Bug 455222

Summary:	net-libs/webkit-gtk - add support for XT PaX marking
Product:	Gentoo Linux	Reporter:	iGentoo <AlphatPC>
Component:	[OLD] GNOME	Assignee:	The Gentoo Linux Hardened Team <hardened>
Status:	RESOLVED NEEDINFO
Severity:	enhancement	CC:	alexander, gnome
Priority:	Normal	Keywords:	PATCH
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=blob;f=eclass/pax-utils.eclass
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	427888
Attachments:	gir-paxctl-lt-wrapper ( POSIX compliant ) webkit-gtk-1.11.4-r300.ebuild.diff

Description iGentoo 2013-02-03 02:00:20 UTC

paxctl-ng is swiss army knife for setting PT_PAX and *XATTR_PAX* flags on an ELF binary.

Comment 1 iGentoo 2013-02-03 02:02:51 UTC

Created attachment 337736 [details, diff]
gir-paxctl-lt-wrapper ( POSIX compliant )

Comment 2 iGentoo 2013-02-03 02:22:48 UTC

Created attachment 337738 [details, diff]
webkit-gtk-1.11.4-r300.ebuild.diff

Comment 3 Gilles Dartiguelongue (RETIRED) gentoo-dev

2013-02-03 10:25:19 UTC

This should probably be handled at eclass level as well.

Comment 4 Anthony Basile gentoo-dev

2013-02-09 20:41:04 UTC

(In reply to comment #3)
> This should probably be handled at eclass level as well.

It can't.  This is a build time pax marking that is needed.  It has to be updated to fix both possible markings, both PT_PAX and XATTR_PAX.  I didn't test Alphat-PC's patch but it looks like its heading in the right direction.

Comment 5 Anthony Basile gentoo-dev

2013-05-21 14:31:06 UTC

(In reply to comment #4)
> (In reply to comment #3)
> > This should probably be handled at eclass level as well.
> 
> It can't.  This is a build time pax marking that is needed.  It has to be
> updated to fix both possible markings, both PT_PAX and XATTR_PAX.  I didn't
> test Alphat-PC's patch but it looks like its heading in the right direction.

The latest version of elfix-0.8.2 includes a bash script, /usr/sbin/pax-mark, which is a wrapper to paxctl-ng/paxctl/scanelf/setfattr which attemps to set XT or PT pax markings as the eclass does.  The difference is that this can be called from any point in a build process, so anywhere you see paxctl hard coded in ebuilds you should be able to replace it with /usr/sbin/pax-mark.

As I write this, I realize I should probably change the name on the next bump to avoid a name collision with pax-mark from the eclass :(

Comment 6 Pacho Ramos gentoo-dev

2014-02-02 14:02:31 UTC

@hardened, feel free to commit if it works for you

Comment 7 Pacho Ramos gentoo-dev

2015-05-24 09:13:43 UTC

is this still needed with current versions?