Re: PaX mprotect now on for amd64

[Thomas Klausner <tk%giga.or.at@localhost>]

On Sun, May 22, 2016 at 12:21:10PM -0400, Christos Zoulas wrote:
> On May 22,  5:43pm, tk%giga.or.at@localhost (Thomas Klausner) wrote:
> -- Subject: Re: PaX mprotect now on for amd64
> 
> | On Sun, May 22, 2016 at 03:13:55PM +0000, Christos Zoulas wrote:
> | > In article <20160522151112.DB22F17FDAB%rebar.astron.com@localhost>,
> | > Christos Zoulas <christos%zoulas.com@localhost> wrote:
> | > >On May 22,  4:49pm, tk%giga.or.at@localhost (Thomas Klausner) wrote:
> | > >-- Subject: Re: PaX mprotect now on for amd64
> | > >
> | > >| On Sat, May 14, 2016 at 01:09:53PM -0400, Christos Zoulas wrote:
> | > >| > This breaks programs that need to map segments both writable and executable,
> | > >| > for example java. To fix them you can:
> | > >| > 
> | > >| > paxctl +m /path/to/bin/java
> | > >| 
> | > >| libreoffice is not building on -current for me.
> | > >| 
> | > >| The first error is that java is detected as 32-bit version instead of
> | > >| 64-bit. That's a bogus result, and the paxctl above fixes it.
> | > >| 
> | > >| However, next libreoffice wants to use ant, and that doesn't start either:
> | > >| 
> | > >| # ant
> | > >| Error occurred during initialization of VM
> | > >| Could not reserve enough space for code cache
> | > >| 
> | > >| What's the fix for that?
> | > >|  Thomas
> | > >
> | > >Turn off ASLR for it?
> | > 
> | > It == java? Try that.
> | 
> | 'ant' is just a shell script.
> | 
> | I tried paxctl +a on the java binary, but see the same issue.
> | 
> | Just install apache-ant (using oracle jre 8) and run 'ant'.
> |  Thomas
> 
> Works here.
> 
> 12:20pm] 271#ant
> Buildfile: build.xml does not exist!
> Build failed

That's interesting:

configure: error: no, you need at least Ant >= 1.6.0
Error running configure at /scratch/misc/libreoffice/work/libreoffice-5.1.3.2/autogen.sh line 269.
*** Error code 25

Stop.
make[1]: stopped in /usr/pkgsrc/misc/libreoffice
*** Error code 1

Stop.
make: stopped in /usr/pkgsrc/misc/libreoffice
# ant
Error occurred during initialization of VM
Could not reserve enough space for code cache
# paxctl /usr/pkg/java/openjdk8/bin/java
PaX flags:
  a: ASLR, explicit disable
  m: mprotect(2) restrictions, explicit disable

