macos SIP and make check

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

macos SIP and make check

Carlo de Falco-2
Hi,

I recently encountered a problem when running make check due
to System Integrity Protection (SIP)[1] being enabled by default on
macos High Sierra.

Apart from preventing even the root user from writing into some system
directories, it appears that SIP prevents some environment variables
such as DYLD_LIBRARY_PATH from being inherited by executable scripts [2],
while they appear to be inherited by binary executables.

As I have some libraries installed outside standard paths (namely sundials)
In my configure options I have

    --with-sundials_nvecserial-includedir=/opt/sundials/2.7.0/include \
    --with-sundials_ida-includedir=/opt/sundials/2.7.0/include \
    --with-sundials_nvecserial-libdir=/opt/sundials/2.7.0/lib \
    --with-sundials_ida-libdir=/opt/sundials/2.7.0/lib

which are sufficient to allow configure and build to work correctly,
but when running Octave I also need to use

    export DYLD_LIBRARY_PATH=/opt/sundials/2.7.0/lib

or ode15{i,s} tests will fail with an "image not found" error.

Since SIP has been enabled specifying DYLD_LIBRARY_PATH will work
when running the installed octave or octave-cli executables but
will fail when using the run-octave script.

As a result "make check" will return a FAIL for all tests that require
SUNDIALS even though running the same tests from within an installed Octave
will work.

Any idea how to avoid the use of DYLD_LIBRARY_PATH? Any other ideas how
to work around this problem?

Thanks,
c.


[1] https://support.apple.com/en-us/HT204899
[2] https://forums.developer.apple.com/thread/9233


-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Mike Miller-4
On Thu, Feb 01, 2018 at 13:47:04 +0000, Carlo De Falco wrote:
> Any idea how to avoid the use of DYLD_LIBRARY_PATH? Any other ideas how
> to work around this problem?

Does building with LDFLAGS=-R/opt/sundials/2.7.0/lib work? This should
add the directory to the rpath encoded into every shared library and
executable in the build.

--
mike


-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------

signature.asc (849 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Carlo de Falco-2


> On 1 Feb 2018, at 18:16, Mike Miller <[hidden email]> wrote:
>
> On Thu, Feb 01, 2018 at 13:47:04 +0000, Carlo De Falco wrote:
>> Any idea how to avoid the use of DYLD_LIBRARY_PATH? Any other ideas how
>> to work around this problem?
>
> Does building with LDFLAGS=-R/opt/sundials/2.7.0/lib work? This should
> add the directory to the rpath encoded into every shared library and
> executable in the build.

Hi,

Sorry for the late reply.
I tried adding the suggested option either as
 
  LDFLAGS=-R/opt/sundials/2.7.0/lib

But configure fails with error

  configure: error: cannot compile liboctave/util/blaswrap.c
  See `config.log' for more details

which seems to be realted to these errors in config.log

  configure:32169: /opt/local/bin/gfortran-mp-7 -o conftest -ff2c -g -O2  -L/opt/local/lib -R/opt/sundials/2.7.0/lib conftest.f -L/opt/local/lib -lopenblas -lm   >&5
  gfortran-mp-7: error: unrecognized command line option '-R'

  ...  

  configure:32409: /usr/bin/clang -c -g -O2   -DUSE_BLASWRAP -I/opt/local/include conftest.c >&5
  conftest.c:53:20: fatal error: 'liboctave/util/blaswrap.c' file not found

I worked around the problem by installing sundials via macports
but would still be interested in finding a solution for linking
self-compiled libraries if you have other suggestions.

Thanks,
c.






