Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 533074 - Stable hardened sys-devel/gcc may have been built with build-id
Summary: Stable hardened sys-devel/gcc may have been built with build-id
Status: RESOLVED DUPLICATE of bug 526144
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: High normal with 1 vote (vote)
Assignee: Gentoo Toolchain Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-19 22:27 UTC by Francisco Blas Izquierdo Riera
Modified: 2014-12-22 17:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info thunderbird firefox (emergeinfo,7.02 KB, text/plain)
2014-12-19 22:29 UTC, Francisco Blas Izquierdo Riera (RETIRED)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Francisco Blas Izquierdo Riera (RETIRED) gentoo-dev 2014-12-19 22:27:25 UTC
emerge fails to merge www-client/firefox-31.3.0 because of collisions. My main suspect here is FEATURES="splitdebug"

Reproducible: Always

Steps to Reproduce:
1.emerge -v1a thunderbird firefox

Actual Results:  
emerge finds file collisions

Expected Results:  
emerge completes sucessfully

Relevant lines of build log:
>>> Installing (2 of 2) www-client/firefox-31.3.0::gentoo
 * checking 5462 files for package collisions
1000 files checked ...
2000 files checked ...
3000 files checked ...
4000 files checked ...
5000 files checked ...
 * This package will overwrite one or more files that may belong to other
 * packages (see list below). You can use a command such as `portageq
 * owners / <filename>` to identify the installed package that owns a
 * file. If portageq reports that only one package owns a file then do
 * NOT file a bug report. A bug report is only useful if it identifies at
 * least two or more packages that are known to install the same file(s).
 * If a collision occurs and you can not explain where the file came from
 * then you should simply ignore the collision since there is not enough
 * information to determine if a real problem exists. Please do NOT file
 * a bug report at http://bugs.gentoo.org unless you report exactly which
 * two packages install the same file(s). See
 * http://wiki.gentoo.org/wiki/Knowledge_Base:Blockers for tips on how to
 * solve the problem. And once again, please do NOT file a bug report
 * unless you have completely understood the above message.
 * 
 * Detected file collision(s):
 * 
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721.debug
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf.debug
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b.debug
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3.debug
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3
 * 
 * Searching all installed packages for file collisions...
 * 
 * Press Ctrl-C to Stop
 * 
 * mail-client/thunderbird-31.3.0:0::gentoo
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721.debug
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf.debug
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3.debug
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b.debug
 * 
 * Package 'www-client/firefox-31.3.0' NOT merged due to file collisions.
 * If necessary, refer to your elog messages for the whole content of the
 * above message.

>>> Failed to install www-client/firefox-31.3.0, Log file:

>>>  '/var/tmp/portage/www-client/firefox-31.3.0/temp/build.log'

 * Messages for package mail-client/thunderbird-31.3.0:

 * You are emerging this package on a hardened profile with USE=jit enabled.
 * This is horribly insecure as it disables all PAGEEXEC restrictions.
 * Please ensure you know what you are doing.  If you don't, please consider
 * emerging the package with USE=-jit

 * Messages for package www-client/firefox-31.3.0:

 * You are emerging this package on a hardened profile with USE=jit enabled.
 * This is horribly insecure as it disables all PAGEEXEC restrictions.
 * Please ensure you know what you are doing.  If you don't, please consider
 * emerging the package with USE=-jit

 * Messages for package mail-client/thunderbird-31.3.0:

 * You are enabling official branding. You may not redistribute this build
 * to any users on your network or the internet. Doing so puts yourself into
 * a legal problem with Mozilla Foundation
 * You can disable it by emerging thunderbird _with_ the bindist USE-flag
 * 
 * 
 * If you experience problems with plugins please issue the
 * following command : rm ${HOME}/.thunderbird/*/extensions.sqlite ,
 * then restart thunderbird

 * Messages for package www-client/firefox-31.3.0:

 * You are enabling official branding. You may not redistribute this build
 * to any users on your network or the internet. Doing so puts yourself into
 * a legal problem with Mozilla Foundation
 * You can disable it by emerging firefox _with_ the bindist USE-flag
 * This package will overwrite one or more files that may belong to other
 * packages (see list below). You can use a command such as `portageq
 * owners / <filename>` to identify the installed package that owns a
 * file. If portageq reports that only one package owns a file then do
 * NOT file a bug report. A bug report is only useful if it identifies at
 * least two or more packages that are known to install the same file(s).
 * If a collision occurs and you can not explain where the file came from
 * then you should simply ignore the collision since there is not enough
 * information to determine if a real problem exists. Please do NOT file
 * a bug report at http://bugs.gentoo.org unless you report exactly which
 * two packages install the same file(s). See
 * http://wiki.gentoo.org/wiki/Knowledge_Base:Blockers for tips on how to
 * solve the problem. And once again, please do NOT file a bug report
 * unless you have completely understood the above message.
 * 
 * Detected file collision(s):
 * 
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721.debug
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf.debug
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b.debug
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3.debug
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3
 * 
 * Searching all installed packages for file collisions...
 * 
 * Press Ctrl-C to Stop
 * 
 * mail-client/thunderbird-31.3.0:0::gentoo
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721
 *      /usr/lib/debug/.build-id/1a/ee80ebec148775fb901a7f6abea228430fc721.debug
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf
 *      /usr/lib/debug/.build-id/1d/64a02068ae05ef9b85f9c3cd63163f50ec63cf.debug
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3
 *      /usr/lib/debug/.build-id/38/ee4d83c67cb87fe923d1cad84fe0ba54d0f2c3.debug
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b
 *      /usr/lib/debug/.build-id/75/39fea7467c047c76f1143dabc8232717cf867b.debug
 * 
 * Package 'www-client/firefox-31.3.0' NOT merged due to file collisions.
 * If necessary, refer to your elog messages for the whole content of the
 * above message.

 * GNU info directory index is up-to-date.
Comment 1 Francisco Blas Izquierdo Riera (RETIRED) gentoo-dev 2014-12-19 22:29:09 UTC
Created attachment 392062 [details]
emerge --info thunderbird firefox

# emerge -vp thunderbird firefox

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] mail-client/thunderbird-31.3.0  USE="crypt custom-optimization dbus gstreamer jit ldap lightning mozdom system-cairo system-icu system-jpeg system-libvpx system-sqlite -bindist -custom-cflags -debug -minimal -pulseaudio (-selinux) -startup-notification" LINGUAS="es_ES -ar -ast -be -bg -bn_BD -br -ca -cs -da -de -el -en_GB -es_AR -et -eu -fi -fr -fy_NL -ga_IE -gd -gl -he -hr -hu -hy_AM -id -is -it -ja -ko -lt -nb_NO -nl -nn_NO -pa_IN -pl -pt_BR -pt_PT -rm -ro -ru -si -sk -sl -sq -sr -sv_SE -ta_LK -tr -uk -vi -zh_CN -zh_TW" 0 KiB
[ebuild     U  ] www-client/firefox-31.3.0 [24.8.0] USE="custom-optimization dbus gstreamer hardened%* jit system-cairo system-icu system-jpeg system-libvpx%* system-sqlite wifi -bindist -custom-cflags -debug -minimal (-pgo) -pulseaudio (-selinux) -startup-notification {-test} (-alsa%*) (-libnotify%*)" LINGUAS="es_ES -af -ar -as -ast -be -bg -bn_BD -bn_IN -br -bs -ca -cs -csb -cy -da -de -el -en_GB -en_ZA -eo -es_AR -es_CL -es_MX -et -eu -fa -fi -fr -fy_NL -ga_IE -gd -gl -gu_IN -he -hi_IN -hr -hu -hy_AM -id -is -it -ja -kk -km -kn -ko -ku -lt -lv -mai -mk -ml -mr -nb_NO -nl -nn_NO -or -pa_IN -pl -pt_BR -pt_PT -rm -ro -ru -si -sk -sl -son -sq -sr -sv_SE -ta -te -th -tr -uk -vi -xh% -zh_CN -zh_TW -zu (-ak%) (-lg%) (-nso%) (-ta_LK%)" 0 KiB

Total: 2 packages (1 upgrade, 1 reinstall), Size of downloads: 0 KiB
Comment 2 Ian Stakenvicius (RETIRED) gentoo-dev 2014-12-21 02:38:27 UTC
This only occurs if either -Wl,--build-id is specified in a user's LDFLAGS when FEATURES="splitdebug" is enabled, or if a user's toolchain was built during that 2ish month period where --enable-build-ids was set by default on all gcc package merges.

