| Summary: | app-emulation/emul-linux-x86-gtklibs-20120520 needs pax marking - gtk-query-immodules-2.0-32: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Alex Efros <powerman-asdf> |
| Component: | New packages | Assignee: | AMD64 Project <amd64> |
| Status: | RESOLVED TEST-REQUEST | ||
| Severity: | normal | CC: | gnome, hardened |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | AMD64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
It's really surprising to me you need pax marking here but not in x11-libs/gtk+ :/ (In reply to comment #1) > It's really surprising to me you need pax marking here but not in > x11-libs/gtk+ :/ PaX marking is done on executables, not libraries. (In reply to comment #2) Ignore what I wrote, I misread comment #1 :/ Also try with latest emul set -> 20121028 (In reply to comment #4) > Also try with latest emul set -> 20121028 Same error. Still valid with 20130224? (In reply to Pacho Ramos from comment #6) > Still valid with 20130224? (In reply to Pacho Ramos from comment #7) > > Still valid with 20130224? > Resolution: --- → TEST-REQUEST * Generating pango modules listing... * Generating gtk+ immodules/gdk-pixbuf loaders listing... gtk-query-immodules-2.0-32: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted * Cannot update gtk.immodules, file generation failed >>> app-emulation/emul-linux-x86-gtklibs-20130224 merged. # paxctl-ng -v /usr/bin/gtk-query-immodules-2.0-32 /usr/bin/gtk-query-immodules-2.0-32: PT_PAX : -e--- XATTR_PAX : not found # /usr/bin/gtk-query-immodules-2.0-32 /usr/bin/gtk-query-immodules-2.0-32: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted For me it looks like nothing was changed, so it isn't fixed. |
On hardened system with nvidia-drivers: * Generating pango modules listing... * Generating gtk+ immodules/gdk-pixbuf loaders listing... gtk-query-immodules-2.0-32: error while loading shared libraries: libGL.so.1: failed to map segment from shared object: Operation not permitted * Cannot update gtk.immodules, file generation failed >>> app-emulation/emul-linux-x86-gtklibs-20120520 merged. kernel log: kern.alert: grsec: denied RWX mmap of /usr/lib32/opengl/nvidia/lib/libGL.so.295.49 by /usr/bin/gtk-query-immodules-2.0-32[gtk-query-immod:31693] uid/euid:0/0 gid/egid:0/0, parent /usr/lib64/portage/bin/ebuild.sh[ebuild.sh:31673] uid/euid:0/0 gid/egid:0/0 paxctl -m /usr/bin/gtk-query-immodules-2.0-32 will fix this issue, but looks like this should be done in ebuild, to avoid this error while merging package.