			#		prelink -r $(( 2*(${zero_load_alignment}) )) &&

			done

			#		paxctl -qC${flags} "${f}" && continue

			#	fi

		#Finally fall back on scanelf

			#fi

		elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then

			fail=1

			einfo "Fallback PaX marking -${flags} with scanelf"

			failures="${failures} ${f}"

			_pax_list_files einfo "$@"

		done

			scanelf -Xxz ${flags} "$@"

	elif type -p scanelf > /dev/null && [[ ${PAX_MARKINGS} != "none" ]]; then

		# Try scanelf, the Gentoo swiss-army knife ELF utility

		#We failed to set PT_PAX flags

		# Currently this sets PT if it can, no option to control what it does.

		elif [[ ${PAX_MARKINGS} != "none" ]]; then

		einfo "Fallback PaX marking -${flags}"

			pt_failures="$*"

		_pax_list_files einfo "$@"

			pt_fail=1

		scanelf -Xxz ${flags} "$@"

		fi

	elif [[ ${PAX_MARKINGS} != "none" ]]; then

		# Out of options!

		if [[ ${pt_fail} == 1 ]]; then

		failures="$*"

			ewarn "Failed to set XT_PAX markings -${flags} for:"

		fail=1

			_pax_list_files ewarn ${pt_failures}

			ret=1

		fi

	if [[ ${fail} == 1 ]]; then

		ewarn "Failed to set PaX markings -${flags} for:"

	if has XT ${PAX_MARKINGS}; then

		_pax_list_files ewarn ${failures}

		ewarn "Executables may be killed by PaX kernels."

		# z = default. For XATTR_PAX, the default is no xattr field at all

		local dodefault=""

		if [[ "${flags}" != "${flags/z/}" ]]; then

			flags="${flags/z/}"

			dodefault="yes"

		fi

		#First try paxctl-ng

		if type -p paxctl-ng > /dev/null && paxctl-ng -l ; then

			einfo "XT PaX marking -${flags} with paxctl-ng"

			_pax_list_files einfo "$@"

			for f in "$@"; do

				[[ ${dodefault} == "yes" ]] && paxctl-ng -d "${f}"

				paxctl-ng -l -${flags} "${f}" && continue

				xt_fail=1

				xt_failures="${tx_failures} ${f}"

			done

		#Next try setfattr

		elif type -p setfattr > /dev/null; then

			einfo "XT PaX marking -${flags} with setfattr"

			_pax_list_files einfo "$@"

			for f in "$@"; do

				[[ ${dodefault} == "yes" ]] && setfattr -x "user.pax.flags" "${f}"

				setfattr -n "user.pax.flags" -v "${flags}" "${f}" && continue

				xt_fail=1

				xt_failures="${tx_failures} ${f}"

			done

		#We failed to set PT_PAX flags

		elif [[ ${PAX_MARKINGS} != "none" ]]; then

			pt_failures="$*"

			pt_fail=1

		fi

		if [[ ${xt_fail} == 1 ]]; then

			ewarn "Failed to set XT_PAX markings -${flags} for:"

			_pax_list_files ewarn ${xt_failures}

			ret=1

		fi

	return ${fail}

	[[ ${ret} == 1 ]] && ewarn "Executables may be killed by PaX kernels."

	return ${ret}