{"action":"created","issue":{"url":"https://api.github.com/repos/nylas/N1/issues/929","labels_url":"https://api.github.com/repos/nylas/N1/issues/929/labels{/name}","comments_url":"https://api.github.com/repos/nylas/N1/issues/929/comments","events_url":"https://api.github.com/repos/nylas/N1/issues/929/events","html_url":"https://github.com/nylas/N1/issues/929","id":125588825,"number":929,"title":"Nylas not starting with hardened kernel","user":{"login":"bashok001","id":2344626,"avatar_url":"https://avatars.githubusercontent.com/u/2344626?v=3","gravatar_id":"","url":"https://api.github.com/users/bashok001","html_url":"https://github.com/bashok001","followers_url":"https://api.github.com/users/bashok001/followers","following_url":"https://api.github.com/users/bashok001/following{/other_user}","gists_url":"https://api.github.com/users/bashok001/gists{/gist_id}","starred_url":"https://api.github.com/users/bashok001/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bashok001/subscriptions","organizations_url":"https://api.github.com/users/bashok001/orgs","repos_url":"https://api.github.com/users/bashok001/repos","events_url":"https://api.github.com/users/bashok001/events{/privacy}","received_events_url":"https://api.github.com/users/bashok001/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nylas/N1/labels/platform-linux","name":"platform-linux","color":"207de5"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2016-01-08T11:02:40Z","updated_at":"2016-01-11T02:27:57Z","closed_at":null,"body":"I have been using N1 on my linux machine for about 6 weeks now. I have recently introduced hardened kernel and found out that there is anonymous mapping issue in N1. Found it with grsecurity patches. `dmesg` will have a message like the following:\r\n\r\n```\r\n[  403.207974] grsec: denied RWX mmap of <anonymous mapping> by /usr/share/nylas/nylas[nylas:1772] uid/euid:1000/1000 gid/egid:100/100, parent /usr/lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0\r\n```\r\n\r\n**N1 won't start when this is happening. For me, this is a showstopper bug.**\r\n\r\nFor reference, this means that there's a memory mapping created that has read-write-execute on it. Should be read-execute or read-write.\r\n\r\nAs a temporary fix for this, run `sudo setfattr -n user.pax.flags -v \"m\" /usr/share/nylas/nylas` . N1 will resume working but it would be nice to figure out the root cause as this potentially can result in anonymous command execution and privilege escalation.\r\n\r\nRevert temporary fix: `sudo setfattr -x user.pax.flags /usr/share/nylas/nylas`  "},"comment":{"url":"https://api.github.com/repos/nylas/N1/issues/comments/170418427","html_url":"https://github.com/nylas/N1/issues/929#issuecomment-170418427","issue_url":"https://api.github.com/repos/nylas/N1/issues/929","id":170418427,"user":{"login":"bashok001","id":2344626,"avatar_url":"https://avatars.githubusercontent.com/u/2344626?v=3","gravatar_id":"","url":"https://api.github.com/users/bashok001","html_url":"https://github.com/bashok001","followers_url":"https://api.github.com/users/bashok001/followers","following_url":"https://api.github.com/users/bashok001/following{/other_user}","gists_url":"https://api.github.com/users/bashok001/gists{/gist_id}","starred_url":"https://api.github.com/users/bashok001/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bashok001/subscriptions","organizations_url":"https://api.github.com/users/bashok001/orgs","repos_url":"https://api.github.com/users/bashok001/repos","events_url":"https://api.github.com/users/bashok001/events{/privacy}","received_events_url":"https://api.github.com/users/bashok001/received_events","type":"User","site_admin":false},"created_at":"2016-01-11T02:27:57Z","updated_at":"2016-01-11T02:27:57Z","body":"Sorry. My bad. Chromium also has `m`. I misread `conf`. So, my question still stays on how turning `m` on by user defined flags on nylas makes it work. I am on Arch Linux with `4.3.3.201601051958-1-grsec` kernel."}}