xorg vs hardened, pie et. al., and unresolved symbols

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

I found that the only way I can get X to install without the strange symbol unresolved errors, is to remove hardened, pic and pie from the use flags, re-build gcc!, clear the ccache (ccache -C) just in case, then build xorg-x11 with the same. Then I put 'hardened pic pie' back into make.conf and rebuild gcc again... The big point is that the only way to get it to build was to rebuild gcc first! Trying to build just xorg-x11 without the hardened flags didn't solve anything; rebuilding gcc was necessary.

Obviously, there may be a smaller set. Perhaps removing hardened from gcc then just pie from xorg-x11 - but frankly it gets very boring rebuilding all this just to try things out!

Whoops - this was meant to be a reply to the xorg-x11 sticky topic, not a new one :/

tomaw · Guru Joined: 26 Mar 2003 Posts: 429 Location: UK

You might be interested in this bug and those linked off of it.
_________________
Tom Wesley

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

Interesting; that bug report says the dlloader is unsupported. Yet it's built that way by default (I didn't do anything to request the dllloader).

Freedesktop implies it's mostly down to sloppy programming in the drivers.

I'm not sure, but the root problem I had that required rebuilding gcc might be different; with "USE=-pie", the unresolved symbols in the graphics driver went away (on both my nvidia desktop and the ati laptop), but a single unresolved symbol remained, which didn't go away until I rebuilt gcc. Unfortunately I've lost the log

I'll have to find time to regenerate the error, I suppose.

spudicus · Posted: Tue Jul 06, 2004 3:41 am Post subject:

I had the same problem but was (finally) able to emerge xorg with hardened/pie USE flags after following Solar's advice i.e. compiled xorg statically

HydroSan · Posted: Tue Jul 06, 2004 3:54 am Post subject:

spudicus · Posted: Tue Jul 06, 2004 5:24 am Post subject:

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

Just an update; I emerged xorg-x11 r2 last night; so tried a slight variation. Built gcc with just USE="-hardened" emerge gcc, then built xorg-x11 straight (and then rebuilt gcc) - I don't think xorg-x11 looks at hardened, pic or pie. So there's no point messing with pic and pie flags. There's a new use flag, dlloader, which might be related - but it's undocumented, as is sdk.

The reason for rebuilding gcc, is that hardened gcc has pie et. al. switched on by default, which the xorg-x11 build is no doubt assuming is off by default. There must be some low-level code in there somewhere that violates the hardened gcc constraints - but that's a lot of code to search! Had a related issue with Wine from cvs, however that failed to compile at the relevant file, which made it easy to find what to fix (preloader.c, if anyone's interested - hacked the makefile for the loader to use -fno-stack-protector -fno-pic -fno-pie on preloader.c only). xorg-x11 doesn't fail to compile.

Palhoto · Posted: Sat Aug 14, 2004 6:13 pm Post subject: Dlloader

My nvidia card (geforce 2 and in the meantime upgraded to an fx5500) stopped working with the "nvidia" drivers (but works with the "nv" drivers) when I recompiled xorg with the static flag due to the hardened issue.

I'm in the process of recompiling xorg-r1 with the dlloader flag, which I suppose may be the problem. It means "DynamicLibraryLoader" if I'm not mistaken. The "nvidia" module for glx purposes needs to be loaded, that is why this hypothesis.

If anyone has more info, let us know. I'll post back once I get xorg recompiled.

Best regards,

seaq · n00b Joined: 15 Jun 2003 Posts: 20 Location: Colombia

i've got a question , the static flag would make the xorg server slower?

i'll wait for the results of dlloader recompilation to give it a try

spudicus · Posted: Mon Aug 16, 2004 1:07 am Post subject:

I've since re-emerged xorg with USE="dlloader hardened pic pie" flags (no static).

EDIT: ati-drivers currently don't load, possibly due to "pie" flag.

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

There's been some progress - see https://bugs.gentoo.org/show_bug.cgi?id=43177 - the problem building xorg with hardened gcc should be resolved soon (at least worked around avoiding rebuilding gcc!).

I think the ati-drivers will not need changing; they work fine for me, with xorg hacked to build sensibly with hardened gcc.

spudicus · Posted: Tue Aug 17, 2004 1:48 pm Post subject:

Hhhmmm

Just when I recompile GCC without hardened/pie/pic and recompile xorg, a fix is in the works

:p

Palhoto · Posted: Fri Aug 27, 2004 2:02 pm Post subject:

Sorry about the delay, I went on vacation and didn't find the time (and computer resources) to reply.

