Re: PaX mprotect now on for amd64

[Christos Zoulas <christos%zoulas.com@localhost>]

that probably means that ant uses a different jdk than the one you turned mprotect off on. run sh -x on ant to find which jdk it uses and paxctl +m that one too.

christos

> On May 22, 2016, at 1:09 PM, Thomas Klausner <tk%giga.or.at@localhost> wrote:
> 
>> On Sun, May 22, 2016 at 12:21:10PM -0400, Christos Zoulas wrote:
>> On May 22,  5:43pm, tk%giga.or.at@localhost (Thomas Klausner) wrote:
>> -- Subject: Re: PaX mprotect now on for amd64
>> 
>> | On Sun, May 22, 2016 at 03:13:55PM +0000, Christos Zoulas wrote:
>> | > In article <20160522151112.DB22F17FDAB%rebar.astron.com@localhost>,
>> | > Christos Zoulas <christos%zoulas.com@localhost> wrote:
>> | > >On May 22,  4:49pm, tk%giga.or.at@localhost (Thomas Klausner) wrote:
>> | > >-- Subject: Re: PaX mprotect now on for amd64
>> | > >
>> | > >| On Sat, May 14, 2016 at 01:09:53PM -0400, Christos Zoulas wrote:
>> | > >| > This breaks programs that need to map segments both writable and executable,
>> | > >| > for example java. To fix them you can:
>> | > >| > 
>> | > >| > paxctl +m /path/to/bin/java
>> | > >| 
>> | > >| libreoffice is not building on -current for me.
>> | > >| 
>> | > >| The first error is that java is detected as 32-bit version instead of
>> | > >| 64-bit. That's a bogus result, and the paxctl above fixes it.
>> | > >| 
>> | > >| However, next libreoffice wants to use ant, and that doesn't start either:
>> | > >| 
>> | > >| # ant
>> | > >| Error occurred during initialization of VM
>> | > >| Could not reserve enough space for code cache
>> | > >| 
>> | > >| What's the fix for that?
>> | > >|  Thomas
>> | > >
>> | > >Turn off ASLR for it?
>> | > 
>> | > It == java? Try that.
>> | 
>> | 'ant' is just a shell script.
>> | 
>> | I tried paxctl +a on the java binary, but see the same issue.
>> | 
>> | Just install apache-ant (using oracle jre 8) and run 'ant'.
>> |  Thomas
>> 
>> Works here.
>> 
>> 12:20pm] 271#ant
>> Buildfile: build.xml does not exist!
>> Build failed
> 
> That's interesting:
> 
> configure: error: no, you need at least Ant >= 1.6.0
> Error running configure at /scratch/misc/libreoffice/work/libreoffice-5.1.3.2/autogen.sh line 269.
> *** Error code 25
> 
> Stop.
> make[1]: stopped in /usr/pkgsrc/misc/libreoffice
> *** Error code 1
> 
> Stop.
> make: stopped in /usr/pkgsrc/misc/libreoffice
> # ant
> Error occurred during initialization of VM
> Could not reserve enough space for code cache
> # paxctl /usr/pkg/java/openjdk8/bin/java
> PaX flags:
>  a: ASLR, explicit disable
>  m: mprotect(2) restrictions, explicit disable
> 
> When I run 'ktrace -di ant', the kdump ends with
> 
> 24144      2 java     NAMI  "/usr/pkg/java/openjdk8/jre/classes"
> 24144      2 java     RET   __stat50 -1 errno 2 No such file or directory
> 24144      2 java     CALL  open(0x738eead070b0,0,0x1b6)
> 24144      2 java     NAMI  "/usr/pkg/java/openjdk8/jre/lib/meta-index"
> 24144      2 java     RET   open 4
> 24144      2 java     CALL  __fstat50(4,0x738eeb5737d0)
> 24144      2 java     RET   __fstat50 0
> 24144      2 java     CALL  read(4,0x738eead52000,0x1000)
> 24144      2 java     GIO   fd 4 read 1922 bytes
