remove some format hardenings by oxij · Pull Request #41192 · NixOS/nixpkgs

oxij · 2018-05-29T03:40:27Z

Motivation for this change

Fixing fallout from #28029 and continuing #39463.

Things done

Everything built before rebase.

GrahamcOfBorg · 2018-05-29T03:53:51Z

Success on x86_64-linux (full log)

Attempted: a52dec, libgdiplus, tinyxml

Partial log (click to expand)

post-installation fixup
moving /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/man to /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/share/man
shrinking RPATHs of ELF executables and libraries in /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4
shrinking /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/bin/a52dec
shrinking /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/bin/extract_a52
gzipping man pages under /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/share/man/
strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/lib  /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4/bin
patching script interpreter paths in /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4
checking for references to /build in /nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4...

oxij · 2018-05-29T03:54:56Z

@GrahamcOfBorg build linuxPackages.perf haskellPackages.ghc802

GrahamcOfBorg · 2018-05-29T03:56:44Z

Success on x86_64-linux (full log)

Attempted: linuxPackages.perf

The following builds were skipped because they don't evaluate on x86_64-linux: haskellPackages.ghc802

Partial log (click to expand)

/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/libexec/perf-core/scripts/perl/bin/rw-by-file-report: interpreter directive changed from "/bin/bash" to "/nix/store/m47apl3hq3i52fzy2cz24378p0xn4lyx-bash-4.4-p19/bin/bash"
/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/libexec/perf-core/scripts/perl/rwtop.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/kag4rrbjj5hih61dlagry62v82l0gscw-perl-5.24.3/bin/perl -w"
/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/libexec/perf-core/scripts/perl/wakeup-latency.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/kag4rrbjj5hih61dlagry62v82l0gscw-perl-5.24.3/bin/perl -w"
/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/libexec/perf-core/perf-with-kcore: interpreter directive changed from "/bin/bash" to "/nix/store/m47apl3hq3i52fzy2cz24378p0xn4lyx-bash-4.4-p19/bin/bash"
checking for references to /build in /nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44...
moving /nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/lib64/* to /nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44/lib
shrinking RPATHs of ELF executables and libraries in /nix/store/929f5q1zbf6gwa4l4bq4kra9w0rg3jx5-perf-linux-4.14.44-debug
patching script interpreter paths in /nix/store/929f5q1zbf6gwa4l4bq4kra9w0rg3jx5-perf-linux-4.14.44-debug
checking for references to /build in /nix/store/929f5q1zbf6gwa4l4bq4kra9w0rg3jx5-perf-linux-4.14.44-debug...
/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44

GrahamcOfBorg · 2018-05-29T04:00:05Z

Success on aarch64-linux (full log)

Attempted: linuxPackages.perf

The following builds were skipped because they don't evaluate on aarch64-linux: haskellPackages.ghc802

Partial log (click to expand)

/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/libexec/perf-core/scripts/perl/rw-by-file.pl: interpreter directive changed from "/usr/bin/perl -w" to "/nix/store/0cicmg6kkz0r056kxhcfwgmf4wjr3ham-perl-5.24.3/bin/perl -w"
/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/libexec/perf-core/perf-with-kcore: interpreter directive changed from "/bin/bash" to "/nix/store/vnb8q2h7951gd551nm2vq2g6n8296g5b-bash-4.4-p19/bin/bash"
/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/libexec/perf-core/perf-archive: interpreter directive changed from "/bin/bash" to "/nix/store/vnb8q2h7951gd551nm2vq2g6n8296g5b-bash-4.4-p19/bin/bash"
/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/libexec/perf-core/tests/attr.py: interpreter directive changed from " /usr/bin/python" to "/nix/store/1xkxxrd2sd8q78icm687ac8si9miak45-python-2.7.15/bin/python"
checking for references to /build in /nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44...
moving /nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/lib64/* to /nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44/lib
shrinking RPATHs of ELF executables and libraries in /nix/store/3wi0hsdx5yhqjm53nx5s6086ks5p4nz8-perf-linux-4.14.44-debug
patching script interpreter paths in /nix/store/3wi0hsdx5yhqjm53nx5s6086ks5p4nz8-perf-linux-4.14.44-debug
checking for references to /build in /nix/store/3wi0hsdx5yhqjm53nx5s6086ks5p4nz8-perf-linux-4.14.44-debug...
/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44

