| Summary: | net-libs/serf-1.3.8 "error: can't start new thread" due to denied RWX mmap of <anonymous mapping> by /usr/bin/python2.7 | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Marcin Mirosław <bug> |
| Component: | Current packages | Assignee: | Arfrever Frehtes Taifersar Arahesis <arfrever.fta> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | normal | CC: | hardened, miro.rovis |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
messages_170321_1009_g5n
www-client_firefox-52.0.1_20170321-090648.log emerge--info_4.9.16-hardened |
||
|
Description
Marcin Mirosław
2016-02-03 10:35:06 UTC
Check that you have emutramp enable in the kernel # zgrep -i emutr /proc/config.gz CONFIG_PAX_EMUTRAMP=y Check the pax mark on python and what you use in the kernel config for marking. >>> Compiling source in /var/tmp/portage/net-libs/serf-1.3.8/work/serf-1.3.8 ...
scons -j6 PREFIX=/usr LIBDIR=/usr/lib64 APR=/usr/bin/apr-1-config APU=/usr/bin/apu-1-config OPENSSL=/usr CC=x86_64-pc-linux-gnu-gcc CPPFLAGS= CFLAGS=-pipe -O2 -march=core2 LINKFLAGS=-Wl,-O1 -Wl,--as-needed
scons: Reading SConscript files ...
scons: done reading SConscript files.
scons: Building targets ...
It works fine for me.
On a other host it also works for me.
# zgrep -i xattr /proc/config.gz
CONFIG_TMPFS_XATTR=y
CONFIG_PAX_XATTR_PAX_FLAGS=y
Ok, I've tracked how to fix it. I didn't had set in make.conf variable PAX_MARKINGS. So paxmarking was:
paxctl-ng -v /usr/bin/python2.7
/usr/bin/python2.7:
PT_PAX : -E---
XATTR_PAX : -E---
Next I set PAX_MARKINGS="XT", so python2.7 received such flags:
paxctl-ng -v /usr/bin/python2.7
/usr/bin/python2.7:
PT_PAX : not found
XATTR_PAX : -E---
Now scons has no problem with working.
Bug in kernel when both PT_PAX and XATTR_PAX flags are set?
Created attachment 467778 [details] messages_170321_1009_g5n When installing Firefox ( Pls., I don't use Firefox anymore, I use Palemoon. I'm only following Firefox out of curiosity and spite after they ruined it all for me with: Require PulseAudio to play sound on Linux https://bugzilla.mozilla.org/show_bug.cgi?id=1247056 ) So, [when installing Firefox] this happened, (from /var/log/messages): Mar 21 10:08:26 g5n kernel: [172037.447577] grsec: (admin:S:/) exec of /var/tmp/portage/www-client/firefox-52.0.1/work/firefox-52.0.1/ff/_virtualenv/bin/python2.7 (/var/tmp/portage/www-client/firefox-52.0.1/work/firefox-52.0.1/ff/_virtualenv/bin/python2.7 - setuptools pip wheel ) by /var/tmp/portage/www-client/firefox-52.0.1/work/firefox-52.0.1/ff/_virtualenv/bin/python2.7[python2.7:15256] uid/euid:250/250 gid/egid:250/250, parent /usr/bin/python2.7[python2.7:15254] uid/euid:250/250 gid/egid:250/250 Mar 21 10:08:26 g5n kernel: [172037.765438] grsec: (admin:S:/) denied RWX mmap of <anonymous mapping> by /var/tmp/portage/www-client/firefox-52.0.1/work/firefox-52.0.1/ff/_virtualenv/bin/python2.7[python2.7:15256] uid/euid:250/250 gid/egid:250/250, parent /usr/bin/python2.7[python2.7:15254] uid/euid:250/250 gid/egid:250/250 See all of it (and more, I only partly understand it) in the attachment: messages_170321_1009_g5n And in the other attachment (that I'll post with the next comment): www-client_firefox-52.0.1_20170321-090648.log find: checking for PIE support... no configure: error: --enable-pie requires PIE support from the linker. The two excerpts above, to my best understanding belong to the same event. PIE means, IIUC, position independent executable (the way in which binaries are installed in a hardened system, like mine). I do have in /etc/portage/make.conf : PAX_MARKINGS="XT" So this: # paxctl-ng -v /usr/bin/python2.7 /usr/bin/python2.7: PT_PAX : not found XATTR_PAX : -E--- # [so this] is all regular. I also have: CONFIG_TMPFS_XATTR=y CONFIG_PAX_XATTR_PAX_FLAGS=y in all my hardened kernels (including the running one). When installing firefox-51.0.1 some three weeks ago I didn't have any issues, excerpt from the log in /var/log/portage/<firefox-51.0.1>.log : checking for shmat... yes checking for IceConnectionNumber in -lICE... yes checking for --noexecstack option to as... yes checking for -z noexecstack option to ld... yes checking for -z text option to ld... yes checking for --ignore-unresolved-symbol option to ld... yes checking if toolchain supports -mssse3 option... yes checking if toolchain supports -msse4.1 option... yes checking for x86 AVX2 asm support in compiler... yes checking for PIE support... yes ^^^^^^^^^^^^^ ||||||||||||| See the PIE support... yes above. How's that not working now? Created attachment 467782 [details]
www-client_firefox-52.0.1_20170321-090648.log
(the attachment promised in the previous post)
Created attachment 467788 [details]
emerge--info_4.9.16-hardened
It doesn't work (all the errors are the same) with all the latest updates, including the hardened kernel.
The firefox bug is not the same as this so open a new one (In reply to Magnus Granberg from comment #9) > The firefox bug is not the same as this so open a new one Sorry! I tried to mend by posting at: PIE support in linker missing, reason: denied RWX mmap of by /var/tmp/...firefox-52.0.1/_virtualenv/bin/python2.7 https://bugs.gentoo.org/show_bug.cgi?id=613452 Regards! (In reply to Marcin Mirosław from comment #5) > Now scons has no problem with working. |
