New issue
Advanced search Search tips

Issue 612647 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

ChromeOS chrome component build does not work under GN

Project Member Reported by llozano@chromium.org, May 18 2016

Issue description

While trying GN in ChromeOS we got the following problem:


scanelf: rpath_security_checks(): Security problem with DT_RPATH='$ORIGIN/.' in /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox with mode set of 4755
scanelf: rpath_security_checks(): Security problem with DT_RPATH='$ORIGIN/.' in /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox with mode set of 4755

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 * $ORIGIN/. /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox

A similar bug was filed under:

https://bugs.chromium.org/p/chromium/issues/detail?id=556843

ChromeOS is using component build as a workaround to a problem were debug information is too large to fit in a 32 bit executable. Although, we don't want to stay with component build in the future, it is good to have a working component build in case we need it as workaround. 

see https://bugs.chromium.org/p/chromium/issues/detail?id=608596#c58 for more context
 
I thought we switched from using component_build to -gsplit-dwarf for 32
bit? We still need to fix this, but maybe it is less urgent than it would
be otherwise?
Labels: -Build-Tools-GN -Pri-3 Pri-2
I think llozano@ told me that they did switch to split-dwarf, but wasn't sure if we would need component to work for other reasons as well (but yes, it's less urgent).
the change for split-dwarf happened a couple of days ago. We are still analyzing crash dumps and making sure everything looks ok. So, change may not stick..
Should be decided by tomorrow...

Status: Fixed (was: Assigned)
I think this is fixed now?
no, I dont think so. 

This is hidden.
We are not using component build at the moment. We fixed the issue that was forcing us to use component build by using split-dwarf.
I don't know how to prioritize this. I believe having a broken component build is not good. Component build can be used to workaround other issues.

ihf? do you have any inputs on this?

I agree that we should fix this if it is indeed broken. I can test it
tomorrow. At the moment I am testing the veyron build, which turns out to
be a slightly different architecture config than arm-generic.
Status: Assigned (was: Fixed)
Ah, right, I forgot that this was about the setuid binary specifically. component_build should otherwise work just fine.

I think we can probably fix that pretty easily. I'll see if I can prepare a CL.
Status: Started (was: Assigned)
Fix: https://codereview.chromium.org/2050763004/
Project Member

Comment 9 by bugdroid1@chromium.org, Jun 9 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3ea22b3a4855512be84da4bc186392434e14de7c

commit 3ea22b3a4855512be84da4bc186392434e14de7c
Author: dpranke <dpranke@chromium.org>
Date: Thu Jun 09 23:39:50 2016

Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

This CL tweaks the ldflag configs for chrome_sandbox to make
sure we don't accidentally pick up -rpath=$ORIGIN, which can
be a security hole for a setuid binary.

R=brettw@chromium.org,llozano@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2050763004
Cr-Commit-Position: refs/heads/master@{#399050}

[modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/build/config/gcc/BUILD.gn
[modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/sandbox/linux/BUILD.gn

Status: Fixed (was: Started)
Okay, I think this should be fixed for real now.

Comment 11 by lloz...@google.com, Jun 10 2016

I will try it.
I get the following error. I synced everything... Is this related to your change? note the "is_component_build=true"

{EGN} gen /home/llozano/chrome_root/src/c/Release --args=is_debug=false  use_v4l2_codec=true use_v4lplugin=false use_ozone=true use_evdev_gestures=true use_xkbcommon=true linux_use_bundled_binutils=false use_debug_fission=false enable_remoting=true enable_nacl=false icu_use_data_file=true use_cras=true use_system_harfbuzz=true is_asan=false is_clang=false cros_host_is_clang=false clang_use_chrome_plugins=false ozone_auto_platforms=false ozone_platform_gbm=true use_system_minigbm=true arm_use_neon=true is_component_build=true use_debug_fission=true symbol_level=2 target_sysroot="/build/daisy" system_libdir="lib" pkg_config="/build/daisy/build/bin/pkg-config" target_os="chromeos" ozone_platform="gbm" target_cpu="arm" arm_float_abi="hard" cros_target_ar="armv7a-cros-linux-gnueabi-ar" cros_target_cc="armv7a-cros-linux-gnueabi-gcc -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" cros_target_cxx="armv7a-cros-linux-gnueabi-g++ -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" host_toolchain="//build/toolchain/cros:host" v8_snapshot_toolchain="//build/toolchain/cros:v8_snapshot" cros_target_ld="armv7a-cros-linux-gnueabi-g++ -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" cros_target_extra_cflags="-pipe -march=armv7-a -mtune=cortex-a15 -mfpu=neon -mfloat-abi=hard " cros_target_extra_cppflags="" cros_target_extra_cxxflags="-pipe -march=armv7-a -mtune=cortex-a15 -mfpu=neon -mfloat-abi=hard -D__google_stl_debug_vector=1 " cros_target_extra_ldflags="-Wl,-O1 -Wl,-O2 -Wl,--as-needed" cros_host_cc="x86_64-pc-linux-gnu-gcc" cros_host_cxx="x86_64-pc-linux-gnu-g++" cros_host_ar="x86_64-pc-linux-gnu-ar" cros_host_ld="x86_64-pc-linux-gnu-g++" cros_host_extra_cflags="" cros_host_extra_cxxflags="" cros_host_extra_cppflags="" cros_host_extra_ldflags="" cros_v8_snapshot_cc="x86_64-pc-linux-gnu-gcc" cros_v8_snapshot_cxx="x86_64-pc-linux-gnu-g++" cros_v8_snapshot_ar="x86_64-pc-linux-gnu-ar" cros_v8_snapshot_ld="x86_64-pc-linux-gnu-g++" cros_v8_snapshot_extra_cflags="" cros_v8_snapshot_extra_cxxflags="" cros_v8_snapshot_extra_cppflags="" cros_v8_snapshot_extra_ldflags="" --root=/home/llozano/chrome_root/src
ERROR at //components/nacl/loader/BUILD.gn:9:1: Assertion failed.
assert(enable_nacl)
^-----
See //chrome/test/BUILD.gn:924:9: which caused the file to be included.
        "//components/nacl/loader:nacl_helper",
        ^-------------------------------------

I doubt this is related to my change per se.

