ChromeOS chrome component build does not work under GN |
||||||||||||||||
Issue descriptionWhile trying GN in ChromeOS we got the following problem: scanelf: rpath_security_checks(): Security problem with DT_RPATH='$ORIGIN/.' in /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox with mode set of 4755 scanelf: rpath_security_checks(): Security problem with DT_RPATH='$ORIGIN/.' in /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox with mode set of 4755 * QA Notice: The following files contain insecure RUNPATHs * Please file a bug about this at http://bugs.gentoo.org/ * with the maintaining herd of the package. * $ORIGIN/. /build/x86-alex/tmp/portage/chromeos-base/chromeos-chrome-52.0.2723.2_rc-r1/image/opt/google/chrome/chrome-sandbox A similar bug was filed under: https://bugs.chromium.org/p/chromium/issues/detail?id=556843 ChromeOS is using component build as a workaround to a problem were debug information is too large to fit in a 32 bit executable. Although, we don't want to stay with component build in the future, it is good to have a working component build in case we need it as workaround. see https://bugs.chromium.org/p/chromium/issues/detail?id=608596#c58 for more context
,
May 18 2016
I think llozano@ told me that they did switch to split-dwarf, but wasn't sure if we would need component to work for other reasons as well (but yes, it's less urgent).
,
May 18 2016
the change for split-dwarf happened a couple of days ago. We are still analyzing crash dumps and making sure everything looks ok. So, change may not stick.. Should be decided by tomorrow...
,
Jun 8 2016
I think this is fixed now?
,
Jun 8 2016
no, I dont think so. This is hidden. We are not using component build at the moment. We fixed the issue that was forcing us to use component build by using split-dwarf. I don't know how to prioritize this. I believe having a broken component build is not good. Component build can be used to workaround other issues. ihf? do you have any inputs on this?
,
Jun 8 2016
I agree that we should fix this if it is indeed broken. I can test it tomorrow. At the moment I am testing the veyron build, which turns out to be a slightly different architecture config than arm-generic.
,
Jun 8 2016
Ah, right, I forgot that this was about the setuid binary specifically. component_build should otherwise work just fine. I think we can probably fix that pretty easily. I'll see if I can prepare a CL.
,
Jun 9 2016
,
Jun 9 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3ea22b3a4855512be84da4bc186392434e14de7c commit 3ea22b3a4855512be84da4bc186392434e14de7c Author: dpranke <dpranke@chromium.org> Date: Thu Jun 09 23:39:50 2016 Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN. This CL tweaks the ldflag configs for chrome_sandbox to make sure we don't accidentally pick up -rpath=$ORIGIN, which can be a security hole for a setuid binary. R=brettw@chromium.org,llozano@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2050763004 Cr-Commit-Position: refs/heads/master@{#399050} [modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/build/config/gcc/BUILD.gn [modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/sandbox/linux/BUILD.gn
,
Jun 9 2016
Okay, I think this should be fixed for real now.
,
Jun 10 2016
I will try it.
,
Jun 10 2016
I get the following error. I synced everything... Is this related to your change? note the "is_component_build=true"
{EGN} gen /home/llozano/chrome_root/src/c/Release --args=is_debug=false use_v4l2_codec=true use_v4lplugin=false use_ozone=true use_evdev_gestures=true use_xkbcommon=true linux_use_bundled_binutils=false use_debug_fission=false enable_remoting=true enable_nacl=false icu_use_data_file=true use_cras=true use_system_harfbuzz=true is_asan=false is_clang=false cros_host_is_clang=false clang_use_chrome_plugins=false ozone_auto_platforms=false ozone_platform_gbm=true use_system_minigbm=true arm_use_neon=true is_component_build=true use_debug_fission=true symbol_level=2 target_sysroot="/build/daisy" system_libdir="lib" pkg_config="/build/daisy/build/bin/pkg-config" target_os="chromeos" ozone_platform="gbm" target_cpu="arm" arm_float_abi="hard" cros_target_ar="armv7a-cros-linux-gnueabi-ar" cros_target_cc="armv7a-cros-linux-gnueabi-gcc -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" cros_target_cxx="armv7a-cros-linux-gnueabi-g++ -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" host_toolchain="//build/toolchain/cros:host" v8_snapshot_toolchain="//build/toolchain/cros:v8_snapshot" cros_target_ld="armv7a-cros-linux-gnueabi-g++ -B/usr/x86_64-pc-linux-gnu/armv7a-cros-linux-gnueabi/binutils-bin/2.25.51-gold" cros_target_extra_cflags="-pipe -march=armv7-a -mtune=cortex-a15 -mfpu=neon -mfloat-abi=hard " cros_target_extra_cppflags="" cros_target_extra_cxxflags="-pipe -march=armv7-a -mtune=cortex-a15 -mfpu=neon -mfloat-abi=hard -D__google_stl_debug_vector=1 " cros_target_extra_ldflags="-Wl,-O1 -Wl,-O2 -Wl,--as-needed" cros_host_cc="x86_64-pc-linux-gnu-gcc" cros_host_cxx="x86_64-pc-linux-gnu-g++" cros_host_ar="x86_64-pc-linux-gnu-ar" cros_host_ld="x86_64-pc-linux-gnu-g++" cros_host_extra_cflags="" cros_host_extra_cxxflags="" cros_host_extra_cppflags="" cros_host_extra_ldflags="" cros_v8_snapshot_cc="x86_64-pc-linux-gnu-gcc" cros_v8_snapshot_cxx="x86_64-pc-linux-gnu-g++" cros_v8_snapshot_ar="x86_64-pc-linux-gnu-ar" cros_v8_snapshot_ld="x86_64-pc-linux-gnu-g++" cros_v8_snapshot_extra_cflags="" cros_v8_snapshot_extra_cxxflags="" cros_v8_snapshot_extra_cppflags="" cros_v8_snapshot_extra_ldflags="" --root=/home/llozano/chrome_root/src
ERROR at //components/nacl/loader/BUILD.gn:9:1: Assertion failed.
