| 1 |
Hi Everyone, |
| 2 |
|
| 3 |
It has take a long time to finalize XATTR_PAX support in Gentoo, but I |
| 4 |
think the final step is done. The thorniest problem was getting portage |
| 5 |
wrappers to `/usr/bin/install` to preserve extended attributes. We |
| 6 |
could have hacked up ebuilds to do the markings after install, but in |
| 7 |
some cases this meant having to do double markings in ebuilds and left a |
| 8 |
gap in our end-to-end support for other packages needing xattrs not |
| 9 |
necessarily related to PaX. I took the harder but "correct" path and |
| 10 |
wrote a wrapper. My first wrapper was written in python and worked |
| 11 |
great except it was slooooow --- actually I had one in bash which used |
| 12 |
associated arrays but that requires bash4 and portage only supports |
| 13 |
bash3! I rewrote the wrapper in C and it worked great when I by-passed |
| 14 |
the portage install machinary and used it directly, but the point was to |
| 15 |
get it working in portage! I finally traced the bug down to how the |
| 16 |
environment $PATH changes during the ebuild phases and added |
| 17 |
intelligence to the C wrapper. |
| 18 |
|
| 19 |
Anyhow, I'd like victims ... err ... I mean testers: |
| 20 |
|
| 21 |
1) Have USE=xattr and PAX_MARKINGS="XT" in you make.conf file |
| 22 |
|
| 23 |
2) Your kernel should have CONFIG_PAX_XATTR_PAX_FLAGS=y. If you are |
| 24 |
brave have CONFIG_PAX_PT_PAX_FLAGS not set. |
| 25 |
|
| 26 |
3) emerge =sys-apps/install-xattr-0.2, sys-apps/elfix. If you can |
| 27 |
emerge elfix with USE="ptpax xtpax" but if you are brave try USE="-ptpax |
| 28 |
xtpax". You must have at least xtpax in there. |
| 29 |
|
| 30 |
4) You need to apply the following patch to portage: |
| 31 |
|
| 32 |
https://git.overlays.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=9089c2d755b0ecb1b340fc23dda461163f589c43 |
| 33 |
|
| 34 |
You can just manually apply it after `cd /usr/lib/portage/` |
| 35 |
|
| 36 |
5) Then emerge any package needing pax markings (maybe not python just |
| 37 |
in case something breaks). Like johntheripper which should give |
| 38 |
|
| 39 |
~ # paxctl-ng -v /usr/sbin/john |
| 40 |
/usr/sbin/john: |
| 41 |
PT_PAX : -emr- |
| 42 |
XATTR_PAX : -emr- |
| 43 |
|
| 44 |
or just |
| 45 |
|
| 46 |
/usr/sbin/john: |
| 47 |
XATTR_PAX : -emr- |
| 48 |
|
| 49 |
If you removed all PT_PAX above. |
| 50 |
|
| 51 |
Let me know if you hit issues. The final step will be to just make sure |
| 52 |
our releases have XATTR_PAX markings and that we document how to |
| 53 |
properly installed them so you don't loose the markings. |
| 54 |
|
| 55 |
|
| 56 |
Finally, some may wonder, why XATTR_PAX markings? The main reason is |
| 57 |
that it doesn't touch the ELF binaries and makes them more consistent |
| 58 |
with what other distros ship. Also, marking can be done while the ELF |
| 59 |
is busy (eg `paxctl -m /bin/bash`, leads to "Text file busy" but you |
| 60 |
can always do `paxctl-ng -lm /bin/bash`, ie set only XATTR_PAX). This |
| 61 |
allows you to work with a live system which is useful if you ever need |
| 62 |
to do a revdep-pax to migrate pax flags from a library to the |
| 63 |
executables that link against it. The disadvantage is that xattr |
| 64 |
support requires more work and so are more fragile. |
| 65 |
|
| 66 |
|
| 67 |
-- |
| 68 |
Anthony G. Basile, Ph. D. |
| 69 |
Chair of Information Technology |
| 70 |
D'Youville College |
| 71 |
Buffalo, NY 14201 |
| 72 |
(716) 829-8197 |
Archives