Bug#837562: Bug#756655: libembperl-perl: FTBFS on s390x: Embperl.so: undefined symbol: ap_rflush

[Niko Tyni]

On Mon, Sep 12, 2016 at 04:51:04PM +0200, gregor herrmann wrote:
> On Fri, 15 Jan 2016 20:15:56 +0100, Axel Beckert wrote:
> 
> > Can't load '/home/abe/libembperl-perl/blib/arch/auto/Embperl/Embperl.so' for module Embperl: /home/abe/libembperl-perl/blib/arch/auto/Embperl/Embperl.so: undefined symbol: ap_hook_open_logs at /usr/lib/s390x-linux-gnu/perl/5.22/DynaLoader.pm line 187.
> >  at test.pl line 1916.
> > Compilation failed in require at test.pl line 1916.
> > BEGIN failed--compilation aborted at test.pl line 1916.
> > 
> > Same for ap_hook_post_config and ap_rwrite. That's where I stopped
> > commenting out code.
> [..]
> > For now, I'm out of ideas.
> 
> This (#756655) looks a bit like the new #837562 (FTBFS with PIE),
> especially since, if I'm reading the patch in #835148 correctly, PIE
> was already enabled on s390x.

Looks like it's a different thing though the symptoms are similar.
Builds on s390x are actually working now, since March 2016 or so.

 https://buildd.debian.org/status/logs.php?pkg=libembperl-perl&arch=s390x

I'm guessing #756655 was a binutils issue fixed between 2.26-2 and 2.26-7
as libembperl-perl started to build on s390x without any source changes.

So closing that bug. Please drop 756655-done@ from any replies.

As for #835148, it's triggered by bindnow (not PIE). I think the patch in
#835148 just shows that PIE was already enabled in Ubuntu on s390x, but
not in Debian.

My understanding is that the Apache module parts (mod_embperl) get
compiled into Embperl.so, but don't get used unless the thing is loaded
by Apache. The 'bindnow' hardening is incompatible with this scheme;
from the ld(1) documentation for '-z now':

  When generating an executable or shared library, mark it to tell the
  dynamic linker to resolve all symbols when the program is started, or
  when the shared library is linked to using dlopen, instead of deferring
  function call resolution to the point when the function is first called.

So when perl dlopens Embperl.so without Apache, the ap_* functions
aren't needed but still get loaded (unsuccessfully).

I think the fix/workaround for this is explicitly opting out of bindnow
with something like

  export DEB_BUILD_MAINT_OPTIONS=hardening=-bindnow

in debian/rules, and possibly a wishlist bug upstream for separating
the Apache module into a separate DSO that loads Embperl.so ?
-- 
Niko Tyni   ntyni at debian.org