Comment 1 Paul Webster 2010-11-22 10:10:48 EST

Try installing an eclipse from http://download.eclipse.org/eclipse/downloads/ in a directory you have permissions on.  Can you start that up?  If so, that would indicate you are correct, it's the noexec causing you problem.

PW

Comment 2 mono9lith 2010-11-22 21:37:56 EST

(In reply to comment #1)
> Try installing an eclipse from http://download.eclipse.org/eclipse/downloads/
> in a directory you have permissions on.  Can you start that up?  If so, that
> would indicate you are correct, it's the noexec causing you problem.
> 
> PW

The package system just copies it in /usr (see http://repos.archlinux.org/wsvn/packages/eclipse/trunk/PKGBUILD). How can I configure Eclipse to work without using /home and /tmp for executing code?

Comment 3 Paul Webster 2010-11-23 06:57:22 EST

(In reply to comment #2)
> The package system just copies it in /usr (see
> http://repos.archlinux.org/wsvn/packages/eclipse/trunk/PKGBUILD). How can I
> configure Eclipse to work without using /home and /tmp for executing code?

The packaged version is running in multi-user mode.  That means it uses your $HOME/.eclipse for configuration and meta-data storage, including extracting native libraries it needs to run.  If they've configured your home directories with noexec, then it won't work in multi-user mode.

You need  to download your own version from the URL I supplied and untar it in a directory you have write permissions to that does have executable permissions (I use /opt/pwebster, for example).  Then you're running in single user mode, and it won't access your $HOME directory.

PW

Comment 4 mono9lith 2010-11-23 20:50:39 EST

(In reply to comment #3)
> The packaged version is running in multi-user mode.  That means it uses your
> $HOME/.eclipse for configuration and meta-data storage, including extracting
> native libraries it needs to run.  If they've configured your home directories
> with noexec, then it won't work in multi-user mode.
> 
> You need  to download your own version from the URL I supplied and untar it in
> a directory you have write permissions to that does have executable permissions
> (I use /opt/pwebster, for example).  Then you're running in single user mode,
> and it won't access your $HOME directory.
> 
> PW

That means, there is no way to run Eclipse without loss of security? And is the only program that requires both writing and execution rights in same directory. In this case, I think it's a big problem in the application architecture.

Comment 5 Paul Webster 2010-11-24 07:30:19 EST

(In reply to comment #4)
> That means, there is no way to run Eclipse without loss of security? And is the
> only program that requires both writing and execution rights in same directory.
> In this case, I think it's a big problem in the application architecture.

That assumes the problem is what we've asserted in comment #1 ... did you try it out?  Will a vanilla eclipse run from your directory?  Will the same zip run from one of your local directories that doesn't have the noexec?



As for architecture, it does not indicate a problem.  Eclipse is a pluggable, extensible framework.  It's impossible to secure an open ended framework without severely restricting functionality, and that was never one of eclipse's goals.

I've passed this on to the framework guys to see if there is a way around this:

- multi-user mode
- native libs expanded in a $HOME directory
- noexec preventing loading

PW

Comment 6 Paul Webster 2010-11-24 08:01:13 EST

I'll just add that you can specify a configuration area on the command line: -configuration

http://help.eclipse.org/helios/index.jsp?topic=/org.eclipse.platform.doc.isv/reference/misc/runtime-options.html

You could try creating a dirRWX/configuration/config.ini and then launch eclipse with -configuration dirRWX/configuration on a partition that doesn't have noexec

PW

Comment 7 mono9lith 2010-11-24 22:42:57 EST

(In reply to comment #5)
> That assumes the problem is what we've asserted in comment #1 ... did you try
> it out?  Will a vanilla eclipse run from your directory?  Will the same zip run
> from one of your local directories that doesn't have the noexec?
> 
> 
> 
> As for architecture, it does not indicate a problem.  Eclipse is a pluggable,
> extensible framework.  It's impossible to secure an open ended framework
> without severely restricting functionality, and that was never one of eclipse's
> goals.
> 
> I've passed this on to the framework guys to see if there is a way around this:
> 
> - multi-user mode
> - native libs expanded in a $HOME directory
> - noexec preventing loading
> 
> PW

I download "eclipse-SDK-3.6.1-linux-gtk-x86_64.tar.gz" from http://download.eclipse.org/eclipse/downloads/ and untar it in /opt. After run I get the same result ("Could not load SWT library" in log file).

