Gentoo Archives: gentoo-dev

From: Mike Gilbert <floppym@g.o>
To: Gentoo Dev <gentoo-dev@l.g.o>
Subject: Re: [gentoo-dev] Automagic pax-mark
Date: Sun, 07 Apr 2013 21:21:02
In Reply to: [gentoo-dev] Automagic pax-mark by "Chí-Thanh Christopher Nguyễn"
1 On Sun, Apr 7, 2013 at 5:11 PM, Chí-Thanh Christopher Nguyễn
2 <chithanh@g.o> wrote:
3 > Hello All,
4 >
5 > After recent changes in dev-lang/v8 and related ebuilds, the pax-mark call no
6 > longer has a || die. This means that the resulting binaries may have PT_PAX,
7 > XATTR_PAX, both or neither markings depending on kernel configuration,
8 > filesystem and mount options.
9 >
10 > I'd say that is not a good thing. If you agree with me, what could be done
11 > here? Have pax-mark die in the eclass or mandate || die in ebuilds? This
12 > would probably require pax-mark calls to be conditional on pax_kernel USE
13 > flag or similar.
14 >
16 Most ebuilds do not call pax-mark || die. Most people do not run PaX
17 systems, so a failure here is not a major issue.
19 I would like to see the kernel patch enabling user.pax attributes on
20 tmpfs submitted to Linus' kernel tree; that would eliminate the major
21 cause of failures here.
23 In the mean time, maybe we could disable XATTR_PAX markings by default
24 for people not using the hardened profile.


Subject Author
Re: [gentoo-dev] Automagic pax-mark "Anthony G. Basile" <blueness@g.o>
Re: [gentoo-dev] Automagic pax-mark "Chí-Thanh Christopher Nguyễn" <chithanh@g.o>