Bug 72277 – unable to build xorg-x11-6.8.0-r3 with grsecurity TPE enabled

• Product: Gentoo Linux
• Status: RESOLVED UPSTREAM

[Description barthek 2004-11-23 13:02:57 UTC]

emerge xfree gives:
...

./config/imake/imake -I./config/cf  -s ./config/makedepend/Makefile.proto -f ./config/makedepend/Imakefile -DTOPDIR=../.. -DCURDIR=./config/makedepend
sh: /var/tmp/portage/xfree-4.3.0-r8/temp/imakeUNW7Om: Permission denied
make[1]: *** [config/makedepend/Makefile.proto] Aborted (core dumped)
make[1]: *** Deleting file `config/makedepend/Makefile.proto'
make[1]: Leaving directory `/home/tmp/portage/xfree-4.3.0-r8/work/xc'
make: *** [World] Error 2

!!! ERROR: x11-base/xfree-4.3.0-r8 failed.
!!! Function src_compile, Line 600, Exitcode 2
!!! (no error message)
!!! If you need support, post the topmost build error, NOT this status message.

and dmesg gives:
grsec: From 62.233.139.50: denied untrusted exec of /home/tmp/portage/xfree-4.3.0-r8/temp/imakeUNW7Om by /bin/bash[sh:20188] uid/euid:250/250 gid/egid:250/250, parent /home/tmp/portage/xfree-4.3.0-r8/work/xc/config/imake/imake[imake:2859] uid/euid:250/250 gid/egid:250/250
grsec: From 62.233.139.50: signal 6 sent to /home/tmp/portage/xfree-4.3.0-r8/work/xc/config/imake/imake[imake:2859] uid/euid:250/250 gid/egid:250/250, parent /usr/bin/make[make:21165] uid/euid:250/250 gid/egid:250/250

is there a workaround for this other than disabling grsecurity's feature ?

[Comment 1 Donnie Berkholz (RETIRED) 2004-11-23 14:45:45 UTC]

No clue, hardened people please help.

[Comment 2 solar (RETIRED) 2004-11-23 15:06:27 UTC]

The user has TPE enabled. Gentoo makes not guarentee that all packages conform to a TPE setup.

Donnie you can't really fix this unless you want to rewrite how the Imake functions. I'd suggest this be considered UPSTREAM unless somebody has a patch. But even then... xfree is only going to live in the tree for another 30ish days..

[Comment 3 Donnie Berkholz (RETIRED) 2004-11-23 15:23:10 UTC]

Is this still an issue w/ xorg?

[Comment 4 barthek 2004-11-25 02:31:32 UTC]

yes, indeed I have enabled trusted path execution of grsecurity.
xorg-x11 has the same problem:

./config/imake/imake -I./config/cf  -s ./config/makedepend/Makefile.proto -f ./config/makedepend/Imakefile -DTOPDIR=../.. -DCURDIR=./config/makedepend
sh: /var/tmp/portage/xorg-x11-6.8.0-r3/temp/imakeqHBNcj: Permission denied
make[1]: *** [config/makedepend/Makefile.proto] Aborted (core dumped)
make[1]: *** Deleting file `config/makedepend/Makefile.proto'
make[1]: Leaving directory `/home/tmp/portage/xorg-x11-6.8.0-r3/work/xc'
make: *** [World] Error 2

!!! ERROR: x11-base/xorg-x11-6.8.0-r3 failed.
!!! Function src_compile, Line 624, Exitcode 2

:(

[Comment 5 barthek 2004-11-25 02:40:51 UTC]

and BTW:
disabling sandboxing stuff makes it compile just fine.

[Comment 6 Donnie Berkholz (RETIRED) 2004-11-25 11:53:38 UTC]

I suggest you file a bug at bugs.freedesktop.org on this, and post the URL here once you do.

[Comment 7 barthek 2004-11-26 00:55:25 UTC]

hmm and wouldnt it be more feasible to give a warning or error
when TPE is enabled (question is how to properly detect it when sysctl is not used) together with sandboxing features of emerge ?

[Comment 8 Donnie Berkholz (RETIRED) 2005-05-25 04:22:35 UTC]

Marking upstream for source compatibility. If you'd like to attach an ebuild
patch to check for TPE etc and warn about it, then reopen the bug, that could work.

[Comment 9 Joshua Baergen (RETIRED) 2005-11-20 12:40:53 UTC]

Is this still an issue with current X versions?