On Wed, 3 Aug 2022, Matthew Pickering wrote:

Hi Henning, I can't reproduce this error you are seeing. How are you installing the compiler?

I used this archive: https://downloads.haskell.org/ghc/9.4.1-rc1/ghc-9.4.0.20220721-x86_64-deb11-... $ tar xf ghc-9.4.0.20220721-x86_64-deb11-linux.tar.lz $ cd ghc-9.4.0.20220721-x86_64-unknown-linux/ $ ./configure --prefix=/usr/local/ghc-9.4.0 $ sudo make install

GHC should use the in-tree libffi which is the correct version.

Interesting, maybe it is not used because it has wrong permissions, like some other files.

On Wed, 3 Aug 2022, Matthew Pickering wrote:

Hi Henning, which files in particular have the wrong permissions? They look fine on my machine.

$ ls -al /usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/bin/ drwxr-xr-x 2 root root 520 4. Aug 16:19 . drwxr-xr-x 4 root root 80 4. Aug 16:19 .. lrwxrwxrwx 1 root root 18 4. Aug 16:19 ghc -> ghc-9.4.0.20220721 -rwx------ 1 root root 2150120 4. Aug 16:19 ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 28 4. Aug 16:19 ghc-iserv -> ghc-iserv-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 32 4. Aug 16:19 ghc-iserv-dyn -> ghc-iserv-dyn-ghc-9.4.0.20220721 -rwx------ 1 root root 34856 4. Aug 16:19 ghc-iserv-dyn-ghc-9.4.0.20220721 -rwx------ 1 root root 32991032 4. Aug 16:19 ghc-iserv-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 33 4. Aug 16:19 ghc-iserv-prof -> ghc-iserv-prof-ghc-9.4.0.20220721 -rwx------ 1 root root 53225472 4. Aug 16:19 ghc-iserv-prof-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 22 4. Aug 16:19 ghc-pkg -> ghc-pkg-9.4.0.20220721 -rwx------ 1 root root 475864 4. Aug 16:19 ghc-pkg-9.4.0.20220721 lrwxrwxrwx 1 root root 26 4. Aug 16:19 haddock -> haddock-ghc-9.4.0.20220721 -rwx------ 1 root root 5448368 4. Aug 16:19 haddock-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 24 4. Aug 16:19 hp2ps -> hp2ps-ghc-9.4.0.20220721 -rwx------ 1 root root 43696 4. Aug 16:19 hp2ps-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 22 4. Aug 16:19 hpc -> hpc-ghc-9.4.0.20220721 -rwx------ 1 root root 647312 4. Aug 16:19 hpc-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 25 4. Aug 16:19 hsc2hs -> hsc2hs-ghc-9.4.0.20220721 -rwx------ 1 root root 694104 4. Aug 16:19 hsc2hs-ghc-9.4.0.20220721 lrwxrwxrwx 1 root root 21 4. Aug 16:19 runghc -> runghc-9.4.0.20220721 -rwx------ 1 root root 51704 4. Aug 16:19 runghc-9.4.0.20220721 lrwxrwxrwx 1 root root 21 4. Aug 16:19 runhaskell -> runghc-9.4.0.20220721 lrwxrwxrwx 1 root root 21 4. Aug 16:19 runhaskell-9.4.0.20220721 -> runghc-9.4.0.20220721 lrwxrwxrwx 1 root root 24 4. Aug 16:19 unlit -> unlit-ghc-9.4.0.20220721 -rwx------ 1 root root 13248 4. Aug 16:19 unlit-ghc-9.4.0.20220721 $ find /usr/local/ghc-9.4.0/ -iname "libffi*" find: ‘/usr/local/ghc-9.4.0/share/doc/ghc-9.4.0.20220721/html’: no permission find: ‘/usr/local/ghc-9.4.0/share/doc/ghc-9.4.0.20220721/archives’: no permission find: ‘/usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/lib/x86_64-linux-ghc-9.4.0.20220721’: no permission find: ‘/usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/lib/package.conf.d’: no permission find: ‘/usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/lib/latex’: no permission find: ‘/usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/lib/html’: no permission find: ‘/usr/local/ghc-9.4.0/lib/ghc-9.4.0.20220721/lib/bin’: no permission

Ben Gamari writes:

Henning Thielemann writes:

...

On Wed, 3 Aug 2022, Matthew Pickering wrote:

...

