[Bug 1933516] Re: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted

[Dan Streetman]

> > gzip/libgzip fails for systemd services using MemoryDenyWriteExecute=yes
> Please could you expand on this? Under what circumstances are users going to be affected by this?

nearly all the systemd services include this setting, e.g.

$ grep -r MemoryDeny *
dbus-org.freedesktop.hostname1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.locale1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.login1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.timedate1.service:MemoryDenyWriteExecute=yes
systemd-hostnamed.service:MemoryDenyWriteExecute=yes
systemd-journald.service:MemoryDenyWriteExecute=yes
systemd-localed.service:MemoryDenyWriteExecute=yes
systemd-logind.service:MemoryDenyWriteExecute=yes
systemd-networkd.service:MemoryDenyWriteExecute=yes
systemd-resolved.service:MemoryDenyWriteExecute=yes
systemd-timedated.service:MemoryDenyWriteExecute=yes
systemd-timesyncd.service:MemoryDenyWriteExecute=yes
systemd-udevd.service:MemoryDenyWriteExecute=yes
udev.service:MemoryDenyWriteExecute=yes


so any call from a systemd service to gzip anything on bionic/ppc64el will fail

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gzip in Ubuntu.
https://bugs.launchpad.net/bugs/1933516

Title:
  gzip: error while loading shared libraries: cannot restore segment
  prot after reloc: Operation not permitted

Status in gzip package in Ubuntu:
  Fix Released
Status in gzip source package in Bionic:
  In Progress
Status in gzip package in Debian:
  Fix Released

Bug description:
  [impact]

  gzip/libgzip fails for systemd services using
  MemoryDenyWriteExecute=yes

  [test case]

  note this only fails on ppc64el

  create service file /etc/systemd/system/test-localegen.service with
  content:

  [Service]
  MemoryDenyWriteExecute=yes
  ExecStart=/usr/sbin/locale-gen

  
  run systemctl daemon-reload, and start the service:

  ubuntu at test-ppc-b:~$ sudo systemctl daemon-reload 
  ubuntu at test-ppc-b:~$ sudo systemctl start test-localegen.service 
  ubuntu at test-ppc-b:~$ sudo systemctl status test-localegen.service 
  ○ test-localegen.service
       Loaded: loaded (8;;file://test-ppc-b/etc/systemd/system/test-localegen.service^G/etc/systemd/system/test-localegen.service8;;^G; static)
       Active: inactive (dead)

  Jun 24 16:44:18 test-ppc-b locale-gen[2737]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
  Jun 24 16:44:18 test-ppc-b locale-gen[2738]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
  Jun 24 16:44:18 test-ppc-b locale-gen[2739]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
  Jun 24 16:44:18 test-ppc-b locale-gen[2740]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
  Jun 24 16:44:18 test-ppc-b locale-gen[2741]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
  Jun 24 16:44:18 test-ppc-b locale-gen[2506]: failed to set locale!
  Jun 24 16:44:18 test-ppc-b locale-gen[2506]: [error] default character map file `ANSI_X3.4-1968' not found: No such file or directory
  Jun 24 16:44:18 test-ppc-b locale-gen[2489]:  done
  Jun 24 16:44:18 test-ppc-b locale-gen[2483]: Generation complete.
  Jun 24 16:44:18 test-ppc-b systemd[1]: test-localegen.service: Deactivated successfully.

  
  [regression potential]

  as this sets NO_ASM any regression would likely involve changed
  performance or architecture-specific failures

  [scope]

  this is needed only in b

  this was fixed in debian at version 1.9-2.1, so this is fixed already
  in f and later

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gzip/+bug/1933516/+subscriptions