Bug 442616 – dev-db/couchdb - /usr/lib/couchdb/bin/couchjs needs pax-mark mr on PaX-enabled systems.

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Mira Ressel 2012-11-10 17:23:36 UTC]

On PaX-enabled systems (hardened-sources), all Javascript-related functions (views, for example) in CouchDB don't work if you don't disable MPROTECT for /usr/bin/couchjs.

Could you please add a 'pax-mark m "${D}/usr/bin/couchjs" to the ebuild (provided by pax-utils.eclass)?

[Comment 1 Tom Wijsman (TomWij) (RETIRED) 2012-11-10 23:15:38 UTC]

Sorry for the extra mail, category change has reset "assigned to". :(

[Comment 2 Mira Ressel 2013-01-12 18:34:44 UTC]

The PaX feature RANDMMAP also has to be disabled, otherwise couchjs will get stuck in an infinite loop inside libmozjs.

So it's 'pax-mark mr "${D}/usr/bin/couchjs"' what you have to add to the ebuild.

[Comment 3 Dirkjan Ochtman (RETIRED) 2013-03-01 09:18:25 UTC]

Does that need to be guarded by a use hardened condition or something similar? I don't have much experience with hardened systems, so an actual patch would be welcome.

[Comment 4 Mira Ressel 2013-03-01 19:13:05 UTC]

Created attachment 340680 [details, diff]
Patch for dev-db/couchdb-1.2.1.ebuild

[Comment 5 Mira Ressel 2013-03-01 19:15:14 UTC]

Aww, my comment somehow didn't get through, so here it is again:

No, pax-mark can be called unconditionally. In this particular case, it has to be called from src_compile, otherwise the tests won't pass.

[Comment 6 Magnus Granberg 2013-03-01 23:54:41 UTC]

The patch looks okay for mee.

[Comment 7 Dirkjan Ochtman (RETIRED) 2013-05-03 11:26:26 UTC]

Committed couchdb-1.3.0 with this fix.