FS#43355 - [paxd] texmaker can't open documents

Attached to Project: Community Packages
Opened by Michael Schönitzer (Nudin) - Tuesday, 06 January 2015, 13:26 GMT
Last edited by Daniel Micay (thestinger) - Saturday, 04 July 2015, 02:35 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Daniel Micay (thestinger)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
texmaker does start, but when opening any document or creating a new document it crashes. From dmesg:
[ 3139.255644] grsec: denied RWX mmap of <anonymous mapping> by /usr/bin/texmaker[texmaker:10531] uid/euid:1000/1000 gid/egid:100/100, parent /usr/bin/mate-panel[mate-panel:1226] uid/euid:1000/1000 gid/egid:100/100
[ 3139.255657] texmaker[10531]: segfault at bbadbeef ip 00000345b28978ad sp 00000384419cac90 error 6 in libQt5Script.so.5.4.0[345b27f8000+263000]

Additional info:
* latest versions of paxd & texmaker

Solution:
Put 'em /usr/bin/texmaker' to /etc/paxd.conf and it works.
This task depends upon

Closed by  Daniel Micay (thestinger)
Saturday, 04 July 2015, 02:35 GMT
Reason for closing:  Fixed
Additional comments about closing:  This and most of the other QtScript-based packages are now dealt with.

There are cases left in KDE packages, but it's more work than I want to take on myself.

A much better solution would be detecting mmap/mprotect failure upstream and handling this by falling back an interpreter. Perhaps I'll file a bug with them.
Comment by PaX Team (paxteam) - Thursday, 15 January 2015, 08:10 GMT
since the problem seems to be related to qtscript and not texmaker, i'd suggest two separate routes:

1. disable the JIT engine in qtscript (gentoo has a USE flag for it too), then you won't need to turn off MPROTECT.

2. scan all userland executables that depend on qtscript and turn off MPROTECT on all of them lest you'd face this problem one by one ;).
Comment by Daniel Micay (thestinger) - Thursday, 15 January 2015, 16:22 GMT
Option 1 isn't really going to work due to it being a primarily binary distribution, and disabling the JIT compilers in the default binary builds is not something I can sell.

Option 2 is definitely better than putting out fires one by one. I've tried to systematically mark some classes of exceptions (SpiderMonkey, gjs, dozens of JRE/JDK binaries) but it's a PITA for qt5-webkit and qt5-script because of the vague KDE dependency trees.

Loading...