# Legato on Generic Linux **URL:** \ **Category:** Legato Application Framework\ **Created:** [April 18, 2017, 11:11pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419 "2017-04-18T23:11:06Z")\ **Posts on this page:** 16\ **Page:** 2
**Author:** ![cholmes](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/cholmes/32/116_2.png) [@cholmes](https://forum.legato.io/u/cholmes)\ **Post date:** [May 9, 2017, 4:09pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/21 "2017-05-09T16:09:26Z")
> I’d be surprised if this is the cause, though, because both supervisor and sdir are running as root (with CAP\_MAC\_ADMIN and CAP\_MAC\_OVERRIDE privileges). There’s nothing in /legato/smack/onlycap right? Correct. /legato/smack/onlycap is empty. ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 11, 2017, 9:22pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/22 "2017-05-11T21:22:48Z")
Thanks, @CoRfr. I’m able to reproduce the problem here. ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 12, 2017, 12:29am UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/23 "2017-05-12T00:29:23Z")
I had some trouble building for the virt target. I grabbed the latest Legato from GitHub using repo, but following the directions you provided, I get the following error: ``` FAILED: /opt/swi/y22/i586-poky-linux-gcc --sysroot=/opt/swi/y22/sysroots/i586-poky-linux -MMD -MF /home/jchitty/legato-repo/legato/build/virt/framework/obj/dir.c.o.d -c /home/jchitty/legato-repo/legato/framework/c/src/dir.c -o /home/jchitty/legato-repo/legato/build/virt/framework/obj/dir.c.o -Wall -fPIC -Werror -O2 -DLE_COMPONENT_NAME=framework -I/home/jchitty/legato-repo/legato/framework/c/inc -DDISABLE_SMACK=0 -DLE_SVCDIR_SERVER_SOCKET_NAME="\"/tmp/legato/serviceDirectoryServer\"" -DLE_SVCDIR_CLIENT_SOCKET_NAME="\"/tmp/legato/serviceDirectoryClient\"" -DLEGATO_EMBEDDED /bin/sh: 1: /opt/swi/y22/i586-poky-linux-gcc: not found ``` I tried setting ``` export VIRT_TOOLCHAIN_DIR=/opt/swi/y22/sysroots/x86_64-pokysdk-linux/usr/bin/i586-poky-linux ``` and this got further, but failed when mksys ran: ``` mksys -t virt -w build/virt/system -o build/virt default.sdef \ --cflags=-O2 ** WARNING: Invalid sysroot returned from compiler '/opt/swi/y22/sysroots/x86_64-pokysdk-linux/usr/bin/i586-poky-linux/i586-poky-linux-gcc' (returned '/not/exist'). [35/658] Running external build step FAILED: CC=/opt/swi/y22/sysroots/x86_64-pokysdk-linux/usr/bin/i586-poky-linux/i586-poky-linux-gcc CXX=/opt/swi/y22/sysroots/x86_64-pokysdk-linux/usr/bin/i586-poky-linux/i586-poky-linux-g++ CFLAGS="-O2 -I build/virt/system -I/home/jchitty/legato-repo/legato/interfaces -I/home/jchitty/legato-repo/legato/framework/c/inc -I. -Iinterfaces/modemServices -Iinterfaces/positioning" CXXFLAGS="-I build/virt/system -I/home/jchitty/legato-repo/legato/interfaces -I/home/jchitty/legato-repo/legato/framework/c/inc -I. -Iinterfaces/modemServices -Iinterfaces/positioning" LDFLAGS="" cd build/virt/system/component/8f7bd0cfe27f5bae6c1fe07c62b7db39; cd /home/jchitty/legato-repo/legato/3rdParty/Lwm2mCore/tinydtls && autoreconf -i /bin/sh: 1: autoreconf: not found [35/658] Compiling C source ninja: build stopped: subcommand failed. Makefile:400: recipe for target 'system_virt' failed make: *** [system_virt] Error 1 ``` It turned out I was missing autoconf and automake from my system (those are not listed in the Legato install/build instructions on [legato.io](http://legato.io)). After installing those, it built. Now to try installing it… ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 12, 2017, 12:56am UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/24 "2017-05-12T00:56:09Z")
Right. Can’t do update or app install because the Legato framework isn’t running. 😖 ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 12, 2017, 2:40am UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/25 "2017-05-12T02:40:23Z")
It definitely seems to be SMACK-related. If I start the serviceDirectory and logCtrlDaemon from the command-line (in that order), then ‘sdir list’ runs fine. I can then start the configTree manually and ‘sdir load’ runs fine. But, if I let the supervisor start the daemons, then ‘sdir list’ can’t connect to the logCtrlDaemon. I looked around for bugs and patches related to sending file descriptors over unix domain sockets and found [this one](https://github.com/ostroproject/ostro-os-xt/issues/43). So I downloaded the kernel sources and had a look. The patch is in the 4.8.12 kernel, so that’s not it. Will keep looking tomorrow. ---
**Author:** ![cholmes](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/cholmes/32/116_2.png) [@cholmes](https://forum.legato.io/u/cholmes)\ **Post date:** [May 12, 2017, 2:52pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/26 "2017-05-12T14:52:29Z")
> [@jchitty](#): > > It definitely seems to be SMACK-related. If I start the serviceDirectory and logCtrlDaemon from the command-line (in that order), then ‘sdir list’ runs fine. I can then start the configTree manually and ‘sdir load’ runs fine. When do you launch the processes this way, what are their smack labels? ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 12, 2017, 10:26pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/27 "2017-05-12T22:26:21Z")
\_ (floor) In this case, they all have the same label. I’ve confirmed that sockets are indeed getting the wrong label. They all seem to be getting ‘\_’, regardless of the label on the process that created them. This appears to be a kernel bug. We can work-around the problem to get the framework and unsandboxed apps working, but sandboxed apps won’t work until the kernel bug is fixed. ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 13, 2017, 12:50am UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/28 "2017-05-13T00:50:35Z")
A workaround to get the framework to start up: ``` echo framework _ rw > /legato/smack/load2 echo _ framework rw > /legato/smack/load2 ``` This is NOT a good final solution, though, because it violates the principal of least privilege. ---
**Author:** ![cholmes](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/cholmes/32/116_2.png) [@cholmes](https://forum.legato.io/u/cholmes)\ **Post date:** [May 15, 2017, 3:50pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/29 "2017-05-15T15:50:04Z")
For now, that will let us move forward with our planning and prototyping. Thank you Sierra for the time and attention to this matter. I know this isn’t a simple problem to track down. ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [May 16, 2017, 6:34pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/30 "2017-05-16T18:34:47Z")
OK, so I think I’ve found the problem. The documentation for this LSM-related stuff is really pretty bad. In 2005, a new Linux-specific socket option flag SO\_PASSSEC and a new ancillary data message SCM\_SECURITY were added (it looks like part of the SELINUX development). This was not documented and remains undocumented and even (in the case of SCM\_SECURITY) unsupported in the libc headers on many modern systems, including this 4.8.12-based Yocto release. But, if this socket option is not set, then passing a file descriptor over that socket will not include the “security context”, which in our case is the SMACK label. The result is that the receiving end doesn’t have the SMACK label that should be attached to the file descriptor it receives, so it defaults to “\_”, which the receiving process is not allowed to write to, so the SMACK security check rejects the received file descriptor. In older kernels, the SMACK security checks for file descriptor passing on unix domain sockets were either not implemented or broken, so our stuff just worked without setting the SO\_PASSSEC flag on the socket. But, at some point quite recently (before kernel 4.8) it was fixed. (Actually, it was broken first, then fixed in December 2015 by [commit 79be093500791cc25cc31bcaec5a4db62e21497b](http://git.yoctoproject.org/cgit/cgit.cgi/linux-yocto-4.6/commit/security/smack/smack_lsm.c?h=standard/intel/base&id=79be093500791cc25cc31bcaec5a4db62e21497b).) Anyway, we now need to make a few changes to to get things working on these