Bug 911150
| Summary: | Some programs in zfs-fuse have an executable stack | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Steve Grubb <sgrubb> | ||||
| Component: | zfs-fuse | Assignee: | Gwyn Ciesla <gwync> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 18 | CC: | gwync | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2013-03-12 23:20:58 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Steve Grubb
2013-02-14 13:48:39 UTC
Running execstack -c on each of those binaries takes care of this, and doesn't seem to impede normal function. Should this be fixed in all releases, or just rawhide for now? I would fix rawhide -> F17. Its better to go after the root cause. It may be nested functions or handwritten assembler that is causing the problem. But if nothing else, then execstack might be used. Further investigation shows the problem is worse than I thought...this package does not have the stack-protector or FORTIFY_SOURCE settings applied either. I am working on a patch for this. Will attach it later. Ok, I've already used execstack in rawhide, I'll apply your patch through f17 when it appears. Thanks! Created attachment 697823 [details]
Patch that adds stack-protector and FORTIFY_SOURCE
The attached patch works on my F18 system. I had to patch a Makefile.in rather than Makefile.am in libumem because running autoreconf totally messed up the resulting Makefile. So, that means the patch may require some adjustment on upstream source upgrades.
I think the problem results because scons doesn't setup the right environment variables when it runs external scripts.
Please test carefully because now that the stack protector and FORTIFY_SOURCE are working, we just might detect actual problems. :-) Thanks.
Looks great, still works, I'll get it out the door. Thanks! Hi...just checking on this...I see a -10 build sitting in koji, but I don't see any updates being pushed through bodhi. I was hoping this would go out to everyone as an update so that if there were any defects found at some point in the future, there is some measure of preventive mechanisms that would make it harder to exploit. Thanks. Sorry about that, I'll get that out. That was a. . .full. . .week. :) zfs-fuse-0.7.0-10.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/zfs-fuse-0.7.0-10.fc18 zfs-fuse-0.7.0-3.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/zfs-fuse-0.7.0-3.fc17 Package zfs-fuse-0.7.0-3.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing zfs-fuse-0.7.0-3.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-3382/zfs-fuse-0.7.0-3.fc17 then log in and leave karma (feedback). zfs-fuse-0.7.0-3.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. zfs-fuse-0.7.0-10.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. |