Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 333263 - www-client/epiphany-2.30.2-r1 terminated by pax on hardened amd64
Summary: www-client/epiphany-2.30.2-r1 terminated by pax on hardened amd64
Status: RESOLVED DUPLICATE of bug 338213
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] GNOME (show other bugs)
Hardware: AMD64 Linux
: High normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords: Bug
Depends on:
Blocks:
 
Reported: 2010-08-18 01:11 UTC by Angelo Arrifano (RETIRED)
Modified: 2011-03-11 08:32 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Angelo Arrifano (RETIRED) gentoo-dev 2010-08-18 01:11:32 UTC
By executing epiphany with pax MPROTECT enabled, it shows the main window for half a second and then it terminates with:

PAX: execution attempt in: <anonymous mapping>, 2f910756000-2f91075a000 2f910756000
PAX: terminating task: /usr/bin/epiphany(epiphany):3874, uid/euid: 1000/1000, PC: 000002f910756228, SP: 000003d51d0aede8
PAX: bytes at PC: 59 49 89 4d d8 49 bb 0a 00 00 00 00 00 00 00 4d 89 9d 78 ff 
PAX: bytes at SP-8: 000002f8fa77b478 000002f90f9c8e89 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000002f8fa701730 000002f8fa68d108 0000000000000000 000002f8fa7098c0

Additional notes:
- I cannot reproduce this on my dual core Turion64.
- I don't have loadable plugins installed (flash, etc..)
A backtrace will follow.

scanelf -a /usr/bin/epiphany 
 TYPE    PAX   PERM ENDIAN STK/REL/PTL TEXTREL RPATH BIND FILE 
ET_DYN ---xe- 0755 LE RW- R-- RW-    -    /usr/lib64 NOW /usr/bin/epiphany

