From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: bug#27429: Stack clash (CVE-2017-1000366 etc) Date: Sat, 24 Jun 2017 03:11:25 -0400 Message-ID: <87y3shkggy.fsf@netris.org> References: <20170619222550.GA29289@jasmine.lan> <20170620004920.GB31586@jasmine.lan> <20170620071857.GA2768@macbook42.flashner.co.il> <87shiumj05.fsf@netris.org> <20170621084134.GA2870@macbook42.flashner.co.il> <20170621095045.GB2870@macbook42.flashner.co.il> <20170623172038.GA6052@jasmine.lan> <87mv8yh7pi.fsf@netris.org> <20170623185448.GA14284@jasmine.lan> <87bmpeh3oz.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:58547) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOfEk-0007F6-25 for bug-guix@gnu.org; Sat, 24 Jun 2017 03:12:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dOfEg-00071O-3E for bug-guix@gnu.org; Sat, 24 Jun 2017 03:12:06 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:60669) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dOfEf-00071E-Vp for bug-guix@gnu.org; Sat, 24 Jun 2017 03:12:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <87bmpeh3oz.fsf@netris.org> (Mark H. Weaver's message of "Fri, 23 Jun 2017 16:03:24 -0400") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Leo Famulari Cc: 27429@debbugs.gnu.org Mark H Weaver writes: > Leo Famulari writes: > >> On Fri, Jun 23, 2017 at 02:36:41PM -0400, Mark H Weaver wrote: >>> Most packages are linked with 'glibc-final' in (gnu packages >>> commencement), and we should expect them to now be linked with *its* >>> replacement. Try this to find the expected glibc-final replacement: >>> >>> ./pre-inst-env guix build -e '((@@ (guix packages) package-replacement) (@@ (gnu packages commencement) glibc-final))' >> >> Thank you for the clarification. Indeed, with Efraim's latest patch, >> packages seem to be referring to the replacement for glibc-final. > > That's good news! > >> So, do we think this patch is ready to apply? AFAIK, nobody has yet >> tried upgrading a GuixSD system with this patch. I won't have access to >> my bare-metal GuixSD system for the next few days. > > I think someone should try reconfiguring their GuixSD system and booting > into it before we apply it to master. I might be able to do it tonight, > or else I can do it tomorrow. I made some minor cleanups to the patch, split it up into multiple patches, and upgraded my GuixSD system to use it. My system seems to work fine. I don't have time right now to verify that the grafting is being done correctly, but I went ahead and pushed the commits to 'master' anyway, based on Leo's preliminary observations. I'm dubious about the changes made to glibc-2.21, but that can be fixed up later. I tried to copy the .drv files for the grafted 'glibc-final' and 'glibc-final-with-bootstrap-bash' from my machine to Hydra, in order to ask Hydra to build it, but both "guix copy" and "guix archive --export" failed: --8<---------------cut here---------------start------------->8--- mhw@jojen ~$ guix copy --to=hydra@hydra /gnu/store/17gcwll4a2y3cjk8jf3fg2gr105m9f4i-glibc-2.25.drv /gnu/store/78j5arbcgjfbj0m91fn6p5s71kz7w2yw-glibc-2.25.drv sending 11 store items to 'localhost'... guix copy: error: corrupt input while restoring archive from # mhw@jojen ~$ guix archive --export /gnu/store/17gcwll4a2y3cjk8jf3fg2gr105m9f4i-glibc-2.25.drv /gnu/store/78j5arbcgjfbj0m91fn6p5s71kz7w2yw-glibc-2.25.drv > GRAFTED-GLIBC-DRVS.nar guix archive: error: corrupt input while restoring archive from # --8<---------------cut here---------------end--------------->8--- I'm concerned that i686 and armhf users are going to have a rude awakening when they not only have to build two variants of glibc, but also a bunch of the early bootstrap because the NARs are not available on Hydra. It would be good if someone could take care of that. I'm sorry, but I need to sleep now. Hopefully someone else can take it from here. Mark