Comment 8 Paul Webster 2010-11-25 07:38:29 EST

(In reply to comment #7)
> 
> I download "eclipse-SDK-3.6.1-linux-gtk-x86_64.tar.gz" from
> http://download.eclipse.org/eclipse/downloads/ and untar it in /opt. After run
> I get the same result ("Could not load SWT library" in log file).

Thanx.  Please attach the log of running this eclipse from /opt  It doesn't sound like a noexec problem.

Are you running on an x86_64 kernel?  Is your JVM 64 bit or 32 bit?

PW

Comment 9 mono9lith 2010-11-25 08:33:30 EST

(In reply to comment #8)
> Thanx.  Please attach the log of running this eclipse from /opt  It doesn't
> sound like a noexec problem.
> 
> Are you running on an x86_64 kernel?  Is your JVM 64 bit or 32 bit?
> 
> PW

Yes, my system is Arch Linux x64 and JVM is openjdk6 6.b20_1.9.1 x64.

log:

!SESSION 2010-11-25 11:31:54.381 -----------------------------------------------
eclipse.buildId=M20100909-0800
java.version=1.6.0_20
java.vendor=Sun Microsystems Inc.
BootLoader constants: OS=linux, ARCH=x86_64, WS=gtk, NL=ru_RU
Command-line arguments:  -os linux -ws gtk -arch x86_64

!ENTRY org.eclipse.osgi 4 0 2010-11-25 11:31:58.257
!MESSAGE Application error
!STACK 1
java.lang.UnsatisfiedLinkError: Could not load SWT library. Reasons: 
	/home/mono/.eclipse/org.eclipse.platform_3.6.1_1473617060/configuration/org.eclipse.osgi/bundles/151/1/.cp/libswt-gtk-3655.so: /home/mono/.eclipse/org.eclipse.platform_3.6.1_1473617060/configuration/org.eclipse.osgi/bundles/151/1/.cp/libswt-gtk-3655.so: сбой отображения сегмента из разделяемого объекта: Операция не позволяется
	no swt-gtk in java.library.path
	Can't load library: /tmp/swtlib-64/libswt-gtk-3655.so
	Can't load library: /tmp/swtlib-64/libswt-gtk.so
	/tmp/swtlib-64/libswt-gtk-3655.so: /tmp/swtlib-64/libswt-gtk-3655.so: сбой отображения сегмента из разделяемого объекта: Операция не позволяется

	at org.eclipse.swt.internal.Library.loadLibrary(Library.java:267)
	at org.eclipse.swt.internal.Library.loadLibrary(Library.java:174)
	at org.eclipse.swt.internal.C.<clinit>(C.java:21)
	at org.eclipse.swt.internal.Converter.wcsToMbcs(Converter.java:63)
	at org.eclipse.swt.internal.Converter.wcsToMbcs(Converter.java:54)
	at org.eclipse.swt.widgets.Display.<clinit>(Display.java:132)
	at org.eclipse.ui.internal.Workbench.createDisplay(Workbench.java:687)
	at org.eclipse.ui.PlatformUI.createDisplay(PlatformUI.java:161)
	at org.eclipse.ui.internal.ide.application.IDEApplication.createDisplay(IDEApplication.java:145)
	at org.eclipse.ui.internal.ide.application.IDEApplication.start(IDEApplication.java:88)
	at org.eclipse.equinox.internal.app.EclipseAppHandle.run(EclipseAppHandle.java:196)
	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.runApplication(EclipseAppLauncher.java:110)
	at org.eclipse.core.runtime.internal.adaptor.EclipseAppLauncher.start(EclipseAppLauncher.java:79)
	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:369)
	at org.eclipse.core.runtime.adaptor.EclipseStarter.run(EclipseStarter.java:179)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:616)
	at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:619)
	at org.eclipse.equinox.launcher.Main.basicRun(Main.java:574)
	at org.eclipse.equinox.launcher.Main.run(Main.java:1407)
	at org.eclipse.equinox.launcher.Main.main(Main.java:1383)

