Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 455222

Summary: net-libs/webkit-gtk - add support for XT PaX marking
Product: Gentoo Linux Reporter: iGentoo <AlphatPC>
Component: [OLD] GNOMEAssignee: The Gentoo Linux Hardened Team <hardened>
Status: RESOLVED NEEDINFO    
Severity: enhancement CC: alexander, gnome
Priority: Normal Keywords: PATCH
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=blob;f=eclass/pax-utils.eclass
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 427888    
Attachments: gir-paxctl-lt-wrapper ( POSIX compliant )
webkit-gtk-1.11.4-r300.ebuild.diff

Description iGentoo 2013-02-03 02:00:20 UTC
paxctl-ng is swiss army knife for setting PT_PAX and *XATTR_PAX* flags on an ELF binary.
Comment 1 iGentoo 2013-02-03 02:02:51 UTC
Created attachment 337736 [details, diff]
gir-paxctl-lt-wrapper ( POSIX compliant )
Comment 2 iGentoo 2013-02-03 02:22:48 UTC
Created attachment 337738 [details, diff]
webkit-gtk-1.11.4-r300.ebuild.diff
Comment 3 Gilles Dartiguelongue gentoo-dev 2013-02-03 10:25:19 UTC
This should probably be handled at eclass level as well.
Comment 4 Anthony Basile gentoo-dev 2013-02-09 20:41:04 UTC
(In reply to comment #3)
> This should probably be handled at eclass level as well.

It can't.  This is a build time pax marking that is needed.  It has to be updated to fix both possible markings, both PT_PAX and XATTR_PAX.  I didn't test Alphat-PC's patch but it looks like its heading in the right direction.
Comment 5 Anthony Basile gentoo-dev 2013-05-21 14:31:06 UTC
(In reply to comment #4)
> (In reply to comment #3)
> > This should probably be handled at eclass level as well.
> 
> It can't.  This is a build time pax marking that is needed.  It has to be
> updated to fix both possible markings, both PT_PAX and XATTR_PAX.  I didn't
> test Alphat-PC's patch but it looks like its heading in the right direction.

The latest version of elfix-0.8.2 includes a bash script, /usr/sbin/pax-mark, which is a wrapper to paxctl-ng/paxctl/scanelf/setfattr which attemps to set XT or PT pax markings as the eclass does.  The difference is that this can be called from any point in a build process, so anywhere you see paxctl hard coded in ebuilds you should be able to replace it with /usr/sbin/pax-mark.

As I write this, I realize I should probably change the name on the next bump to avoid a name collision with pax-mark from the eclass :(
Comment 6 Pacho Ramos gentoo-dev 2014-02-02 14:02:31 UTC
@hardened, feel free to commit if it works for you
Comment 7 Pacho Ramos gentoo-dev 2015-05-24 09:13:43 UTC
is this still needed with current versions?