When I run 'ktrace -di ant', the kdump ends with

 24144      2 java     NAMI  "/usr/pkg/java/openjdk8/jre/classes"
 24144      2 java     RET   __stat50 -1 errno 2 No such file or directory
 24144      2 java     CALL  open(0x738eead070b0,0,0x1b6)
 24144      2 java     NAMI  "/usr/pkg/java/openjdk8/jre/lib/meta-index"
 24144      2 java     RET   open 4
 24144      2 java     CALL  __fstat50(4,0x738eeb5737d0)
 24144      2 java     RET   __fstat50 0
 24144      2 java     CALL  read(4,0x738eead52000,0x1000)
 24144      2 java     GIO   fd 4 read 1922 bytes
       "% VERSION 2\n% WARNING: this file is auto-generated; do not edit\n% UNSUPPORTED: this file and its format may change and/or\n%   may be removed in a future release\n# char\
        sets.jar\nsun/awt\nsun/nio\n! jce.jar\njavax/crypto\nsun/security\n! jsse.jar\ncom/sun/net/\nsun/security\n! management-agent.jar\n@ resources.jar\nMETA-INF/services/javax\
        .sound.sampled.spi.AudioFileWriter\ncom/sun/imageio/\nsun/print\nMETA-INF/mimetypes.default\nMETA-INF/services/javax.sound.midi.spi.MidiDeviceProvider\ncom/sun/java/util/j\
        ar/pack/\njavax/swing\nMETA-INF/services/sun.java2d.cmm.CMMServiceProvider\nMETA-INF/services/javax.sound.midi.spi.SoundbankReader\nMETA-INF/mailcap.default\nMETA-INF/serv\
        ices/javax.print.PrintServiceLookup\ncom/sun/java/swing/\nMETA-INF/services/javax.sound.sampled.spi.MixerProvider\nMETA-INF/services/javax.sound.midi.spi.MidiFileWriter\nM\
        ETA-INF/services/sun.util.spi.XmlPropertiesProvider\njavax/xml\nsun/net\nMETA-INF/services/javax.sound.sampled.spi.FormatConversionProvider\nMETA-INF/services/sun.java2d.p\
        ipe.RenderingEngine\ncom/sun/jndi/\njavax/sql\ncom/sun/org/\njava/lang\nsun/text\nMETA-INF/services/com.sun.tools.internal.xjc.Plugin\nsun/rmi\nMETA-INF/services/javax.sou\
        nd.midi.spi.MidiFileReader\nMETA-INF/services/javax.sound.sampled.spi.AudioFileReader\nMETA-INF/services/javax.print.StreamPrintServiceFactory\ncom/sun/corba/\ncom/sun/row\
        set/\ncom/sun/xml/\nMETA-INF/services/com.sun.tools.internal.ws.wscompile.Plugin\n! rt.jar\ncom/sun/imageio/\ncom/sun/rmi/\ncom/sun/media/\ncom/sun/security/\ncom/sun/java\
        _cup/\ncom/oracle/\norg/ietf/\ncom/sun/beans/\ncom/sun/java/util/jar/pack/\ncom/sun/naming/\ncom/sun/management/\ncom/sun/istack/\njava/\ncom/sun/accessibility/\nsun/\ncom\
        /sun/java/swing/\ncom/sun/swing/\ncom/sun/demo/\ncom/sun/nio/\ncom/sun/jmx/\ncom/sun/java/browser/\norg/omg/\ncom/sun/awt/\ncom/sun/jndi/\ncom/sun/tracing/\norg/w3c/\ncom/\
        sun/org/\njdk/\ncom/sun/net/\ncom/sun/activation/\njavax/\norg/jcp/\norg/xml/\ncom/sun/corba/\ncom/sun/rowset/\ncom/sun/xml/\n"
 24144      2 java     RET   read 1922/0x782
 24144      2 java     CALL  read(4,0x738eead52000,0x1000)
 24144      2 java     GIO   fd 4 read 0 bytes
       ""
 24144      2 java     RET   read 0
 24144      2 java     CALL  close(4)
 24144      2 java     RET   close 0
 24144      2 java     CALL  mmap(0,0xf000000,0,0x1002,0xffffffff,0,0)
 24144      2 java     RET   mmap 127057365303296/0x738ed9200000
 24144      2 java     CALL  mprotect(0x738ed9200000,0x270000,7)
 24144      2 java     RET   mprotect -1 errno 13 Permission denied
 24144      2 java     CALL  write(1,0x738eeb573350,0x2b)
 24144      2 java     GIO   fd 1 wrote 43 bytes
       "Error occurred during initialization of VM\n"
 24144      2 java     RET   write 43/0x2b
 24144      2 java     CALL  write(1,0x738eea136478,0x2d)
 24144      2 java     GIO   fd 1 wrote 45 bytes
       "Could not reserve enough space for code cache"
 24144      2 java     RET   write 45/0x2d
 24144      2 java     CALL  write(1,0x738eea141043,1)

 Thomas