emerge --info
Portage 2.1.8.3 (hardened/linux/amd64/10.0, gcc-4.3.4, glibc-2.11.2-r0, 2.6.32-hardened-r9 x86_64)
=================================================================
System uname: Linux-2.6.32-hardened-r9-x86_64-AMD_Athlon-tm-_64_Processor_3400+-with-gentoo-2.0.1
Timestamp of tree: Sat, 14 Aug 2010 15:00:01 +0000
distcc 3.1 x86_64-pc-linux-gnu [enabled]
app-shells/bash:     4.0_p37
dev-java/java-config: 2.1.11
dev-lang/python:     2.6.5-r3, 3.1.2-r4
dev-util/cmake:      2.8.1-r2
sys-apps/baselayout: 2.0.1
sys-apps/openrc:     0.6.0-r1
sys-apps/sandbox:    1.6-r2
sys-devel/autoconf:  2.13, 2.65
sys-devel/automake:  1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.3.4
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.6b
virtual/os-headers:  2.6.30-r1
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb /var/bind"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=k8 -O2"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests collision-protect distcc distlocks fixpackages multilib-strict news parallel-fetch protect-owned sandbox sfperms strict unmerge-logs unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://cesium.di.uminho.pt/pub/gentoo/"
LANG="pt_PT.utf-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en pt"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/usr/local/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl acpi alsa amd64 aspell berkdb branding bzip2 cairo cdr cleartype cli consolekit cracklib crypt cups cxx dbus dri dvd dvdr eds exif fat ffmpeg fuse gd gdbm glitz gnome gnome-keyring gpm gstreamer gtk hardened iconv jpeg jpeg2k justify libnotify mmx modules mpeg mudflap multilib nautilus ncurses nls nptl nptlonly offensive ogg opengl openmp pam pcre perl pic png policykit pppd python readline reflection samba session spell spl sqlite sse sse2 ssl startup-notification svg sysfs tcpd threads tiff unicode urandom v4l2 vorbis webkit xinerama xorg xulrunner zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="alias autoindex authz_host dir mime mime_magic userdir log_config" APACHE2_MPMS="worker" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en pt" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="nv none nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Angelo Arrifano (RETIRED) gentoo-dev 2010-08-18 14:14:57 UTC
bt
#0  0x00000306d67fa228 in ?? ()
#1  0x00000306e6a3d769 in ctiTrampoline () from /usr/lib64/libwebkit-1.0.so.2
#2  0x00000306e6a502e7 in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*, JSC::JSValue*) () from /usr/lib64/libwebkit-1.0.so.2
#3  0x00000306e6af97eb in JSC::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValue) ()
   from /usr/lib64/libwebkit-1.0.so.2
#4  0x00000306e63cf1b8 in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*)
    () from /usr/lib64/libwebkit-1.0.so.2
#5  0x00000306e63cf882 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) ()
   from /usr/lib64/libwebkit-1.0.so.2
#6  0x00000306e63e515c in WebCore::ScriptController::executeScript(WebCore::ScriptSourceCode const&) ()
   from /usr/lib64/libwebkit-1.0.so.2
#7  0x00000306e63e53e3 in WebCore::ScriptController::executeScript(WebCore::String const&, bool) ()
   from /usr/lib64/libwebkit-1.0.so.2
#8  0x00000306e69d1265 in webkit_web_view_execute_script () from /usr/lib64/libwebkit-1.0.so.2
#9  0x0000005af114567b in ephy_window_link_message_cb (web_view=<value optimized out>, spec=<value optimized out>, 
    window=<value optimized out>) at ephy-window.c:2647
#10 0x00000306e2f6256d in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#11 0x00000306e2f77a0b in ?? () from /usr/lib64/libgobject-2.0.so.0
#12 0x00000306e2f79109 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#13 0x00000306e2f79653 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#14 0x00000306e2f66600 in ?? () from /usr/lib64/libgobject-2.0.so.0
#15 0x00000306e2f65813 in ?? () from /usr/lib64/libgobject-2.0.so.0
#16 0x00000306e2f6597b in g_object_thaw_notify () from /usr/lib64/libgobject-2.0.so.0
#17 0x0000005af117ec2f in ephy_web_view_location_changed (view=0x5af14091f0, location=0x5af16e7510 "http://www.google.pt/")
    at ephy-web-view.c:2633
#18 0x0000005af1174bca in load_status_changed_cb (view=0x5af14091f0, spec=<value optimized out>, embed=0x5af14b7980)
    at ephy-embed.c:215
#19 0x00000306e2f6256d in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#20 0x00000306e2f77a0b in ?? () from /usr/lib64/libgobject-2.0.so.0
#21 0x00000306e2f79109 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#22 0x00000306e2f79653 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#23 0x00000306e2f66600 in ?? () from /usr/lib64/libgobject-2.0.so.0
#24 0x00000306e2f68277 in g_object_notify () from /usr/lib64/libgobject-2.0.so.0
#25 0x00000306e69b4448 in WebKit::FrameLoaderClient::dispatchDidCommitLoad() () from /usr/lib64/libwebkit-1.0.so.2
#26 0x00000306e6624b8d in WebCore::FrameLoader::dispatchDidCommitLoad() () from /usr/lib64/libwebkit-1.0.so.2
#27 0x00000306e662d1c6 in WebCore::FrameLoader::receivedFirstData() () from /usr/lib64/libwebkit-1.0.so.2
#28 0x00000306e662d444 in WebCore::FrameLoader::setEncoding(WebCore::String const&, bool) () from /usr/lib64/libwebkit-1.0.so.2
#29 0x00000306e69b4b89 in WebKit::FrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) ()
   from /usr/lib64/libwebkit-1.0.so.2
#30 0x00000306e66141e8 in WebCore::DocumentLoader::commitLoad(char const*, int) () from /usr/lib64/libwebkit-1.0.so.2
#31 0x00000306e664e092 in WebCore::ResourceLoader::didReceiveData(char const*, int, long long, bool) ()
   from /usr/lib64/libwebkit-1.0.so.2
#32 0x00000306e663e867 in WebCore::MainResourceLoader::didReceiveData(char const*, int, long long, bool) ()
   from /usr/lib64/libwebkit-1.0.so.2
#33 0x00000306e699a571 in WebCore::gotChunkCallback(_SoupMessage*, SoupBuffer*, void*) () from /usr/lib64/libwebkit-1.0.so.2
#34 0x00000306e2f6256d in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#35 0x00000306e2f77a0b in ?? () from /usr/lib64/libgobject-2.0.so.0
#36 0x00000306e2f79109 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#37 0x00000306e2f79653 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#38 0x00000306e42d0f8b in ?? () from /usr/lib64/libsoup-2.4.so.1
#39 0x00000306e42d166e in ?? () from /usr/lib64/libsoup-2.4.so.1
#40 0x00000306e42d1dc8 in ?? () from /usr/lib64/libsoup-2.4.so.1
#41 0x00000306e2f6256d in g_closure_invoke () from /usr/lib64/libgobject-2.0.so.0
#42 0x00000306e2f77a0b in ?? () from /usr/lib64/libgobject-2.0.so.0
#43 0x00000306e2f79109 in g_signal_emit_valist () from /usr/lib64/libgobject-2.0.so.0
#44 0x00000306e2f79653 in g_signal_emit () from /usr/lib64/libgobject-2.0.so.0
#45 0x00000306e42dd622 in ?? () from /usr/lib64/libsoup-2.4.so.1
#46 0x00000306e2a9397c in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#47 0x00000306e2a97560 in ?? () from /usr/lib64/libglib-2.0.so.0
#48 0x00000306e2a97b55 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#49 0x00000306e54c1607 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#50 0x0000005af113a641 in main (argc=1, argv=0x3d8190870e8) at ephy-main.c:739
Comment 2 Anthony Basile gentoo-dev 2010-08-18 17:02:29 UTC
I can confirmed this bug.

From the first named function in the backtrace, it looks like webkit uses Trampolines which would trigger a pax violation.

#1  0x00000306e6a3d769 in ctiTrampoline () from /usr/lib64/libwebkit-1.0.so.2

This may be a hard one to get upstream to fix.  A workaround is to disable mprotect with paxctl -m.

Comment 3 Pacho Ramos gentoo-dev 2010-11-07 17:06:09 UTC
Could this be related with bug 338213 ?
Comment 4 Magnus Granberg gentoo-dev 2010-11-07 18:56:03 UTC
(In reply to comment #3)
> Could this be related with bug 338213 ?
> 

it looks like it is the same stuff.
Comment 5 Pacho Ramos gentoo-dev 2011-03-11 08:32:19 UTC

*** This bug has been marked as a duplicate of bug 338213 ***