assert(enable_nacl)
^-----
See //chrome/test/BUILD.gn:924:9: which caused the file to be included.
"//components/nacl/loader:nacl_helper",
^-------------------------------------
,
Jun 10 2016
I doubt this is related to my change per se. I don't think we have 'enable_nacl=false' on any of our builders, so it wouldn't be surprising to me if this was broken, but I know a lot of devs do disable it so I'd be surprised if it was broken for very long. Let me try to repro it.
,
Jun 10 2016
Okay, actually I think this is related to a different change of mine, that did break the enable_nacl=false case on chromeos. Patch coming ...
,
Jun 11 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a15352b402e0daacb658337f0748f02f0372f2a5 commit a15352b402e0daacb658337f0748f02f0372f2a5 Author: dpranke <dpranke@chromium.org> Date: Sat Jun 11 04:51:47 2016 Fix CrOS build for enable_nacl=false. TBR=llozano@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2055023004 Cr-Commit-Position: refs/heads/master@{#399364} [modify] https://crrev.com/a15352b402e0daacb658337f0748f02f0372f2a5/chrome/test/BUILD.gn
,
Jun 13 2016
After last fix, my chroot build with: USE='gn build_tests component_build' emerge-daisy chromeos-chrome succeeded.
,
Jun 13 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab commit 41d05be20fcf850c7ae1a01ae08a3f339e8f4aab Author: dpranke <dpranke@chromium.org> Date: Mon Jun 13 18:59:31 2016 Fix typo in sandbox/linux/BUILD.gn. In r399050 I added a condition to fix component builds of the Linux sandbox to not contain -rpath=$ORIGIN, but I messed up the non-gold configuration. This patch fixes the typo. TBR=eugenis@chromium.org, llozano@chromium.org, mdempsky@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2059343002 Cr-Commit-Position: refs/heads/master@{#399498} [modify] https://crrev.com/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab/sandbox/linux/BUILD.gn
,
Jun 15 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3ea22b3a4855512be84da4bc186392434e14de7c commit 3ea22b3a4855512be84da4bc186392434e14de7c Author: dpranke <dpranke@chromium.org> Date: Thu Jun 09 23:39:50 2016 Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN. This CL tweaks the ldflag configs for chrome_sandbox to make sure we don't accidentally pick up -rpath=$ORIGIN, which can be a security hole for a setuid binary. R=brettw@chromium.org,llozano@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2050763004 Cr-Commit-Position: refs/heads/master@{#399050} [modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/build/config/gcc/BUILD.gn [modify] https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c/sandbox/linux/BUILD.gn
,
Jun 15 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a15352b402e0daacb658337f0748f02f0372f2a5 commit a15352b402e0daacb658337f0748f02f0372f2a5 Author: dpranke <dpranke@chromium.org> Date: Sat Jun 11 04:51:47 2016 Fix CrOS build for enable_nacl=false. TBR=llozano@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2055023004 Cr-Commit-Position: refs/heads/master@{#399364} [modify] https://crrev.com/a15352b402e0daacb658337f0748f02f0372f2a5/chrome/test/BUILD.gn
,
Jun 15 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab commit 41d05be20fcf850c7ae1a01ae08a3f339e8f4aab Author: dpranke <dpranke@chromium.org> Date: Mon Jun 13 18:59:31 2016 Fix typo in sandbox/linux/BUILD.gn. In r399050 I added a condition to fix component builds of the Linux sandbox to not contain -rpath=$ORIGIN, but I messed up the non-gold configuration. This patch fixes the typo. TBR=eugenis@chromium.org, llozano@chromium.org, mdempsky@chromium.org BUG= 612647 Review-Url: https://codereview.chromium.org/2059343002 Cr-Commit-Position: refs/heads/master@{#399498} [modify] https://crrev.com/41d05be20fcf850c7ae1a01ae08a3f339e8f4aab/sandbox/linux/BUILD.gn
,
Jul 1 2016
,
Aug 29 2016
,
Oct 7 2016
,
Oct 10 2016
,
Nov 19 2016
,
Jan 21 2017
,
Mar 4 2017
,
Apr 17 2017
,
May 30 2017
,
Aug 1 2017
,
Aug 3 2017
Closing. Please reopen it if its not fixed. Thanks! |
||||||||||||||||
►
Sign in to add a comment |
||||||||||||||||
Comment 1 by steve...@chromium.org
, May 18 2016