Bug #72281 [Opn]: PaX MPROTECT breaks php

Edit report at https://bugs.php.net/bug.php?id=72281&edit=1 ID: 72281 User updated by: tk at giga dot or dot at Reported by: tk at giga dot or dot at Summary: PaX MPROTECT breaks php Status: Open Type: Bug Package: PCRE related Operating System: NetBSD PHP Version: 7.0.7 Block user comment: N Private report: N New Comment: PCRE is built as a shared library here, so the paxctl does work in this case. The paxctl is just a workaround, the real fix would be to address the PCRE bug "PCRE-JITted code should be executed from non-writable memory to obey execmem SELinux restriction": https://bugs.exim.org/show_bug.cgi?id=1749 It is however better in the meantime than core dumps :) Previous Comments: ------------------------------------------------------------------------ [2016-11-09 20:32:27] cmb@php.net As I understand it, the compilation succeeds, but the problem is PCRE's JIT support, so I'm changing the "package affected". > Since JIT and MPROTECT are at odds with each other, I suggest running > "paxctl +m" on the binary, […] But what if PCRE is built as shared library? Would that also work in this case? Furthermore, according to Gentoo's Hardened/PaX Quickstart[1] it appears that marking is not without issues. Perhaps we should simply document the issue instead of trying to fix it? [1] <https://wiki.gentoo.org/wiki/Hardened/PaX_Quickstart#Marking_for_PaX> ------------------------------------------------------------------------ [2016-11-09 15:10:17] ab@php.net Related To: Bug #73114 ------------------------------------------------------------------------ [2016-05-28 08:11:44] tk at giga dot or dot at Description: ------------ When compiling php-7.0.7 on NetBSD-7.99.29/amd64, the compilation fails because php dumps core. The problem is that NetBSD on that release has PaX MPROTECT turned on by default (see http://netbsd.gw.com/cgi-bin/man-cgi?security++NetBSD-current), i.e. it does not allow mapping pages both writable and executable. However, this is needed by php. The backtrace of the core dump has: #1 0x00000000004d0d87 in _pcre_jit_exec () #2 0x00000000004a53f1 in php_pcre_exec () Since JIT and MPROTECT are at odds with each other, I suggest running "paxctl +m" on the binary, which (on NetBSD, see http://netbsd.gw.com/cgi-bin/man-cgi?paxctl++NetBSD-current) removes the MPROTECT restrictions for the php binary. A workaround patch is attached. It can not be used as is, since paxctl on *BSD and paxctl on Linux have different syntax. I hope that someone can extend this to also work on Linux. The patch is an example, but is tested and works on NetBSD. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72281&edit=1