When I recompiled xorg with dlloader, nothing changed regarding nvidia. I still cannot use the nvidia drivers, just nv.

I suppose I'll recompile gcc without hardened for the time being.

Snooper · Posted: Thu Sep 02, 2004 1:11 am Post subject:

I wonder if everyone here experiencing this issue is using the hardened profile, If they are in the default profile as opposed to hardened the X use flag is set, so in the hardened profile X is not passed to gcc durring the bootstrap.

Just a thought i have not tried building gcc with X in my USE statement but i am also experiencing the same issues as described in this thread.
_________________
ftp://lila-project.ath.cx

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

While not everyone is using the hardened profile as such, I think everyone with this issue has gcc compiled with the hardened use flag. It's the default enabling of -fstack-protector and -fpie in gcc (an effect of setting the hardened use flag when building gcc) which trigger the problem. Possibly the same problem occurs for people not using hardened gcc but who have -fstack-protector in the CFLAGS.

Snooper · Posted: Sun Sep 05, 2004 4:48 am Post subject:

After talking to some of the hardened developers using static works for the x86 version of xorg-x11 as with xfree.

In the masked versions of xorg-x11 witch will become 6.8.0 passing dlloader will work and 6.8 will become the standard on the hardened profile when it is released.

Or so i was told!
_________________
ftp://lila-project.ath.cx

spudicus · Posted: Mon Sep 06, 2004 1:21 am Post subject:

coren2000 · Posted: Tue Sep 07, 2004 3:30 am Post subject: static and hardened

Static is no good for any modules you want to load in X.

drbugs · Posted: Fri Sep 10, 2004 1:26 pm Post subject: Failure with 6.8

I tried the upgrade to 6.8.0 last night, no joy with the -hardened/hardened gcc. It compiles fine, but when I try to do an Xorg -configure, it fails with somethiing like "duplicate symbol" in a font file (I'm at work and don't have an exact copy of the error).

Anyone else have a better story?

drbugs · Posted: Sun Sep 12, 2004 8:39 pm Post subject: Re: Failure with 6.8

kevquinn · Retired Dev Joined: 27 Jun 2003 Posts: 52

FI, I've uploaded a new patch to https://bugs.gentoo.org/show_bug.cgi?id=43177 which only removes pie for modules - the stack protector now builds in 6.8.0 without causing any problems.

tcbounce · Last edited by tcbounce on Mon Sep 27, 2004 8:34 am; edited 1 time in total

Last night I recompiled X with the patch mentioned above. I found out that the source code patch was added already to the xorg-x11-6.8.0-r1 build file.

I am getting interesting results here. I have successfully got the package to run on my main system that compiled the program last night using -fstack-protector and it only reports a few error messages about GLX and unresolved symbols. I am using a i740 on that system so I will report to the bugs list that the patch is successfully tested on that hardware.

The problem I am having however is on a different system. When I merge the binary package created on the first system, I am getting much more errors relating to unresolved symbols as per this bug report!!

What dependancies does the dll loader have. I will reinstall my binuitls and glibc and update you on it later. Any tips would be appreciated.

[ update solved ]
I just copied over the /usr/X11R6/lib/modules directory to the problematic host using tar, and it fixed the problem. Why isn't quickpkg copying these files over when it make an .tgz file????

Cheers,

Luke

tcbounce · Posted: Mon Sep 27, 2004 7:54 am Post subject: still no luck

I tried a quickpkg glibc binutils xorg-x11 and installed the same packages on the problematic host, only to get the same problem.

I had some problems loading security policies so I copied over the config from my main server and still couldn't load. I rebooted the system and that fixed it. Now i'm doing an emerge -ke system to make the two systems identical.

How can one system have the unresolved symbols and the other not when they both have the same xorg-x11 package I don't know. I'll compile again locally on the problematic host it still has unresolved symbols.

amne · Posted: Sun May 01, 2005 4:59 pm Post subject:

Moved to Duplicate Threads, please see USE=hardened breaks XOrg server for more information and direct any followups there, too.
_________________
Dinosaur week! (Ok, this thread is so last week)