oxij · 2018-05-29T04:01:12Z

@GrahamcOfBorg build haskell.compiler.ghc802

GrahamcOfBorg · 2018-05-29T04:01:53Z

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: haskell.compiler.ghc802

Partial log (click to expand)


a) For `nixos-rebuild` you can set
  { nixpkgs.config.allowUnsupportedSystem = true; }
in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.

GrahamcOfBorg · 2018-05-29T04:40:46Z

Success on x86_64-linux (full log)

Attempted: haskell.compiler.ghc802

Partial log (click to expand)

strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
patching script interpreter paths in /nix/store/vnzhm68hg3minr68ckcflndhfiphkgsd-ghc-8.0.2-man
checking for references to /build in /nix/store/vnzhm68hg3minr68ckcflndhfiphkgsd-ghc-8.0.2-man...
shrinking RPATHs of ELF executables and libraries in /nix/store/m7wrj3pfgjxnw62pq924ba8jwasdbxm6-ghc-8.0.2-doc
/nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
patching script interpreter paths in /nix/store/m7wrj3pfgjxnw62pq924ba8jwasdbxm6-ghc-8.0.2-doc
/nix/store/m7wrj3pfgjxnw62pq924ba8jwasdbxm6-ghc-8.0.2-doc/share/doc/ghc/html/libraries/gen_contents_index: interpreter directive changed from "/bin/sh" to "/nix/store/m47apl3hq3i52fzy2cz24378p0xn4lyx-bash-4.4-p19/bin/sh"
checking for references to /build in /nix/store/m7wrj3pfgjxnw62pq924ba8jwasdbxm6-ghc-8.0.2-doc...
/nix/store/f7jhkc1frnqb37l7h3gi51y4vc8qnwry-ghc-8.0.2

GrahamcOfBorg · 2018-05-29T04:44:48Z

Success on aarch64-linux (full log)

Attempted: a52dec, libgdiplus, tinyxml

Partial log (click to expand)

post-installation fixup
shrinking RPATHs of ELF executables and libraries in /nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9
shrinking /nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9/lib/libgdiplus.so.0.0.0
strip is /nix/store/8yfik687kfccisxnad42j19lfb7ij9b4-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9/lib
patching script interpreter paths in /nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9
checking for references to /build in /nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9...
/nix/store/ff9wqbmjbi4dfbfjxlpnqgpamfh1blhb-a52dec-0.7.4p4
/nix/store/g2ws2p2qggz29l3m9klymln4i67k2ch4-libgdiplus-2.10.9
/nix/store/sx89pf3psyxxrn8zdq155ds3aa4jdj20-tinyxml-2.6.2

xeji · 2018-05-29T06:34:14Z

libgdiplus: see also #41187

peti · 2018-05-29T06:41:39Z

How about haskell.packages.ghc842.ghc? It also seems to have trouble with the new hardening features: https://hydra.nixos.org/build/75026569. Or is that not related?

One test still fails :(

before squashing was: "disable pic hardening on i686, else tests will fail"

oxij · 2018-05-29T07:41:22Z

libgdiplus

Identical change, rebased.

How about `haskell.packages.ghc842.ghc`?

Likely related, fixed.

GrahamcOfBorg · 2018-05-29T07:49:10Z

Success on aarch64-linux (full log)

Attempted: a52dec, linuxPackages.perf, tinyxml

The following builds were skipped because they don't evaluate on aarch64-linux: haskell.compiler.ghc802, haskell.compiler.ghc842

Partial log (click to expand)

in configuration.nix to override this.

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
  { allowUnsupportedSystem = true; }
to ~/.config/nixpkgs/config.nix.