-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

ederag
On Monday, February 05, 2018 05:23:43 Carlo De Falco wrote:
> I worked around the problem by installing sundials via macports
> but would still be interested in finding a solution for linking
> self-compiled libraries if you have other suggestions.

perhaps with LDFLAGS="... -Wl,-rpath, ...", as in
http://wiki.octave.org/Octave_and_separate_toolchain



-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Carlo de Falco-2


> On 5 Feb 2018, at 15:50, ederag <[hidden email]> wrote:
>
> On Monday, February 05, 2018 05:23:43 Carlo De Falco wrote:
>> I worked around the problem by installing sundials via macports
>> but would still be interested in finding a solution for linking
>> self-compiled libraries if you have other suggestions.
>
> perhaps with LDFLAGS="... -Wl,-rpath, ...", as in
> http://wiki.octave.org/Octave_and_separate_toolchain
>

Thanks for the suggestion.
With this option set:

 -Wl,-rpath -Wl,/opt/sundials/2.7.0/lib

building works but when running "make check"
or  doing "./run-octave" and "test ode15i"
the test fails with

  >> test ode15i
  ***** testif HAVE_SUNDIALS
   ref = 0.049787079136413;
   ff = @(t, u, udot)  udot + 3 * u;
   [t, y] = ode15i (ff, 0:1, 1, -3);
   assert ([t(end), y(end)], [1, ref], 1e-3);
  !!!!! test failed
  /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct: failed to load: dlopen(/opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct,   10): Library not loaded: libsundials_ida.2.dylib
   Referenced from: /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
   Reason: image not found

installing and then running the test leads to the same error.
exporting the DYLD_LIBRARY_PATH variable before running the
Octave binary lets the test pass.

c.



 

-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

ederag
On Tuesday, February 06, 2018 06:25:33 Carlo De Falco wrote:
>   !!!!! test failed
>   /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct: failed to load: dlopen(/opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct,   10): Library not loaded: libsundials_ida.2.dylib
>    Referenced from: /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
>    Reason: image not found

To debug that, the following commands might be useful:
ldd /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
and
chrpath -l /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
# the later output should contain RPATH=/opt/sundials/2.7.0/lib



-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Carlo de Falco-2


> On 6 Feb 2018, at 09:57, ederag <[hidden email]> wrote:
>
> On Tuesday, February 06, 2018 06:25:33 Carlo De Falco wrote:
>>  !!!!! test failed
>>  /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct: failed to load: dlopen(/opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct,   10): Library not loaded: libsundials_ida.2.dylib
>>   Referenced from: /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
>>   Reason: image not found
>
> To debug that, the following commands might be useful:
> ldd /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
> and
> chrpath -l /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
> # the later output should contain RPATH=/opt/sundials/2.7.0/lib

There is no "ldd" or "chrpath" on macos.
The output below should be the equivalent generated by "otool".
Thanks,
c.

$ otool -l /opt/octave/4.3.0+/bin/octave-cli
...
Load command 47
          cmd LC_RPATH
      cmdsize 40
         path /opt/sundials/2.7.0/lib (offset 12)
...


$ otool -l /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
...
Load command 41
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name libsundials_ida.2.dylib (offset 24)
   time stamp 2 Thu Jan  1 01:00:02 1970
      current version 2.9.0
compatibility version 2.0.0
Load command 42
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name libsundials_nvecserial.2.dylib (offset 24)
   time stamp 2 Thu Jan  1 01:00:02 1970
      current version 2.7.0
compatibility version 2.0.0
Load command 43
          cmd LC_LOAD_DYLIB
      cmdsize 64
         name /opt/local/lib/libklu.1.3.0.dylib (offset 24)
   time stamp 2 Thu Jan  1 01:00:02 1970
      current version 0.0.0
compatibility version 1.0.0
...
Load command 48
          cmd LC_RPATH
      cmdsize 40
         path /opt/sundials/2.7.0/lib (offset 12)
...


$ otool -L /opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct
/opt/octave/4.3.0+/lib/octave/4.3.0+/oct/x86_64-apple-darwin17.4.0/__ode15__.oct:
        /opt/octave/4.3.0+/lib/octave/4.3.0+/liboctinterp.4.dylib (compatibility version 5.0.0, current version 5.0.0)
        /opt/octave/4.3.0+/lib/octave/4.3.0+/liboctave.4.dylib (compatibility version 5.0.0, current version 5.0.0)
        /opt/local/lib/libhdf5.101.dylib (compatibility version 102.0.0, current version 102.0.0)
        /opt/local/lib/libGraphicsMagick++.12.dylib (compatibility version 16.0.0, current version 16.1.0)
        /opt/local/lib/libGraphicsMagick.3.dylib (compatibility version 21.0.0, current version 21.2.0)
        /opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
        /opt/local/lib/libfontconfig.1.dylib (compatibility version 12.0.0, current version 12.1.0)
        /opt/local/lib/libfreetype.6.dylib (compatibility version 21.0.0, current version 21.0.0)
        /opt/local/lib/libgl2ps.1.dylib (compatibility version 1.0.0, current version 1.4.0)
        /opt/local/lib/libcurl.4.dylib (compatibility version 10.0.0, current version 10.0.0)
        /opt/local/lib/libcholmod.3.0.0.dylib (compatibility version 3.0.0, current version 3.0.0)
        /opt/local/lib/libumfpack.5.7.0.dylib (compatibility version 5.0.0, current version 0.0.0)
        /opt/local/lib/libamd.2.4.0.dylib (compatibility version 2.0.0, current version 2.4.0)
        /opt/local/lib/libcamd.2.4.0.dylib (compatibility version 2.0.0, current version 2.4.0)
        /opt/local/lib/libcolamd.2.9.0.dylib (compatibility version 2.0.0, current version 2.9.0)
        /opt/local/lib/libccolamd.2.9.0.dylib (compatibility version 2.0.0, current version 2.9.0)
        /opt/local/lib/libcxsparse.3.1.3.dylib (compatibility version 3.0.0, current version 3.1.3)
        /opt/local/lib/libsuitesparseconfig.4.2.1.dylib (compatibility version 4.0.0, current version 4.2.1)
        /opt/local/lib/libarpack.2.dylib (compatibility version 3.0.0, current version 3.0.0)
        /opt/local/lib/libqrupdate.1.dylib (compatibility version 0.0.0, current version 0.0.0)
        /opt/local/lib/libfftw3_threads.3.dylib (compatibility version 9.0.0, current version 9.5.0)
        /opt/local/lib/libfftw3.3.dylib (compatibility version 9.0.0, current version 9.5.0)
        /opt/local/lib/libfftw3f_threads.3.dylib (compatibility version 9.0.0, current version 9.5.0)
        /opt/local/lib/libfftw3f.3.dylib (compatibility version 9.0.0, current version 9.5.0)
        /opt/local/lib/libopenblas-r1.dylib (compatibility version 0.0.0, current version 0.0.0)
        /opt/local/lib/libreadline.7.dylib (compatibility version 7.0.0, current version 7.0.0)
        /opt/local/lib/libncurses.6.dylib (compatibility version 6.0.0, current version 6.0.0)
        /opt/local/lib/libpcre.1.dylib (compatibility version 4.0.0, current version 4.9.0)
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.0.0)
        /opt/local/lib/libgcc/libgfortran.4.dylib (compatibility version 5.0.0, current version 5.0.0)
        /opt/local/lib/libgcc/libquadmath.0.dylib (compatibility version 1.0.0, current version 1.0.0)
        /opt/local/lib/libiconv.2.dylib (compatibility version 9.0.0, current version 9.0.0)
        libsundials_ida.2.dylib (compatibility version 2.0.0, current version 2.9.0)
        libsundials_nvecserial.2.dylib (compatibility version 2.0.0, current version 2.7.0)
        /opt/local/lib/libklu.1.3.0.dylib (compatibility version 1.0.0, current version 0.0.0)
        /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL (compatibility version 1.0.0, current version 1.0.0)
        /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon (compatibility version 2.0.0, current version 158.0.0)
        /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 400.9.0)






-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Sebastian Schöps
In reply to this post by Carlo de Falco-2
Carlo de Falco-2 wrote
> Apart from preventing even the root user from writing into some system
> As I have some libraries installed outside standard paths (namely
> sundials)

I have no issues with homebrew and non-standard paths, it even works for the
Octave.app ("/Application/..."). Not sure why it fails for you. Standard
homebrew installs its files into "/usr/local/opt/". Cou could try to put
your stuff there? (You do not use homebrew and macports is not using this
directory as far as I recall).

