pkg/51800: gnutls w/accelerated asm routines runs afoul of PAX MPROTECT on -current/i386

[jdbaker%mylinuxisp.com@localhost]

>Number:         51800
>Category:       pkg
>Synopsis:       gnutls w/accelerated asm routines runs afoul of PAX MPROTECT on -current/i386
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 08 15:45:00 +0000 2017
>Originator:     John D. Baker
>Release:        NetBSD/i386-7.99.55, pkgsrc-2016Q4
>Organization:
>Environment:
NetBSD verthandi 7.99.55 NetBSD 7.99.55 (VERTHANDI) #1: Fri Jan  6 15:38:47 CST 2017  sysop%dpe2850b.technoskunk.fur@localhost:/d0/build/current/obj/i386/sys/arch/i386/compile/VERTHANDI i386

>Description:
While making another stab at pkg/51266 (see PR for context), I figured
it would be good to figure out how to fix or work around issues with
loading "gnutls" libraries--just to reduce the possible sources of
error.  This is most often seen during package builds which use
"gobject-introspection".  Example from "security/libsecret":

[...]
  GISCAN   Secret-1.gir
/usr/pkg/lib/libgnutls.so.30: text relocations
/usr/pkg/lib/libgnutls.so.30: Cannot write-enable text segment: Permission denied
Failed to load module: /usr/pkg/lib/gio/modules/libgiognutls.so

[g-ir-scanner messages]

Failed to load module: /usr/pkg/lib/gio/modules/libgiognutls.so
Command '[u'/d0/build/pkgsrc/security/libsecret/work/libsecret-0.18/tmp-introspect1lCZGZ/Secret-1', u'--introspect-dump=/d0/build/pkgsrc/security/libsecret/work/libsecret-0.18/tmp-introspect1lCZGZ/functions.txt,/d0/build/pkgsrc/security/libsecret/work/libsecret-0.18/tmp-introspect1lCZGZ/dump.xml']' returned non-zero exit status -11
[1]   Segmentation fault (core dumped) CPPFLAGS="-I/usr...
/usr/pkg/share/gobject-introspection-1.0/Makefile.introspection:155: recipe for target 'Secret-1.gir' failed
gmake[2]: *** [Secret-1.gir] Error 139
gmake[2]: Leaving directory '/d0/build/pkgsrc/security/libsecret/work/libsecret-0.18'
Makefile:1992: recipe for target 'all-recursive' failed
gmake[1]: *** [all-recursive] Error 1
gmake[1]: Leaving directory '/d0/build/pkgsrc/security/libsecret/work/libsecret-0.18'
Makefile:1147: recipe for target 'all' failed
gmake: *** [all] Error 2
*** Error code 2

Stop.
make[1]: stopped in /usr/pkgsrc/security/libsecret
*** Error code 1

Stop.
make: stopped in /usr/pkgsrc/security/libsecret

(the segfault from the mysterious "Secret-1" program included for
context, but not actually relevant to this PR).


Another discussion of this took place in this thread:

  http://mail-index.netbsd.org/pkgsrc-users/2016/10/03/msg023815.html

and specifically here:

  http://mail-index.netbsd.org/pkgsrc-users/2016/11/29/msg024028.html


I scanned everything in WRKOBJDIR for "libsecret" (and
"gobject-introspection") with 'ldd' but didn't find anything actually
linked against any gnutls libraries, even indirectly.  Even scanning
the installed "/usr/pkg/{,s}bin" and "/usr/pkg/lib" only turned up
"ffmpeg3" and "cups" binaries/libraries that referenced anything from
"gnutls".  I don't know where anything related to
"gobject-introspection" is trying to load "gnutls" stuff.

>How-To-Repeat:
Attempt to build "gobject-introspection" or anything that uses it
on i386-current after PAX MPROTECT was turned on by default.

I think I saw something similar on macppc?  It's been a long time since
I last booted NetBSD/macppc let alone try building any packages.

The problem does not occur on amd64.
>Fix:
Fix assembly routines to behave themselves?  I am not an x86 assembly
person.

Workaround:  Add:

  CONFIGURE_ARGS+= --disable-hardware-acceleration

for i386 (other non-amd64?) platforms with PAX MPROTECT enabled.