# eu-findtextrel /usr/sbin/squid3
either the file containing the function '_IO_stdin_used' or the file containing the function '_ZTS11ACLStrategyIPKcE' is not compiled with -fpic/-fPIC

The effect of the above is that when running on SE Linux the execmod permission
is required.

http://www.akkadia.org/drepper/textrelocs.html
http://etbe.coker.com.au/2008/09/11/execmod-and-se-linux-i386-must-die/

The above web pages have Ulrich Drepper's background information on text
relocation and my summary of the security impacts of this.  As squid is a
daemon that interacts with a variety of hostile programs on the Internet as
well as dealing with sensitive user data I think it's important to make it
as secure as possible in this regard.

System Information:
Debian Release: 8.0
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages squid3 depends on:
ii  adduser                  3.113+nmu3
ii  libc6                    2.19-15
ii  libcap2                  1:2.24-7
ii  libcomerr2               1.42.12-1.1
ii  libdb5.3                 5.3.28-9
ii  libecap2                 0.2.0-3
ii  libexpat1                2.1.0-6+b3
ii  libgcc1                  1:4.9.2-10
ii  libgssapi-krb5-2         1.12.1+dfsg-18
ii  libk5crypto3             1.12.1+dfsg-18
ii  libkrb5-3                1.12.1+dfsg-18
ii  libldap-2.4-2            2.4.40-4
ii  libltdl7                 2.4.2-1.11
ii  libnetfilter-conntrack3  1.0.4-1
ii  libnettle4               2.7.1-5
ii  libpam0g                 1.1.8-3.1
ii  libsasl2-2               2.1.26.dfsg1-13
ii  libstdc++6               4.9.2-10
ii  libxml2                  2.9.1+dfsg1-5
ii  logrotate                3.8.7-1+b1
ii  lsb-base                 4.1+Debian13+nmu1
ii  netbase                  5.3
ii  squid3-common            3.4.8-6

squid3 recommends no packages.

Versions of packages squid3 suggests:
pn  resolvconf   <none>
pn  smbclient    <none>
pn  squid-cgi    <none>
pn  squid-purge  <none>
pn  squidclient  <none>
pn  ufw          <none>
pn  winbindd     <none>

Hi Russel,

Thanks for taking your time and reporting this bug. I did not understand completely what it’s going on and maybe you can help me find out.

From my understanding:

  - no library is compiled from squid3 sources, thus -fPIC should not be needed. -fPIE should be used instead;
  - squid3 is compiled with hardening=+all flags and this includes ‘-fPIE’ which should handle text relocations;
  - two symbols are reported from eu-findtextrel:
    * _IO_stdin_used is a private symbol from libc and is not defined in squid3 sources (nor used directly);
    * _ZTS11ACLStrategyIPKcE does not map to a function, but this may be my fault in understanding symbol names.

Can you please help me sort this out? A debug binary is available in squid3-dbg package if needed.

Regards,

L

understand completely what it’s going on and maybe you can help me
find out.
needed. -fPIE should be used instead;

This is not quite true. Squid is constructed from a collection of
convenience libraries. Which are statically linked as needed to each
binary in the package.
In 3.4 and 3.5 some are still constructed as full static libraries
rather than convenience objects.

My understanding was that -fPIC is needed on the convenience objects,
and -fPIE on the final binaries.
But that libtool takes care of determining which one (of the ones
provided) is to be used on any particular object built.
includes ‘-fPIE’ which should handle text relocations;

Nod.
squid3 sources (nor used directly);
my fault in understanding symbol names.

This is a virtual class template name.

Amos