Hi Henning, which files in particular have the wrong permissions? They look fine on my machine.

I suspect that the problem is that Hadrian's bindist Makefile is using plain `cp` to copy binaries, etc. into place. This is almost certainly wrong. We should be using either `install` or, at very least, `cp -p`.

I have opened #21965 to track this issue. Cheers, - Ben

Henning Thielemann writes:

On Thu, 4 Aug 2022, Ben Gamari wrote:

...

Henning Thielemann writes:

...

On Wed, 3 Aug 2022, Matthew Pickering wrote:

...

Hi Henning, which files in particular have the wrong permissions? They look fine on my machine.

I suspect that the problem is that Hadrian's bindist Makefile is using plain `cp` to copy binaries, etc. into place. This is almost certainly wrong. We should be using either `install` or, at very least, `cp -p`.

I guess that 'install' is better, yes.

Henning, Could you perhaps try testing the Debian 11 binary distribution from !8763 (specifically, the artifact from [1] when it is finished)? I believe this change will fix your issue. Cheers, - Ben [1] https://gitlab.haskell.org/ghc/ghc/-/jobs/1130855

Henning Thielemann writes:

On Thu, 4 Aug 2022, Ben Gamari wrote:

...

Henning Thielemann writes:

...

I guess that 'install' is better, yes.

Henning,

Could you perhaps try testing the Debian 11 binary distribution from !8763 (specifically, the artifact from [1] when it is finished)? I believe this change will fix your issue.

I downloaded and tested the archive.

The installation from this archive works in the sense that I can run ghc-9.5, but then it looks not right. E.g. most files in

/usr/local/ghc-9.5/lib/ghc-9.5.20220804/lib/

are owned by the private user who unpacked the tarball and ran configure. The permissions are exclusive to this user. Instead, they should belong to 'root' and have read and executable permissions for all users.

Henning, What is the umask in your environment (e.g. just running the `umask` command on the shell will print it). Cheers, - Ben

On Fri, 5 Aug 2022, Ben Gamari wrote:

What is the umask in your environment (e.g. just running the `umask` command on the shell will print it).

The now released GHC-9.4.1-deb11-amd64 bindist correctly generates files for user 'root' and with global read permissions. Except: $ ll /usr/local/ghc-9.4.1/lib/ghc-9.4.1/lib/package.conf.d drwxr-xr-x 1 root root 3356 8. Aug 11:15 . drwxr-xr-x 1 root root 240 8. Aug 11:15 .. -rw------- 1 root root 1666 8. Aug 11:15 array-0.5.4.0.conf -rw------- 1 root root 1666 8. Aug 11:15 array-0.5.4.0.conf.copy -rw------- 1 root root 6344 8. Aug 11:15 base-4.17.0.0.conf -rw------- 1 root root 6344 8. Aug 11:15 base-4.17.0.0.conf.copy -rw------- 1 root root 1897 8. Aug 11:15 binary-0.8.9.1.conf -rw------- 1 root root 1897 8. Aug 11:15 binary-0.8.9.1.conf.copy ... The global read permissions for the *.conf files are missing.

On Mon, 8 Aug 2022, Ben Gamari wrote:

Out of curiosity, have you set umask to 077 intentionally or is this somehow accidental? This does seem like a very strange configuration (although GHC should work nevertheless).

It is set by intention. The configuring user is an unprivileged one. Is this uncommon?

On Mon, 8 Aug 2022, Brandon Allbery wrote:

I think umask addresses a different issue than "unprivileged user". In any case, yes, 077 is fairly uncommon; if you have that much need for privacy then perhaps you should not be using the system in the first place.

Are you the only user on the machine?

On 08/08/2022 15.59, Brandon Allbery wrote:

I think umask addresses a different issue than "unprivileged user". In any case, yes, 077 is fairly uncommon; if you have that much need for privacy then perhaps you should not be using the system in the first place.

Yes and no. It prevents a program which drops privileges (e.g. sshd) at the start from reading arbitrary user files, so if there are post-startup remote vulnerabilities it's unable to exfiltrate all your user data. (Obviously one has to trust the program up to that point, but that's a much smaller attack surface.) I find it a good general practice in terms of Defense in Depth -- especially as it actually really shouldn't cause issues one a single-user system. (It *is* probably uncommon as you say, though. I believe most distros default to 022.) Regards,