Or you move to homebrew altogether... you find Ben's configure script (file
#42932) at https://savannah.gnu.org/bugs/?49053. I maintain a
homebrew-formula for the outdated sundials27.

Seb.



--
Sent from: http://octave.1599824.n4.nabble.com/Octave-Maintainers-f1638794.html


-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Carlo de Falco-2


> On 7 Feb 2018, at 09:17, Sebastian Schöps <[hidden email]> wrote:
>
> Carlo de Falco-2 wrote
>> Apart from preventing even the root user from writing into some system
>> As I have some libraries installed outside standard paths (namely
>> sundials)
>
> I have no issues with homebrew and non-standard paths, it even works for the
> Octave.app ("/Application/..."). Not sure why it fails for you. Standard
> homebrew installs its files into "/usr/local/opt/". Cou could try to put
> your stuff there? (You do not use homebrew and macports is not using this
> directory as far as I recall).
>
> Or you move to homebrew altogether... you find Ben's configure script (file
> #42932) at https://savannah.gnu.org/bugs/?49053. I maintain a
> homebrew-formula for the outdated sundials27.
>
> Seb.
>

Hi,

Actually, my practical problem is already solved, macports deals OK
with nonstandard paths and includes a port named sundials2 that installs
sundials 2.7.0.

So this question is really about understanding how to fix the same problem
outside a package manager. From my previous email you may have noted that
all macports libraries are linked in with full path names but the ones I
list in LDFLAGS are not.

Would it be possible to get the FULL configure options used by the homebrew
build process? For example can you save the config.log file produced by the
configure step?

c.













-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------
Reply | Threaded
Open this post in threaded view
|

Re: macos SIP and make check

Carlo de Falco-3
In reply to this post by Carlo de Falco-2


> On 8 Feb 2018, at 16:30, Sebastian Schöps <[hidden email]> wrote:
>
>> Would it be possible to get the FULL configure options used by the homebrew
>> build process? For example can you save the config.log file produced by the
>> configure step?
>
> Sure, please find the file attached!
>
> Seb.

Hi,

I think I found the issue ...
Or rather I found that there is no issue with the way Octave is built, but rather it is a problem with SUNDIALS installation.

For the record, in case it may be of help to someone else, here is what I found:

$ otool -D /opt/local/lib/libsundials_nvecserial.dylib
/opt/local/lib/libsundials_nvecserial.dylib:
/opt/local/lib/libsundials_nvecserial.2.dylib

$ otool -D /opt/sundials/2.7.0/lib/libsundials_nvecserial.dylib
/opt/sundials/2.7.0/lib/libsundials_nvecserial.dylib:
libsundials_nvecserial.2.dylib

so the sundials libraries installed by macports have their install_name set to the
full path while those I installed manually only have the last component in the path.

From what I infer from googling around, it appears install names are considered
relative to DYLD_LIBRARY_PATH while to make them relative to the runtime path they
must be prepended with @rpath. So if I change manually the install names in the shared
libraries to contain full path or to start with @rpath everything works fine:

$ sudo install_name_tool -id "@rpath/libsundials_nvecserial.2.dylib" /opt/sundials/2.7.0/lib/libsundials_nvecserial.2.dylib
$ sudo install_name_tool -id "@rpath/libsundials_ida.2.dylib" /opt/sundials/2.7.0/lib/libsundials_ida.dylib
$ ./run-octave -q
>> test ode15i
PASSES 48 out of 48 tests
>>

All install names in Octave libraries are set to full path so there seems to be nothing to be changed
in the Octave build process.

I just wonder now whether changing the install names for sundials manually is the only way to
go or there is some build option that I can pass to cmake to make this happen automatically.

Thanks to those that helped,
c.











-----------------------------------------
Join us March 12-15 at CERN near Geneva
Switzerland for OctConf 2018.  More info:
https://wiki.octave.org/OctConf_2018
-----------------------------------------