Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dropbox: use paxmark m to fix Dropbox when grsecurity enabled #22245

Merged
merged 1 commit into from Jan 29, 2017

Conversation

ttuegel
Copy link
Member

@ttuegel ttuegel commented Jan 28, 2017

Motivation for this change

Fixes #21148.

Things done
  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@mention-bot
Copy link

@ttuegel, thanks for your PR! By analyzing the history of the files in this pull request, we identified @amiddelk, @peterhoeg and @abbradar to be potential reviewers.

@ttuegel
Copy link
Member Author

ttuegel commented Jan 28, 2017

@siddharthist Could you try running Dropbox from this PR? The PaX issue should be resolved now.

@langston-barrett
Copy link
Contributor

langston-barrett commented Jan 29, 2017

@ttuegel Testing the build now, will have to nixos-rebuild and reboot to test with grsecurity. Thank you so much for your help!

@langston-barrett
Copy link
Contributor

Build works on non-grsecurity enabled kernel, and running Dropbox works when grsecurity is enabled. Thanks again @ttuegel!

@ttuegel ttuegel merged commit 76985ad into NixOS:master Jan 29, 2017
@ttuegel ttuegel deleted the dropbox-grsecurity branch January 29, 2017 19:04
@langston-barrett
Copy link
Contributor

@ttuegel Just out of curiosity, why does this work? Is paxmark part of the stdenv?

@ttuegel
Copy link
Member Author

ttuegel commented Jan 29, 2017

Well, it sets some PaX flag so that the memory protections are disabled and Dropbox can run. I don't know how it does that; I was under the impression that requires root permission. I guess paxmark is part of stdenv; to be honest, I just ran grep -R paxmark over nixpkgs and saw that lots of packages were using it without extra dependencies! 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants