Open fundon opened 3 years ago
@nodejs/platform-freebsd
Installing from packages (which currently has node-16.10.0 in the set) on FreeBSD 13 here works for me:
$ npm -v
6.14.8
$ yarn -v
1.22.11
Installing from packages (which currently has node-16.10.0 in the set) on FreeBSD 13 here works for me:
Not works for me: https://github.com/Brooooooklyn/snappy/runs/3913092013?check_suite_focus=true
$ node -v
ld-elf.so.1: /lib/libcrypto.so.111: version OPENSSL_1_1_1e required by /usr/local/bin/node not found
ld-elf.so.1: /lib/libcrypto.so.111: version OPENSSL_1_1_1e required by /usr/local/bin/node not found
I got that same error after pkg update/upgrade to node 16.10.0 a few days ago and then after upgrade to node 16.11.1 today.
Today I tried running:
# freebsd-update fetch
# freebsd-update install
That fixed it. The node --version is now reported as v16.11.1 without the openssl error (without needing to reinstall node).
I have a similar trace during compilation. When I install the prebuilt package from the repository, I'm also getting that trace after running node binary.
I use truenas Core 12.0 -U6 (freebsd 12.2) I see same message.. jail`s openssl version is 1.1.1h
I use truenas Core 12.0 -U6 (freebsd 12.2) I see same message.. jail`s openssl version is 1.1.1h
Have you managed to fix it? I'm facing the same issue on the same TueNAS release.
same error for truenas - freebsd 12.2 jail
This bug is caused by setting sysctl kern.elf64.allow_wx=0
(on the host system)
Which is why it also can occur in a FreeBSD 12.2 jail
note that just calling node --version, i'll get:
root@ports ~# node --version
v16.13.0
root@ports ~#
but as soon as i involve any JavaScript in the process it's not too happy about this
What allow WX=0 is that it disables executable sections to be writable. If JavaScript programs need that, then nodejs needs to be marked, as such on FreeBSD:
root@ports ~# elfctl /usr/local/bin/node
File '/usr/local/bin/node' features:
noaslr 'Disable ASLR' is unset.
noprotmax 'Disable implicit PROT_MAX' is unset.
nostackgap 'Disable stack gap' is unset.
wxneeded 'Requires W+X mappings' is unset.
la48 'amd64: Limit user VA to 48bit' is unset.
noaslrstkgap 'Disable ASLR stack gap' is unset.
root@ports ~#
if i do this manually:
root@ports ~ # elfctl -e +wxneeded /usr/local/bin/node
root@ports ~# elfctl /usr/local/bin/node
File '/usr/local/bin/node' features:
noaslr 'Disable ASLR' is unset.
noprotmax 'Disable implicit PROT_MAX' is unset.
nostackgap 'Disable stack gap' is unset.
wxneeded 'Requires W+X mappings' is set.
la48 'amd64: Limit user VA to 48bit' is unset.
noaslrstkgap 'Disable ASLR stack gap' is unset.
then re-enable allow_wx, it works:
root@ports ~# sysctl -a | grep allow_wx
kern.elf32.allow_wx: 0
kern.elf64.allow_wx: 0
root@ports ~# yarn --version
1.22.17
root@ports ~#
note that this seems to be a new feature in 16 and 17, it does not happen in 14.
Found a random twitter thread that suggests V8 started using RWX pages so this could explain a regression. https://twitter.com/spoofyroot/status/1379911789903716352
Can everyone who has experienced this issue confirm that they've set the allow_wx sysctl to 0?
I did set it and setting it to 1 allows node to be built.
I've just found this ticket searching for the error message I was seeing building node16 on my poudriere server, and indeed I have w^x enabled and turning it off allowed node to build!
Do we know if this is a bug in the FreeBSD port or a bug in nodejs itself?
Neither. It's an issue with nodejs starting to use JIT. Ideally, there would be an option in nodejs to disable JIT, or FreeBSD ports could disable ASLR selectively for node binary.
There's a --jitless
flag but that's like installing a 30 mph speed limiter in your Ferrari.
A better option is --nowrite_code_using_rwx
.
Interestingly Debian Code Search and Google both turn up no hits for "nowrite_code_using_rwx" so I guess this is not really used in the wild today (other than on macOS on arm64, as a #if compile-time default)?
#if !defined(V8_OS_DARWIN) || !defined(V8_HOST_ARCH_ARM64)
DEFINE_BOOL(write_code_using_rwx, true,
"flip permissions to rwx to write page instead of rw")
DEFINE_NEG_IMPLICATION(jitless, write_code_using_rwx)
#else
DEFINE_BOOL_READONLY(write_code_using_rwx, false,
"flip permissions to rwx to write page instead of rw")
#endif
https://chromium.googlesource.com/v8/v8/+/master/src/flags/flag-definitions.h#747
If someone is willing to write a patch and upstream it I think the best case would be to have the process use procctl(2) on FreeBSD to determine if the process has wx mappings disabled and set write_code_using_rwx appropriately (i.e., a run-time rather than compile-time default).
As a much more straightforward (and easier to be accepted) change we could also just default write_code_using_rwx
to false on FreeBSD unconditionally, e.g. !((Darwin && arm64) || FreeBSD).
Finally nodejs's build infrastructure or the FreeBSD port could use elfctl to mark the binary as requiring wx mappings (using wxneeded flag). There is ports infrastructure to handle this in a consistent way if the port maintainer wants to go that way.
The same "issue" happens on OpenBSD. I think that turning -nowrite_code_using_rwx
on by default is definitely better than changing the port build infra to explicitly touch elf metadata, but as I'm not a FreeBSD user I'm quite unfamiliar with what are the best practices in such cases.
Version
v16.10.0
Platform
FreeBSD fundev.local 13.0-RELEASE-p4 FreeBSD 13.0-RELEASE-p4 #0: Tue Aug 24 07:33:27 UTC 2021 root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
Subsystem
No response
What steps will reproduce the bug?
How often does it reproduce? Is there a required condition?
If I install it from pkg.
What is the expected behavior?
No response
What do you see instead?
No response
Additional information
No response