Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 442616 - dev-db/couchdb - /usr/lib/couchdb/bin/couchjs needs pax-mark mr on PaX-enabled systems.
Summary: dev-db/couchdb - /usr/lib/couchdb/bin/couchjs needs pax-mark mr on PaX-enable...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Development (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Dirkjan Ochtman
URL:
Whiteboard:
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2012-11-10 17:23 UTC by Mira Ressel
Modified: 2013-05-03 11:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Patch for dev-db/couchdb-1.2.1.ebuild (couchdb-1.2.1.ebuild.patch,600 bytes, patch)
2013-03-01 19:13 UTC, Mira Ressel
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mira Ressel 2012-11-10 17:23:36 UTC
On PaX-enabled systems (hardened-sources), all Javascript-related functions (views, for example) in CouchDB don't work if you don't disable MPROTECT for /usr/bin/couchjs.

Could you please add a 'pax-mark m "${D}/usr/bin/couchjs" to the ebuild (provided by pax-utils.eclass)?
Comment 1 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2012-11-10 23:15:38 UTC
Sorry for the extra mail, category change has reset "assigned to". :(
Comment 2 Mira Ressel 2013-01-12 18:34:44 UTC
The PaX feature RANDMMAP also has to be disabled, otherwise couchjs will get stuck in an infinite loop inside libmozjs.

So it's 'pax-mark mr "${D}/usr/bin/couchjs"' what you have to add to the ebuild.
Comment 3 Dirkjan Ochtman gentoo-dev 2013-03-01 09:18:25 UTC
Does that need to be guarded by a use hardened condition or something similar? I don't have much experience with hardened systems, so an actual patch would be welcome.
Comment 4 Mira Ressel 2013-03-01 19:13:05 UTC
Created attachment 340680 [details, diff]
Patch for dev-db/couchdb-1.2.1.ebuild
Comment 5 Mira Ressel 2013-03-01 19:15:14 UTC
Aww, my comment somehow didn't get through, so here it is again:

No, pax-mark can be called unconditionally. In this particular case, it has to be called from src_compile, otherwise the tests won't pass.
Comment 6 Magnus Granberg gentoo-dev 2013-03-01 23:54:41 UTC
The patch looks okay for mee.
Comment 7 Dirkjan Ochtman gentoo-dev 2013-05-03 11:26:26 UTC
Committed couchdb-1.3.0 with this fix.