/nix/store/ff9wqbmjbi4dfbfjxlpnqgpamfh1blhb-a52dec-0.7.4p4
/nix/store/phi6j1ybq9xkbrl64yj48c4acxsng7az-perf-linux-4.14.44
/nix/store/sx89pf3psyxxrn8zdq155ds3aa4jdj20-tinyxml-2.6.2

GrahamcOfBorg · 2018-05-29T08:30:50Z

Success on x86_64-linux (full log)

Attempted: a52dec, haskell.compiler.ghc802, haskell.compiler.ghc842, linuxPackages.perf, tinyxml

Partial log (click to expand)

/nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
strip is /nix/store/92d2ifxcni4n3zx9s8wnkcjlvnx5ajlc-binutils-2.30/bin/strip
patching script interpreter paths in /nix/store/s2fmlbgfydj5pf2pgb75l91d80cmk9f9-ghc-8.4.2-doc
/nix/store/s2fmlbgfydj5pf2pgb75l91d80cmk9f9-ghc-8.4.2-doc/share/doc/ghc/html/libraries/gen_contents_index: interpreter directive changed from "/bin/sh" to "/nix/store/m47apl3hq3i52fzy2cz24378p0xn4lyx-bash-4.4-p19/bin/sh"
checking for references to /build in /nix/store/s2fmlbgfydj5pf2pgb75l91d80cmk9f9-ghc-8.4.2-doc...
/nix/store/wrfqv2j2z9jzrgp2jln0k9q246lzir3s-a52dec-0.7.4p4
/nix/store/f7jhkc1frnqb37l7h3gi51y4vc8qnwry-ghc-8.0.2
/nix/store/qqpj7di0zjbfwpziz5bn8w2kf9cyn42c-ghc-8.4.2
/nix/store/xmissrgpzr4nmypcmphgf2mn5ni0xpzx-perf-linux-4.14.44
/nix/store/ps9drs0ya9l81nk3kida9hkd5qcfamli-tinyxml-2.6.2

peti · 2018-05-29T09:00:53Z

ghc-7.10.3 and ghc-head are also broken. :-(

I committed a246b6e6f8a33622d0be001391a9087820030134 and 8d36f159fa3dcdb2b8f4872787a4bf67748fd7db to the haskell-updates branch to fix.

EDIT: I needed two attempts to get the hyperlinks to the commits right.

oxij · 2018-05-29T09:18:31Z

Okay. Do you want me to do anything else with this? Ofborg clearly shows that this doesn't make things worse, so I would just merge so that master would hopefully start to build again.

oxij requested a review from peti as a code owner May 29, 2018 03:40

oxij force-pushed the tree/hardening-unformat branch from 75b5d0b to 486948f Compare May 29, 2018 03:41

This was referenced May 29, 2018

hardening: fix #18995 #28029

Merged

Build of ghc-8.0.2 is broken #41166

Closed

oxij and others added 7 commits May 29, 2018 07:31

tree-wide: random cleanups

725de31

tinyxml: disable format hardening, else tests will fail

3d53d14

linuxPackages.perf: disable format hardening, else tests will fail

edc59b4

perlPackages.GD: disable format hardening to fix some tests

430da80

One test still fails :(

a52dec: disable tests on i686

e102dc7

before squashing was: "disable pic hardening on i686, else tests will fail"

haskell.compiler.ghc802: disable format hardening, else tests will fail

ee5660e

haskell.compiler.ghc842: disable format hardening

29757f3

oxij force-pushed the tree/hardening-unformat branch from 486948f to 29757f3 Compare May 29, 2018 07:36

peti approved these changes May 29, 2018

View reviewed changes

peti merged commit 5418dfc into NixOS:master May 29, 2018

oxij deleted the tree/hardening-unformat branch September 8, 2018 22:19

Uh oh!

Conversation

oxij commented May 29, 2018

Motivation for this change

Things done

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

oxij commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

oxij commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

xeji commented May 29, 2018

Uh oh!

peti commented May 29, 2018

Uh oh!

oxij commented May 29, 2018 via email

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

GrahamcOfBorg commented May 29, 2018

Uh oh!

peti commented May 29, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oxij commented May 29, 2018 via email

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

peti commented May 29, 2018 •

edited

Loading