Just installed stable app-portage/mirrorselect and ran: mirrorselect -i Reproducible: Always Steps to Reproduce: 1. mirrorselect -i 2. 3. Actual Results: mirrorselect -i * Using url: https://api.gentoo.org/mirrors/distfiles.xml * Downloading a list of mirrors... Segmentation fault emerge --info Portage 2.2.18 (python 2.7.9-final-0, hardened/linux/amd64/no-multilib, gcc-4.8.4, glibc-2.20-r2, 3.18.9-hardened x86_64) ================================================================= System uname: Linux-3.18.9-hardened-x86_64-QEMU_Virtual_CPU_version_2.2.0-with-gentoo-2.2 KiB Mem: 2051244 total, 629652 free KiB Swap: 6290428 total, 6290428 free Timestamp of repository gentoo: Wed, 29 Apr 2015 05:45:01 +0000 sh bash 4.2_p53 ld GNU ld (Gentoo 2.24 p1.4) 2.24 ccache version 3.1.9 [enabled] app-shells/bash: 4.2_p53::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r1::gentoo, 3.4.1::gentoo dev-util/ccache: 3.1.9-r4::gentoo dev-util/cmake: 2.8.12.2-r1::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.13.11::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.69::gentoo sys-devel/automake: 1.13.4::gentoo sys-devel/binutils: 2.24-r3::gentoo sys-devel/gcc: 4.8.4::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.europe.gentoo.org/gentoo-portage priority: -1000 croessner location: /usr/local/portage masters: gentoo priority: 0 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.5/ext-active/ /etc/php/cgi-php5.5/ext-active/ /etc/php/cli-php5.5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--keep-going --with-bdeps=y --binpkg-respect-use=y --rebuilt-binaries=y --rebuilt-binaries-timestamp=20140405050000" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg ccache compressdebug config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://de-mirror.org/gentoo/ rsync://de-mirror.org/gentoo/" LANG="en_US.UTF-8" LC_ALL="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j9" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="acl adns aio amd64 bacula-clientonly bacula-console bash-completion berkdb bindist btrfs bzip2 caps cli cracklib crypt curl cxx device-mapper dri gdbm hardened iconv ipv6 justify logrotate loop-aes lzo mmap mmx mmxext modules ncurses nls nptl nscd ntp openmp openssl pam pax_kernel pcre readline session sse sse2 ssl tcpd threads unicode urandom vim-syntax xattr xtpax zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx sse sse2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="de en" NGINX_MODULES_HTTP="access auth_basic autoindex browser charset dav empty_gif fancyindex fastcgi geo gzip headers_more limit_conn limit_req map memcached proxy referer rewrite scgi spdy split_clients ssi upstream_ip_hash userid uwsgi" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" QEMU_SOFTMMU_TARGETS="x86_64 i386" QEMU_USER_TARGETS="x86_64 i386" RUBY_TARGETS="ruby20 ruby19" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga nouveau nv r128 radeon savage sis tdfx trident vesa via vmware dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Please provide a full backtrace as described here: https://wiki.gentoo.org/wiki/Bugzilla/Guide#Debugging_using_GDB P.S. 2.2.0.1 works just fine here.
Mirrorselect is pure python code, so should be nearly impossible to segfault. If you have other python versions installed, try running it with them. You will most likely have to re-emerge python or one of the other libs like openssl.