>       "% VERSION 2\n% WARNING: this file is auto-generated; do not edit\n% UNSUPPORTED: this file and its format may change and/or\n%   may be removed in a future release\n# char\
>        sets.jar\nsun/awt\nsun/nio\n! jce.jar\njavax/crypto\nsun/security\n! jsse.jar\ncom/sun/net/\nsun/security\n! management-agent.jar\n@ resources.jar\nMETA-INF/services/javax\
>        .sound.sampled.spi.AudioFileWriter\ncom/sun/imageio/\nsun/print\nMETA-INF/mimetypes.default\nMETA-INF/services/javax.sound.midi.spi.MidiDeviceProvider\ncom/sun/java/util/j\
>        ar/pack/\njavax/swing\nMETA-INF/services/sun.java2d.cmm.CMMServiceProvider\nMETA-INF/services/javax.sound.midi.spi.SoundbankReader\nMETA-INF/mailcap.default\nMETA-INF/serv\
>        ices/javax.print.PrintServiceLookup\ncom/sun/java/swing/\nMETA-INF/services/javax.sound.sampled.spi.MixerProvider\nMETA-INF/services/javax.sound.midi.spi.MidiFileWriter\nM\
>        ETA-INF/services/sun.util.spi.XmlPropertiesProvider\njavax/xml\nsun/net\nMETA-INF/services/javax.sound.sampled.spi.FormatConversionProvider\nMETA-INF/services/sun.java2d.p\
>        ipe.RenderingEngine\ncom/sun/jndi/\njavax/sql\ncom/sun/org/\njava/lang\nsun/text\nMETA-INF/services/com.sun.tools.internal.xjc.Plugin\nsun/rmi\nMETA-INF/services/javax.sou\
>        nd.midi.spi.MidiFileReader\nMETA-INF/services/javax.sound.sampled.spi.AudioFileReader\nMETA-INF/services/javax.print.StreamPrintServiceFactory\ncom/sun/corba/\ncom/sun/row\
>        set/\ncom/sun/xml/\nMETA-INF/services/com.sun.tools.internal.ws.wscompile.Plugin\n! rt.jar\ncom/sun/imageio/\ncom/sun/rmi/\ncom/sun/media/\ncom/sun/security/\ncom/sun/java\
>        _cup/\ncom/oracle/\norg/ietf/\ncom/sun/beans/\ncom/sun/java/util/jar/pack/\ncom/sun/naming/\ncom/sun/management/\ncom/sun/istack/\njava/\ncom/sun/accessibility/\nsun/\ncom\
>        /sun/java/swing/\ncom/sun/swing/\ncom/sun/demo/\ncom/sun/nio/\ncom/sun/jmx/\ncom/sun/java/browser/\norg/omg/\ncom/sun/awt/\ncom/sun/jndi/\ncom/sun/tracing/\norg/w3c/\ncom/\
>        sun/org/\njdk/\ncom/sun/net/\ncom/sun/activation/\njavax/\norg/jcp/\norg/xml/\ncom/sun/corba/\ncom/sun/rowset/\ncom/sun/xml/\n"
> 24144      2 java     RET   read 1922/0x782
> 24144      2 java     CALL  read(4,0x738eead52000,0x1000)
> 24144      2 java     GIO   fd 4 read 0 bytes
>       ""
> 24144      2 java     RET   read 0
> 24144      2 java     CALL  close(4)
> 24144      2 java     RET   close 0
> 24144      2 java     CALL  mmap(0,0xf000000,0,0x1002,0xffffffff,0,0)
> 24144      2 java     RET   mmap 127057365303296/0x738ed9200000
> 24144      2 java     CALL  mprotect(0x738ed9200000,0x270000,7)
> 24144      2 java     RET   mprotect -1 errno 13 Permission denied
> 24144      2 java     CALL  write(1,0x738eeb573350,0x2b)
> 24144      2 java     GIO   fd 1 wrote 43 bytes
>       "Error occurred during initialization of VM\n"
> 24144      2 java     RET   write 43/0x2b
> 24144      2 java     CALL  write(1,0x738eea136478,0x2d)
> 24144      2 java     GIO   fd 1 wrote 45 bytes
>       "Could not reserve enough space for code cache"
> 24144      2 java     RET   write 45/0x2d
> 24144      2 java     CALL  write(1,0x738eea141043,1)
> 
> Thomas