The former case is considered unsupported (at least that seems to be the consensus among gentoo dev's), while the latter case's solution is to re-emerge the currently-installed gcc's.

I use FEATURES="splitdebug" myself on these packages, so I don't want to restrict it.  And we've already applied patches to ensure that the packages themselves are not adding build-id generation.  I'm not sure what else we can do here, other than perhaps eerror early upon checking to see if the toolchain generates build-ids when splitdebug is enabled in features??  If that's even possible within say, pkg_pretend or pkg_setup?
Comment 3 Francisco Blas Izquierdo Riera (RETIRED) gentoo-dev 2014-12-21 03:01:34 UTC
(In reply to Ian Stakenvicius from comment #2)
> This only occurs if either -Wl,--build-id is specified in a user's LDFLAGS
> when FEATURES="splitdebug" is enabled, or if a user's toolchain was built
> during that 2ish month period where --enable-build-ids was set by default on
> all gcc package merges.
> 
> The former case is considered unsupported (at least that seems to be the
> consensus among gentoo dev's), while the latter case's solution is to
> re-emerge the currently-installed gcc's.
> 
> I use FEATURES="splitdebug" myself on these packages, so I don't want to
> restrict it.  And we've already applied patches to ensure that the packages
> themselves are not adding build-id generation.  I'm not sure what else we
> can do here, other than perhaps eerror early upon checking to see if the
> toolchain generates build-ids when splitdebug is enabled in features??  If
> that's even possible within say, pkg_pretend or pkg_setup?

I'm afraid that period occured along with the hardened unmasking of 4.8 (ugh)

Okay Ian I'll reemerge gcc then both thunderbird and firefox and come back :)
Comment 4 Francisco Blas Izquierdo Riera (RETIRED) gentoo-dev 2014-12-22 10:12:13 UTC
Ian, reemerging gcc then both thunderbird and firefox seemed to fix this.

Given the timeline this may be affecting more stable gcc users and we may need to tell them as this may block other security updates in the future.

Here is how to test if build-id was enabled:
(You may add other paths)
# objdump -h -j .note.gnu.build-id /usr/bin/* /bin/* /sbin/* /usr/sbin/* 2> /dev/null | grep build-id

If build-id was enabled objdump the output will show lines saying something like:
  2 .note.gnu.build-id 00000024  00000000000002ac  00000000000002ac  000002ac  2**2

A simplest way is just compiling a small file (for example a hello world) and then checking it with the above command.

In this system I did the emerge on the 22 of October with stabilization happening on the 24th. So I wouldn't be surprised if the time build-id was enabled and the time sys-devel/gcc-4.8.3 was stabilized overlapped.

I'll be marking this as a duplicate.

*** This bug has been marked as a duplicate of bug 526144 ***
Comment 5 Arfrever Frehtes Taifersar Arahesis 2014-12-22 14:21:23 UTC
(In reply to Ian Stakenvicius from comment #2)
> if a user's toolchain was built
> during that 2ish month period where --enable-build-ids was set by default on
> all gcc package merges.

9.619 days, not 2 months.
http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/eclass/toolchain.eclass?r1=1.635&r2=1.636
http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/eclass/toolchain.eclass?r1=1.643&r2=1.644
Comment 6 Francisco Blas Izquierdo Riera (RETIRED) gentoo-dev 2014-12-22 17:12:14 UTC
(In reply to Arfrever Frehtes Taifersar Arahesis from comment #5)
> (In reply to Ian Stakenvicius from comment #2)
> > if a user's toolchain was built
> > during that 2ish month period where --enable-build-ids was set by default on
> > all gcc package merges.
> 
> 9.619 days, not 2 months.
> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/eclass/toolchain.
> eclass?r1=1.635&r2=1.636
> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/eclass/toolchain.
> eclass?r1=1.643&r2=1.644

It still overlaps quite nicely with the stabilization period ;) https://bugs.gentoo.org/show_bug.cgi?id=516152