gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted

> [impact]

> gzip/libgzip fails for systemd services using MemoryDenyWriteExecute=yes

Please could you expand on this? Under what circumstances are users going to be affected by this?

Specifically our SRU process requires: "An explanation of the bug on users and justification for backporting the fix to the stable release".

I also don't understand what's going on here, so I'd also appreciate "In addition, it is helpful, but not required, to include an explanation of how the upload fixes this bug".

> > gzip/libgzip fails for systemd services using MemoryDenyWriteExecute=yes
> Please could you expand on this? Under what circumstances are users going to be affected by this?

nearly all the systemd services include this setting, e.g.

$ grep -r MemoryDeny *
dbus-org.freedesktop.hostname1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.locale1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.login1.service:MemoryDenyWriteExecute=yes
dbus-org.freedesktop.timedate1.service:MemoryDenyWriteExecute=yes
systemd-hostnamed.service:MemoryDenyWriteExecute=yes
systemd-journald.service:MemoryDenyWriteExecute=yes
systemd-localed.service:MemoryDenyWriteExecute=yes
systemd-logind.service:MemoryDenyWriteExecute=yes
systemd-networkd.service:MemoryDenyWriteExecute=yes
systemd-resolved.service:MemoryDenyWriteExecute=yes
systemd-timedated.service:MemoryDenyWriteExecute=yes
systemd-timesyncd.service:MemoryDenyWriteExecute=yes
systemd-udevd.service:MemoryDenyWriteExecute=yes
udev.service:MemoryDenyWriteExecute=yes

so any call from a systemd service to gzip anything on bionic/ppc64el will fail

> I also don't understand what's going on here

the asm causes failures on some archs under certain conditions and is disabled in debian/ubuntu as shown in the linked debian bug. There's quite a lot of detail in the debian bug if you would like more specific detail on why the asm shouldn't be used

Thanks - I had missed the Debian bug link.

Hello Dan, or anyone else affected,

Accepted gzip into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gzip/1.6-5ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

ubuntu@test-ppc-b:~$ dpkg -l|grep gzip
ii gzip 1.6-5ubuntu1 ppc64el GNU compression utilities
ubuntu@test-ppc-b:~$ sudo systemctl daemon-reload
ubuntu@test-ppc-b:~$ sudo systemctl start test-localegen.service
ubuntu@test-ppc-b:~$ sudo systemctl status test-localegen.service
○ test-localegen.service
     Loaded: loaded (8;;file://test-ppc-b/etc/systemd/system/test-localegen.service^G/etc/systemd/system/test-localegen.service8;;^G; static)
     Active: inactive (dead)

Jul 11 22:32:32 test-ppc-b locale-gen[42474]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
Jul 11 22:32:32 test-ppc-b locale-gen[42475]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
Jul 11 22:32:32 test-ppc-b locale-gen[42476]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
Jul 11 22:32:32 test-ppc-b locale-gen[42477]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
Jul 11 22:32:32 test-ppc-b locale-gen[42478]: gzip: error while loading shared libraries: cannot restore segment prot after reloc: Operation not permitted
Jul 11 22:32:32 test-ppc-b locale-gen[42243]: failed to set locale!
Jul 11 22:32:32 test-ppc-b locale-gen[42243]: [error] default character map file `ANSI_X3.4-1968' not found: No such file or directory
Jul 11 22:32:32 test-ppc-b locale-gen[42222]: done
Jul 11 22:32:32 test-ppc-b locale-gen[42216]: Generation complete.
Jul 11 22:32:32 test-ppc-b systemd[1]: test-localegen.service: Deactivated successfully.

ubuntu@test-ppc-b:~$ dpkg -l|grep gzip
ii gzip 1.6-5ubuntu1.1 ppc64el GNU compression utilities
ubuntu@test-ppc-b:~$ sudo systemctl daemon-reload
ubuntu@test-ppc-b:~$ sudo systemctl start test-localegen.service
ubuntu@test-ppc-b:~$ sudo systemctl status test-localegen.service
○ test-localegen.service
     Loaded: loaded (8;;file://test-ppc-b/etc/systemd/system/test-localegen.service^G/etc/systemd/system/test-localegen.service8;;^G; static)
     Active: inactive (dead)

Jul 11 22:32:32 test-ppc-b locale-gen[42243]: failed to set locale!
Jul 11 22:32:32 test-ppc-b locale-gen[42243]: [error] default character map file `ANSI_X3.4-1968' not found: No such file or directory
Jul 11 22:32:32 test-ppc-b locale-gen[42222]: done
Jul 11 22:32:32 test-ppc-b locale-gen[42216]: Generation complete.
Jul 11 22:32:32 test-ppc-b systemd[1]: test-localegen.service: Deactivated successfully.
Jul 11 22:33:13 test-ppc-b systemd[1]: Started test-localegen.service.
Jul 11 22:33:13 test-ppc-b locale-gen[42930]: Generating locales (this might take a while)...
Jul 11 22:33:13 test-ppc-b locale-gen[42936]: en_US.UTF-8... done
Jul 11 22:33:13 test-ppc-b locale-gen[42930]: Generation complete.
Jul 11 22:33:13 test-ppc-b systemd[1]: test-localegen.service: Deactivated successfully.

As per Robie's comment, I think we can safely release this as is. Thanks!

This bug was fixed in the package gzip - 1.6-5ubuntu1.1

---------------
gzip (1.6-5ubuntu1.1) bionic; urgency=medium

  * d/rules: Do not use ASM (LP: #1933516)

 -- Dan Streetman <email address hidden> Thu, 24 Jun 2021 11:38:02 -0400

The verification of the Stable Release Update for gzip has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.