Hi!
I'm building ruby (2.2.x and 2.3.x) on NetBSD 7.99.26/amd64 from
pkgsrc.
Recently we have discussed improving the security features, and added
some options to pkgsrc for that. One of them is relro ("Full RELRO" as
per
http://tk-blog.blogspot.co.at/2009/02/relro-not-so-well-known-memory.html;
i.e. add "-Wl,-z,relro,-z,now" to the compiler flags) which maps the
GOT read-only.
I've enabled this in my local builds, and most stuff still builds.
However there are problems with ruby-2.2.4 and ruby-2.3.0.
For ruby-2.2.4, relro breaks the installation phase:
installing bundle gems: /usr/pkg/lib/ruby/gems/2.2.0 (build_info, cache, doc, extensions, gems, specifications)
/scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require': /scratch/lang/ruby22-base/work/ruby-2.2.4/.ext/x86_64-netbsd/socket.so: Undefined symbol "inspect_tcpi_msec" (symnum = 74) - /scratch/lang/ruby22-base/work/ruby-2.2.4/.ext/x86_64-netbsd/socket.so (LoadError)
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/.ext/common/socket.rb:1:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/net/protocol.rb:21:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/net/http.rb:22:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/request.rb:1:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/remote_fetcher.rb:2:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/spec_fetcher.rb:1:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/dependency_installer.rb:5:in `<top (required)>'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems/core_ext/kernel_require.rb:54:in `require'
from /scratch/lang/ruby22-base/work/ruby-2.2.4/lib/rubygems.rb:562:in `install'
from ./tool/rbinstall.rb:722:in `block (2 levels) in <main>'
from ./tool/rbinstall.rb:721:in `each'
from ./tool/rbinstall.rb:721:in `block in <main>'
from ./tool/rbinstall.rb:757:in `call'
from ./tool/rbinstall.rb:757:in `block in <main>'
from ./tool/rbinstall.rb:754:in `each'
from ./tool/rbinstall.rb:754:in `<main>'
*** Error code 1
The rbconfig.rb diffs between a working and a breaking build are:
176c176
< CONFIG["LDFLAGS"] = "-L. -L/usr/lib -Wl,-R/usr/lib -L/usr/pkg/lib -Wl,-R/usr/pkg/lib -pthread -fstack-protector -Wl,-export-dynamic"
···
---
CONFIG["LDFLAGS"] = "-L. -Wl,-z,relro -Wl,-z,now -L/usr/lib -Wl,-R/usr/lib -L/usr/pkg/lib -Wl,-R/usr/pkg/lib -pthread -fstack-protector -Wl,-export-dynamic"
For ruby-2.3.0, the breakage is different. Ruby itself builds and
installs without problems, but some modules fail to install. For me
locally, e.g. colorator, ffi, kramdown, liquid, mercenary, ....
The breakage looks happens in the configuration stage and looks like
this:
===> Extracting for ruby23-colorator-0.1
ERROR: Loading command: unpack (LoadError)
/usr/pkg/lib/ruby/2.3.0/x86_64-netbsd/socket.so: Undefined symbol "inspect_tcpi_msec" (symnum = 74) - /usr/pkg/lib/ruby/2.3.0/x86_64-netbsd/socket.so
ERROR: While executing gem ... (NoMethodError)
undefined method `invoke_with_build_args' for nil:NilClass
*** Error code 1
I started looking for this symbol and found for ruby-2.2.4 in ext/socket/option.c
#if defined(__linux__) || defined(__sun)
static void
inspect_tcpi_msec(VALUE ret, const char *prefix, uint32_t t)
{
rb_str_catf(ret, "%s%u.%03us", prefix, t / 1000, t % 1000);
}
#endif
#ifdef __FreeBSD__
# define inspect_tcpi_rto(ret, t) inspect_tcpi_usec(ret, " rto=", t)
# define inspect_tcpi_last_data_recv(ret, t) inspect_tcpi_usec(ret, " last_data_recv=", t)
# define inspect_tcpi_rtt(ret, t) inspect_tcpi_usec(ret, " rtt=", t)
# define inspect_tcpi_rttvar(ret, t) inspect_tcpi_usec(ret, " rttvar=", t)
#else
# define inspect_tcpi_rto(ret, t) inspect_tcpi_usec(ret, " rto=", t)
# define inspect_tcpi_ato(ret, t) inspect_tcpi_usec(ret, " ato=", t)
# define inspect_tcpi_last_data_sent(ret, t) inspect_tcpi_msec(ret, " last_data_sent=", t)
# define inspect_tcpi_last_data_recv(ret, t) inspect_tcpi_msec(ret, " last_data_recv=", t)
# define inspect_tcpi_last_ack_sent(ret, t) inspect_tcpi_msec(ret, " last_ack_sent=", t)
# define inspect_tcpi_last_ack_recv(ret, t) inspect_tcpi_msec(ret, " last_ack_recv=", t)
# define inspect_tcpi_rtt(ret, t) inspect_tcpi_usec(ret, " rtt=", t)
# define inspect_tcpi_rttvar(ret, t) inspect_tcpi_usec(ret, " rttvar=", t)
# define inspect_tcpi_rcv_rtt(ret, t) inspect_tcpi_usec(ret, " rcv_rtt=", t)
#endif
This code hasn't changed for ruby-2.3.0.
So it looks like this symbol is missing for !Linux && !Solaris, and
FreeBSD works around it. I don't see why these operating systems are
handled specially, it looks straightforward enough to use it
everywhere.
Can this please be made unconditional?
I also don't understand why this only makes a difference with relro.
Does anyone have an idea about that?
Thanks,
Thomas