Gentoo Archives: gentoo-hardened

From: Alessandro Di Federico <ale@×××××××××.me>
To: gentoo-hardened@l.g.o
Subject: [gentoo-hardened] PaX marking during build for mono & others
Date: Tue, 14 May 2013 07:27:16
Message-Id: FArCusV2Z7fcY-8q6vRPFrAK2kyyVKjZzIP2WKOv_f9_1RQyXLo4ya7bP6Z7t5XNsQ56jqPi-pqM2TM-wnwH6Q@localhost.localdomain
1 Hi, currently several ebuilds sed some build scripts inject a paxctl
2 call to mark the executable in various ways. However paxctl does not
3 handle xattr marking, leading e.g. to bug #467238 [1].
4 pax-utils.eclass correctly handles this cases checking the PAX_MARKINGS
5 variable.
6 The pax-mark function should become a standalone script to include in
7 elfix, portage or maybe just generate a script (e.g. pax-mark.sh) and
8 copy it in the build directory and inject pax-mark.sh instead of paxctl.
9
10 Grepping /usr/portage these are packages which most probably are
11 affected by the same problems:
12
13 sys-boot/grub-0.96-r1
14 net-libs/webkit-gtk-* (gir-paxctl-lt-wrapper script)
15 www-client/epiphany-*
16 www-client/luakit-9999
17 dev-lisp/sbcl-*
18 app-emulation/wine-*
19 app-emulation/qemu-user-0.9.0 (?)
20 dev-lang/mono-*
21
22 What's the most appropriate way to go?
23
24 Thanks,
25 --
26 Ale
27
28 [1] https://bugs.gentoo.org/show_bug.cgi?id=467238