newer kernels: - Add SCM\_SECURITY to the standard library headers; - in unixSocket.c, in unixSocket\_CreateSeqPacketUnnamed(), set the SO\_PASSSEC socket option flag; - In unixSocket.c, in ExtractAncillaryData(), handle the SCM\_SECURITY message (just throw it away); - Make the Supervisor add a couple of new SMACK rules: - “framework admin w” - “admin framework w” - Set the extended attribute “security.SMACK64EXEC” to “framework” on all command-line tools bundled with the framework. The good news is that we don’t have to patch the kernel to get this working. Although, we should probably submit a patch to fix the documentation. ---
**Author:** ![cholmes](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/cholmes/32/116_2.png) [@cholmes](https://forum.legato.io/u/cholmes)\ **Post date:** [May 16, 2017, 6:42pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/31 "2017-05-16T18:42:58Z")
Fantastic news! And, an impressive rundown of under-documented features. I’ll be happy to test any new commits on my end, or patch the code together myself for testing. ---
**Author:** ![vipper](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vipper](https://forum.legato.io/u/vipper)\ **Post date:** [May 19, 2017, 3:51pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/32 "2017-05-19T15:51:49Z")
Using this toolchain that cholmes are using I was able to compile legato as virt and generate a squashfs file. However when trying to execute the start file I came across the issue below: sudo: unable to execute ./startSystem: No such file or directory Have you faced it before? ---
**Author:** ![CoRfr](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/corfr/32/69_2.png) [@CoRfr](https://forum.legato.io/u/CoRfr)\ **Post date:** [May 19, 2017, 5:45pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/33 "2017-05-19T17:45:18Z")
The “No such file or directory” can appear if it’s not built for the right architecture. Like if you build for x86 and you execute it on arm it would return that error as well (it’s a bit misleading …). So an advise would to make sure that it builds for the right architecture, with the right toolchain. Note that if you’re building for virt, by default there is that `VIRT_TARGET_ARCH` env variable that controls the target architecture. It takes either arm or x86, and defaults to arm. ---
**Author:** ![vipper](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vipper](https://forum.legato.io/u/vipper)\ **Post date:** [May 20, 2017, 7:10pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/34 "2017-05-20T19:10:26Z")
Even though I’m using the configuration below, I’m still receiving that error. > export VIRT\_TOOLCHAIN\_DIR=/opt/swi/y22/sysroots/x86\_64-pokysdk-linux/usr/bin/i586-poky-linux > export VIRT\_TARGET\_ARCH=x86 > export LEGATO\_SYSROOT=/opt/swi/y22/sysroots/i586-poky-linux ---
**Author:** ![CoRfr](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/corfr/32/69_2.png) [@CoRfr](https://forum.legato.io/u/CoRfr)\ **Post date:** [May 23, 2017, 6:01pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/35 "2017-05-23T18:01:16Z")
That is odd, which version of Legato are you building with? latest? I have this: file build/virt/staging/system/bin/startSystem build/virt/staging/system/bin/startSystem: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=ffa85db5f395fd6ba5664f886feed0b51f7f6be8, not stripped ---
**Author:** ![jchitty](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.legato.io/jchitty/32/72_2.png) [@jchitty](https://forum.legato.io/u/jchitty)\ **Post date:** [July 12, 2017, 7:06pm UTC](https://forum.legato.io/t/legato-on-generic-linux/2419/36 "2017-07-12T19:06:16Z")
Another thing that is needed: In framework/c/src/start/start.c, in the function MakeDir(), change the line ``` le_result_t result = le_dir_Make(dirPath, DEFAULT_PERMS); ``` to ``` le_result_t result = dir_MakeSmack(dirPath, DEFAULT_PERMS, "_"); ``` This ensures that directories created by the start-up program get the correct SMACK label. [Previous page](https://forum.legato.io/t/legato-on-generic-linux/2419.md?page=1)