Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 565468

Summary: gnome-base/nautilus-3.16.2 segfaults on hardened with mprotect enabled
Product: Gentoo Linux Reporter: Jens Pranaitis <jens>
Component: [OLD] GNOMEAssignee: Gentoo Linux Gnome Desktop Team <gnome>
Status: RESOLVED TEST-REQUEST    
Severity: normal CC: jens
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---
Attachments: patch to deactivate mprotect on nautilus binary

Description Jens Pranaitis 2015-11-11 10:16:05 UTC 
Nautilus segfaults when run with a hardened kernel with grsec and the desktop profile. After changing the pax flags of the binary to disable mprotect it runs fine. Here is the error with mprotect enabled:

[ 3250.145030] PAX: execution attempt in: <anonymous mapping>, 36d80afe000-36d80aff000 36d80afe000
[ 3250.145036] PAX: terminating task: /usr/bin/nautilus(nautilus):7176, uid/euid: 1000/1000, PC: 0000036d80afe010, SP: 000003dbabe26b38
[ 3250.145039] PAX: bytes at PC: 49 bb e2 3a 4a 79 6d 03 00 00 49 ba 10 e0 af 80 6d 03 00 00 
[ 3250.145048] PAX: bytes at SP-8: 000003dbabe26bc0 0000036d7da3cfae 000003dbabe26b80 000003dbabe26b78 0000036d7dd3b280 0000000000000000 0000036d00000000 00000055d98f4b10 00000055d976d780 00000055d9a02d40 0000036d80afe010 

After disabling mprotect nautilus works fine.

Reproducible: Always

Steps to Reproduce:
1. install hardened kernel with grsec desktop profile selected
2. emerge nautilus
3. run nautilus and watch it segfault
4. paxctl-ng -mv /usr/bin/nautilus
5. run nautilus - hooray it works
Actual Results:  
nautilus crashes in the default configuration on hardened gentoo

Expected Results:  
nautilus should either work with mprotect or have mprotect disabled in the ebuild

Portage 2.2.20.1 (python 3.4.3-final-0, hardened/linux/amd64, gcc-4.9.3, glibc-2.21-r1, 4.2.5-hardened-r1 x86_64)
=================================================================
System uname: Linux-4.2.5-hardened-r1-x86_64-Intel-R-_Core-TM-_i3-2310M_CPU_@_2.10GHz-with-gentoo-2.2
KiB Mem:     8044812 total,   3111076 free
KiB Swap:    4194300 total,   4194300 free
Timestamp of repository gentoo: Wed, 11 Nov 2015 06:45:01 +0000
sh bash 4.3_p39
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
app-shells/bash:          4.3_p39::gentoo
dev-java/java-config:     2.2.0::gentoo
dev-lang/perl:            5.20.2::gentoo
dev-lang/python:          2.7.10::gentoo, 3.4.3::gentoo
dev-util/cmake:           3.3.1-r1::gentoo
dev-util/pkgconfig:       0.28-r2::gentoo
sys-apps/baselayout:      2.2::gentoo
sys-apps/openrc:          0.17::gentoo
sys-apps/sandbox:         2.6-r1::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69::gentoo
sys-devel/automake:       1.10.3-r1::gentoo, 1.11.6-r1::gentoo, 1.13.4::gentoo, 1.14.1::gentoo, 1.15::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo
sys-devel/gcc:            4.9.3::gentoo
sys-devel/gcc-config:     1.7.3::gentoo
sys-devel/libtool:        2.4.6::gentoo
sys-devel/make:           4.1-r1::gentoo
sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers)
sys-libs/glibc:           2.21-r1::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.europe.gentoo.org/gentoo-portage
    priority: -1000

jensp
    location: /var/lib/layman/jensp
    masters: gentoo
    priority: 0

pentoo
    location: /var/lib/layman/pentoo
    masters: gentoo
    priority: 1

ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=native -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -march=native -pipe"
DISTDIR="/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://mirror.netcologne.de/gentoo/ http://ftp.uni-erlangen.de/pub/mirrors/gentoo http://mirror.leaseweb.com/gentoo/"
LANG="en_US.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
USE="X a52 aac aalib acl alsa amd64 apng autoipd avahi avx bash-completion berkdb bluetooth branding bzip2 cairo caps cdda city cleartype cli clucene colord connection-sharing corefonts cracklib crypt cryptsetup css cue cups cxx dbus declarative device-mapper dri dts dvd ebook eds encode exif extensions fam ffmpeg flac fontconfig foomatic foomaticdb g3dvl gbm gdbm geoip gif git glamor gles gles1 gles2 gnome gnome-keyring gpg gpm gps gpsd graphics gstreamer gtk hardened hdaps humanities iconv icq id3 id3tag idn imap injection inotify introspection ipv6 ithreads jabber joystick jpeg justify kpathsea lame lastfm lastfmradio lcdfilter lcms libass libkms libnotify libsecret libusb link lzma mad matroska mdnsresponder-compat metric minizip mmx mmxext mng modemmanager modules mp3 mpeg mtp multilib musepack nautilus ncurses networkmanager nls nptl nsplugin ntfs ntfsprogs ofa offensive ogg openal opengl openmp pam pango passwordsave pax_kernel pcre pdf pdfimport perl pgo pie plymouth png policykit pop postscript ppds prison pulseaudio python qt4 readline rtlsdr samba schroedinger script sdl seccomp secure-delete session setproctitle sidebar smime smp sms smtp sna spell sse sse2 sse2_4way sse3 sse4 sse4_1 sse4a ssl ssp ssse3 startup-notification svg system-icu system-jpeg system-sqlite systemd tcpd tesseract theora thinkpad tiff tordns transparent-proxy truetype twolame udev udisks unicode unpaper upcall urandom usb v4l vaapi vim vim-syntax vnc vorbis webp webstart wifi winbind wma wma-fixed x264 xattr xcb xetex xkb xml xmp xorg xtpax xv xvfb xvid xvmc zeroconf zip zlib zsh-completion" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" RUBY_TARGETS="ruby20 ruby21" USERLAND="GNU" VIDEO_CARDS="intel" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Comment 1 Jens Pranaitis 2015-11-11 18:53:04 UTC 
Created attachment 416704 [details, diff]
patch to deactivate mprotect on nautilus binary
Comment 2 Pacho Ramos gentoo-dev 2016-06-25 14:48:31 UTC 
Are you still hitting this with 3.20.1?