sys-libs/libapparmor: Disable LTO

[felikcat]

Problematic when attempting to compile firejail afterwards with the apparmor USE flag.

x86_64-pc-linux-gnu-gcc -march=skylake -falign-functions=32 -O3 -fgraphite-identity -floop-nest-optimize -fipa-pta -fno-semantic-interposition -flto=7 -fuse-linker-plugin -pipe -Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu -ggdb -O2 -DVERSION='"0.9.56"' -DPREFIX='"/usr"' -DSYSCONFDIR='"/etc/firejail"' -DLIBDIR='"/usr/lib64"' -DHAVE_X11 -DHAVE_PRIVATE_HOME -DHAVE_APPARMOR -DHAVE_OVERLAYFS -DHAVE_SECCOMP -DHAVE_GLOBALCFG -DHAVE_SECCOMP_H -DHAVE_CHROOT -DHAVE_NETWORK -DHAVE_USERNS -DHAVE_FILE_TRANSFER -DHAVE_WHITELIST -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security -c x11.c -o x11.o
/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: /usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../lib64/libapparmor.so: undefined reference to `aa_query_label'
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:10: firemon] Error 1
make[1]: Leaving directory '/var/tmp/portage/sys-apps/firejail-0.9.56-r1/work/firejail-0.9.56/src/firemon'
make: *** [Makefile:34: src/firemon] Error 2
make: *** Waiting for unfinished jobs....
x86_64-pc-linux-gnu-gcc -Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu -march=skylake -falign-functions=32 -O3 -fgraphite-identity -floop-nest-optimize -fipa-pta -fno-semantic-interposition -flto=7 -fuse-linker-plugin -pipe -pie -Wl,-z,relro -Wl,-z,now -lpthread -o firejail appimage.o appimage_size.o arp.o bandwidth.o caps.o cgroup.o checkcfg.o cmdline.o cpu.o dbus.o env.o fs.o fs_bin.o fs_dev.o fs_etc.o fs_home.o fs_hostname.o fs_lib.o fs_lib2.o fs_logger.o fs_mkdir.o fs_trace.o fs_var.o fs_whitelist.o join.o ls.o macros.o main.o mountinfo.o netfilter.o netns.o network.o network_main.o no_sandbox.o output.o paths.o preproc.o profile.o protocol.o pulseaudio.o restrict_users.o restricted_shell.o rlimit.o run_files.o run_symlink.o sandbox.o sbox.o seccomp.o shutdown.o usage.o util.o x11.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o -lapparmor
/usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: /usr/lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../lib64/libapparmor.so: undefined reference to `aa_query_label'
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:10: firejail] Error 1
make[1]: Leaving directory '/var/tmp/portage/sys-apps/firejail-0.9.56-r1/work/firejail-0.9.56/src/firejail'
make: *** [Makefile:34: src/firejail] Error 2

[InBetweenNames]

Finally got a chance to test this. On my system it works without any linking errors. If I had to guess, this is related to the binary stripping issue mentioned in the README.md.

[InBetweenNames]

@Ghost-101 is this still affecting you?

[felikcat]

I don't have a Gentoo installation currently, didn't have what I needed at the time. If someone else could retest it'd be appreciated.

[InBetweenNames]

No issues on GCC 9.1.0. I'll close this for now, but if it needs to be reopened, just comment.

[kryptt]

I was forced to exclude LTO here.

This is what I have in my make.conf:

FLTO="-flto=8"
GRAPHITE="-fgraphite-identity -floop-nest-optimize"
CFLAGS="-march=native -mtune=native -O3 ${GRAPHITE} ${FLTO} -fuse-linker-plugin -pipe"
CXXFLAGS="${CFLAGS}"
LDFLAGS="-Wl,--as-needed -Wl,--hash-style=gnu"
CBUILD="x86_64-pc-linux-gnu"
CHOST=$CBUILD
CTARGET=$CTARGET

[kryptt]

I just revisited this override I had:

sys-libs/libapparmor *FLAGS-=-flto*

and symbols from libapparmor are still being stripped, so it is still needed; any ideas?

[elsandosgrande]

@kryptt If you are still seeing issues, how about we discuss it on a ticket once you have opened it?

[SudoNova]

It's true, this is not lto compatible:

emerge -1 libapparmor

readelf -s /usr/lib64/libapparmor.so | grep aa_query_label
1: 0000000000000000 0 NOTYPE GLOBAL DEFAULT UND aa_query_label

IPAPTA=0 emerge -1 libapparmor

readelf -s /usr/lib64/libapparmor.so | grep aa_query_label
1: 0000000000000000 0 NOTYPE GLOBAL DEFAULT UND aa_query_label

LTO=0 emerge -1 libapparmor

readelf -s /usr/lib64/libapparmor.so | grep aa_query_label
124: 0000000000005f10 578 FUNC GLOBAL DEFAULT 11 aa_query_label@@APPARMOR_2.9
126: 0000000000005f10 578 FUNC GLOBAL DEFAULT 11 aa_query_label@APPARMOR_1.1

[InBetweenNames]

Still can't reproduce. I'm going to need some build.logs to try to identify what's going on here.