I guess, it has to do with Grsecurity. I traced the app (gdb and python??) open("/usr/lib64/python2.7/site-packages/cffi/gc_weakref.pyc", O_RDONLY) = 5 fstat(5, {st_mode=S_IFREG|0644, st_size=1158, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x6af2ec957000 read(5, "\3\363\r\na\277`Sc\0\0\0\0\0\0\0\0\3\0\0\0@\0\0\0s*\0\0\0d\0"..., 4096) = 1158 fstat(5, {st_mode=S_IFREG|0644, st_size=1158, ...}) = 0 read(5, "", 4096) = 0 close(5) = 0 munmap(0x6af2ec957000, 4096) = 0 close(4) = 0 munmap(0x6af2e642e000, 262144) = 0 munmap(0x6af2e64ae000, 262144) = 0 munmap(0x6af2e64ee000, 262144) = 0 munmap(0x6af2e652e000, 262144) = 0 munmap(0x6af2e656e000, 262144) = 0 munmap(0x6af2e65ee000, 262144) = 0 munmap(0x6af2e662e000, 262144) = 0 munmap(0x6af2e666e000, 262144) = 0 munmap(0x6af2e66ae000, 262144) = 0 munmap(0x6af2e66ee000, 262144) = 0 munmap(0x6af2e672e000, 262144) = 0 munmap(0x6af2e676e000, 262144) = 0 munmap(0x6af2e67ae000, 262144) = 0 munmap(0x6af2e67ee000, 262144) = 0 munmap(0x6af2e682e000, 262144) = 0 munmap(0x6af2e686e000, 262144) = 0 munmap(0x6af2e68ee000, 262144) = 0 munmap(0x6af2e692e000, 262144) = 0 munmap(0x6af2e696e000, 262144) = 0 munmap(0x6af2e69ae000, 262144) = 0 munmap(0x6af2e69ee000, 262144) = 0 munmap(0x6af2e6a2e000, 262144) = 0 munmap(0x6af2e6a6e000, 262144) = 0 munmap(0x6af2e6aae000, 262144) = 0 munmap(0x6af2e6b6e000, 262144) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 EPERM (Operation not permitted) --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0} --- +++ killed by SIGSEGV +++ Segmentation fault And this is, what the kernel message buffer said: [390433.645995] grsec: From 193.239.106.201: denied RWX mmap of <anonymous mapping> by /usr/lib64/python-exec/python2.7/mirrorselect[mirrorselect:24420] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/strace[strace:24417] uid/euid:0/0 gid/egid:0/0 So I might fix this with paxctl, but at the end something crashes: [390421.989628] mirrorselect[24409]: segfault at 0 ip 00006de65b83c3d5 sp 0000765f21c3be60 error 6 in libffi.so.6.0.1[6de65b836000+8000] Whatever libel is, it should not set fault. It seems it does not catch an exception in the mmap operation and therefor crashes,
It is impossible for me to debug this with gdb. I recompiled python2.7 and lib with FEATURES="nostril" and -ggdb support. I set the gdb PaX flags, but I see exactly nothing, when the crash appears. So unfortunately I can not provide debugging symbols. All you can do is look at the lib code for the mmap operation, if that might be buggy. I _could_ try to set paxctl -m for /usr/bin/python2.7, but I am not sure, if that is really clever or not.
Setting paxctl -m /usr/bin/python2.7 is a temporar workaround
Anthony, Can you shed any light on this problem? Is it a paxctl problem?
(In reply to Brian Dolbec from comment #6) > Anthony, Can you shed any light on this problem? Is it a paxctl problem? Yes. You need two things to get python working right in a hardened kernel: 1) paxctl-ng -vE /usr/bin/python2.7 #enable trampolines in userland 2) CONFIG_PAX_EMUTRAMP=y #enable trampolitines in the kernel. Disabling MPROTECT works but is overkill. For a few years now, python has decided that they want to use PROT_WRITE | PROT_EXEC in their mmap()-ings. This opens up a gaping security hole which we have mitigated by using kernel assisted trampolines. @Christian. Sorry, we've tried to get the word out. Maybe we could add it to our FAQ? I'm going to close this INVALID. Please reopen if the above doesn't fix your issue.
paxctl-ng -v /usr/bin/python2.7 /usr/bin/python2.7: PT_PAX : -Em-- XATTR_PAX : not found It does not work for me without -m So I reopen it. My kernel is compiled with trampoline support: CONFIG_PAX_EMUTRAMP=y So I had to add MPROTECT disabled. It seems the -E does not solve the problem here.
(In reply to Christian Roessner from comment #8) > paxctl-ng -v /usr/bin/python2.7 > /usr/bin/python2.7: > PT_PAX : -Em-- > XATTR_PAX : not found > > It does not work for me without -m > > So I reopen it. > > My kernel is compiled with trampoline support: > > CONFIG_PAX_EMUTRAMP=y > > So I had to add MPROTECT disabled. It seems the -E does not solve the > problem here. If you have dev-python/cffi installed you need to use unstable version.
I can confirm that using unstable cffi, mirrorselect works. But is this not considered a bug, if a dependency requires an unstable XYZ for a stable package? At least thanks for your help.
*** This bug has been marked as a duplicate of bug 525494 ***
(In reply to Christian Roessner from comment #10) > I can confirm that using unstable cffi, mirrorselect works. But is this not > considered a bug, if a dependency requires an unstable XYZ for a stable > package? > > At least thanks for your help. It is a bug. I thought the appropriate version of cffi was already stable. My bad. We're stabilizing it now. Bug #548530.