Comment 10 Paul Webster 2010-11-25 08:45:44 EST

(In reply to comment #9)
> log:
> !ENTRY org.eclipse.osgi 4 0 2010-11-25 11:31:58.257
> !MESSAGE Application error
> !STACK 1
> java.lang.UnsatisfiedLinkError: Could not load SWT library. Reasons: 
>    
> /home/mono/.eclipse/org.eclipse.platform_3.6.1_1473617060/configuration/org.eclipse.osgi/bundles/151/1/.cp/libswt-gtk-3655.so:
> /home/mono/.eclipse/org.eclipse.platform_3.6.1_1473617060/configuration/org.eclipse.osgi/bundles/151/1/.cp/libswt-gtk-3655.so:

Did you set it up in multi-user mode?  This is still accessing your home directory, not your /opt directory

PW

Comment 11 mono9lith 2010-11-25 21:19:35 EST

(In reply to comment #10)
> Did you set it up in multi-user mode?  This is still accessing your home
> directory, not your /opt directory
> 
> PW

No, I just untar it in /opt and run eclipse.

Comment 12 Paul Webster 2010-11-29 07:51:19 EST

(In reply to comment #11)
> 
> No, I just untar it in /opt and run eclipse.

What version of gtk do you have installed?

bash$ rpm -q gtk2

Also, try temporarily moving your .eclipse directory to .eclipse_bak so when you run your "/opt/whatever/eclipse/eclipse -data new_workspace" there's nothing there already.

PW

Comment 13 mono9lith 2010-12-02 23:53:13 EST

(In reply to comment #12)
> What version of gtk do you have installed?
> 
> bash$ rpm -q gtk2
> 
> Also, try temporarily moving your .eclipse directory to .eclipse_bak so when
> you run your "/opt/whatever/eclipse/eclipse -data new_workspace" there's
> nothing there already.

gtk2 2.22.1

I have done for your advice, the result is the same. On the Internet I found a way, is to copy the missing libraries in /usr/lib but I think it's a bad way.

I very much hope that shortly there will be a way to run without the use of /home and /tmp to exec. What do you think, does it make sense to make a feature request?

Comment 14 Paul Webster 2010-12-06 09:25:14 EST

(In reply to comment #13)
> > Also, try temporarily moving your .eclipse directory to .eclipse_bak so when
> > you run your "/opt/whatever/eclipse/eclipse -data new_workspace" there's
> > nothing there already.
> 
> gtk2 2.22.1
> 
> I have done for your advice, the result is the same. On the Internet I found a
> way, is to copy the missing libraries in /usr/lib but I think it's a bad way.

How could you get the same result?  unzipping  eclipse-SDK-3.6-linux-gtk.tar.gz in /opt/local/eclipse36 and running /opt/local/eclipse36/eclipse/eclipse will not create anything in your $HOME/.eclipse folder.  Please try again.


> I very much hope that shortly there will be a way to run without the use of
> /home and /tmp to exec. What do you think, does it make sense to make a feature
> request?

Eclipse will always need to extract and run n native libraries.  On the local disk, this doesn't seem to pose a problem.  In multi-user mode, those libraries have to go somewhere, and that means your $HOME dir, /tmp. or some writable user-specified disk that can they can be executed from.

PW