I don't think we have 'enable_nacl=false' on any of our builders, so it wouldn't be surprising to me if this was broken, but I know a lot of devs do disable it so I'd be surprised if it was broken for very long.

Let me try to repro it.
Okay, actually I think this is related to a different change of mine, that did break the enable_nacl=false case on chromeos. Patch coming ...
Project Member

Comment 15 by bugdroid1@chromium.org, Jun 11 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a15352b402e0daacb658337f0748f02f0372f2a5

commit a15352b402e0daacb658337f0748f02f0372f2a5
Author: dpranke <dpranke@chromium.org>
Date: Sat Jun 11 04:51:47 2016

Fix CrOS build for enable_nacl=false.

TBR=llozano@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2055023004
Cr-Commit-Position: refs/heads/master@{#399364}

[modify] https://crrev.com/a15352b402e0daacb658337f0748f02f0372f2a5/chrome/test/BUILD.gn

After last fix, my chroot build with:
USE='gn build_tests component_build' emerge-daisy chromeos-chrome

succeeded.
Project Member

Comment 17 by bugdroid1@chromium.org, Jun 13 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab

commit 41d05be20fcf850c7ae1a01ae08a3f339e8f4aab
Author: dpranke <dpranke@chromium.org>
Date: Mon Jun 13 18:59:31 2016

Fix typo in sandbox/linux/BUILD.gn.

In r399050 I added a condition to fix component builds of the Linux
sandbox to not contain -rpath=$ORIGIN, but I messed up the non-gold
configuration. This patch fixes the typo.

TBR=eugenis@chromium.org, llozano@chromium.org, mdempsky@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2059343002
Cr-Commit-Position: refs/heads/master@{#399498}

[modify] https://crrev.com/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab/sandbox/linux/BUILD.gn

Project Member

Comment 18 by bugdroid1@chromium.org, Jun 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3ea22b3a4855512be84da4bc186392434e14de7c

commit 3ea22b3a4855512be84da4bc186392434e14de7c
Author: dpranke <dpranke@chromium.org>
Date: Thu Jun 09 23:39:50 2016

Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

This CL tweaks the ldflag configs for chrome_sandbox to make
sure we don't accidentally pick up -rpath=$ORIGIN, which can
be a security hole for a setuid binary.

R=brettw@chromium.org,llozano@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2050763004
Cr-Commit-Position: refs/heads/master@{#399050}

[modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/build/config/gcc/BUILD.gn
[modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/sandbox/linux/BUILD.gn

Project Member

Comment 19 by bugdroid1@chromium.org, Jun 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a15352b402e0daacb658337f0748f02f0372f2a5

commit a15352b402e0daacb658337f0748f02f0372f2a5
Author: dpranke <dpranke@chromium.org>
Date: Sat Jun 11 04:51:47 2016

Fix CrOS build for enable_nacl=false.

TBR=llozano@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2055023004
Cr-Commit-Position: refs/heads/master@{#399364}

[modify] https://crrev.com/a15352b402e0daacb658337f0748f02f0372f2a5/chrome/test/BUILD.gn

Project Member

Comment 20 by bugdroid1@chromium.org, Jun 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab

commit 41d05be20fcf850c7ae1a01ae08a3f339e8f4aab
Author: dpranke <dpranke@chromium.org>
Date: Mon Jun 13 18:59:31 2016

Fix typo in sandbox/linux/BUILD.gn.

In r399050 I added a condition to fix component builds of the Linux
sandbox to not contain -rpath=$ORIGIN, but I messed up the non-gold
configuration. This patch fixes the typo.

TBR=eugenis@chromium.org, llozano@chromium.org, mdempsky@chromium.org
BUG= 612647 

Review-Url: https://codereview.chromium.org/2059343002
Cr-Commit-Position: refs/heads/master@{#399498}

[modify] https://crrev.com/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab/sandbox/linux/BUILD.gn

Labels: VerifyIn-53
Labels: VerifyIn-54
Labels: VerifyIn-55

Comment 24 by dchan@chromium.org, Oct 10 2016

Labels: -VerifyIn-55

Comment 25 by dchan@google.com, Nov 19 2016

Labels: VerifyIn-56

Comment 26 by dchan@google.com, Jan 21 2017

Labels: VerifyIn-57

Comment 27 by dchan@google.com, Mar 4 2017

Labels: VerifyIn-58

Comment 28 by dchan@google.com, Apr 17 2017

Labels: VerifyIn-59

Comment 29 by dchan@google.com, May 30 2017

Labels: VerifyIn-60
Labels: VerifyIn-61
Status: Verified (was: Fixed)
Closing. Please reopen it if its not fixed. Thanks!

Sign in to add a comment