# Test "check-security-hardening" FAILED \[SOLVED\]

**URL:** <https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652>\
**Category:** Technical Support\
**Created:** [October 25, 2017, 4:30pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652 "2017-10-25T16:30:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmoussouni](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/mmoussouni/32/7222_2.png) [@mmoussouni](https://forum.zcashcommunity.com/u/mmoussouni)\
**Post date:** [October 25, 2017, 4:30pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/1 "2017-10-25T16:30:33Z")

</div>

Hello,  
While executing tests right after a fresh v1.0.12 install on CentOS7, i get a failed check. Even more worrying that its named “check-security-hardening” :

```
===== BEGIN: /usr/src/zcash/qa/zcash/check-security-hardening.sh
[...]
Checking binary security of [zcashd zcash-cli zcash-tx]...
zcash-cli: failed NX RELRO
zcash-tx: failed NX RELRO
make: *** [check-security] Erreur 1
[...]
===== FAILED: /usr/src/zcash/qa/zcash/check-security-hardening.sh

```

I’ll try to have a look at source code but i’m not an expert at all so i still need help at the moment.

Thanks for helping!

PS: I saw similar but unanswered topic from a year ago : [Check-security-hardening failed](https://forum.zcashcommunity.com/t/check-security-hardening-failed/3625)

---

<div class="post-metadata">

**Author:** ![daira](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/daira/32/43253_2.png) [@daira](https://forum.zcashcommunity.com/u/daira)\
**Post date:** [October 26, 2017, 12:32am UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/2 "2017-10-26T00:32:38Z")

</div>

This is probably [Building on debian with GCC 6 (and/or updated binutils, maybe?) fails during check-security-hardening.sh · Issue #2212 · zcash/zcash · GitHub](https://github.com/zcash/zcash/issues/2212) . Which GCC and binutils versions did you build with?

---

<div class="post-metadata">

**Author:** ![mmoussouni](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/mmoussouni/32/7222_2.png) [@mmoussouni](https://forum.zcashcommunity.com/u/mmoussouni)\
**Post date:** [October 26, 2017, 7:55am UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/3 "2017-10-26T07:55:08Z")

</div>

Versions:

- GCC 4.9.2 20150212 (Red Hat 4.9.2-6) _(gcc -v)_
- GNU ld version 2.24 _(ld -v)_
- GNU assembleur 2.24 […] BFD version 2.24 _(as -v)_

And this is an enlighted version of _yum list installed_ (i tried to remove everything i know was out of topic but let in-scl unknown packages). And yes i use autotools-latest scl with devtoolset-3 to avoid out of date centOS packages.

_scl enable devtoolset-3 ‘scl enable autotools-latest bash’_

```
autoconf.noarch 2.69-11.el7 @base
automake.noarch 1.13.4-3.el7 @base

autotools-latest.x86_64 1-14.el7.centos @praiskup-autotools-epel-7-x86_64
autotools-latest-autoconf.noarch 2.69-4.el7.centos @praiskup-autotools-epel-7-x86_64
autotools-latest-automake.noarch 1.15-4.el7.centos @praiskup-autotools-epel-7-x86_64
autotools-latest-libtool.x86_64 2.4.2-16.el7.centos @praiskup-autotools-epel-7-x86_64
autotools-latest-m4.x86_64 1.4.17-4.el7.centos @praiskup-autotools-epel-7-x86_64
autotools-latest-runtime.x86_64 1-14.el7.centos @praiskup-autotools-epel-7-x86_64

devtoolset-3.x86_64 3.1-12.el7 @centos-sclo-rh
devtoolset-3-binutils.x86_64 2.24-18.el7 @centos-sclo-rh
devtoolset-3-elfutils.x86_64 0.161-1.el7 @centos-sclo-rh
devtoolset-3-elfutils-libelf.x86_64 0.161-1.el7 @centos-sclo-rh
devtoolset-3-elfutils-libs.x86_64 0.161-1.el7 @centos-sclo-rh
devtoolset-3-gcc.x86_64 4.9.2-6.el7 @centos-sclo-rh
devtoolset-3-gcc-c++.x86_64 4.9.2-6.el7 @centos-sclo-rhh
devtoolset-3-gdb.x86_64 7.8.2-38.el7 @centos-sclo-rh
devtoolset-3-icu4j.noarch 1:54.1.1-4.4.el7 @centos-sclo-rh
devtoolset-3-ide.x86_64 3.1-12.el7 @centos-sclo-rhlo-rh
devtoolset-3-libstdc++-devel.x86_64 4.9.2-6.el7 @centos-sclo-rh
devtoolset-3-runtime.x86_64 3.1-12.el7 @centos-sclo-rh
devtoolset-3-toolchain.x86_64 3.1-12.el7 @centos-sclo-rh
devtoolset-3-xmlrpc-client.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh
devtoolset-3-xmlrpc-common.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh
devtoolset-3-xmlrpc-server.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh

```

As i need to go, i’ll have a look later this day on the issue you linked.  
Thanks for the help!

---

<div class="post-metadata">

**Author:** ![daira](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/daira/32/43253_2.png) [@daira](https://forum.zcashcommunity.com/u/daira)\
**Post date:** [October 26, 2017, 10:47am UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/4 "2017-10-26T10:47:00Z")

</div>

Those version numbers aren’t consistent with the current hypothesis about what causes #2212, so it could be an independent problem.

I have another theory: I notice you’re running in a French-language locale, and the script might be too dependent on matching English output from the commands it uses. Can you try running in an English locale to check this?

[Edit: this theory is supported by the fact that in the previous forum post, the script ran in an Italian-language locale.]

---

<div class="post-metadata">

**Author:** ![mmoussouni](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/mmoussouni/32/7222_2.png) [@mmoussouni](https://forum.zcashcommunity.com/u/mmoussouni)\
**Post date:** [October 26, 2017, 5:21pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/5 "2017-10-26T17:21:38Z")

</div>

Hello,

I confirm the “check-security-hardening” test suite is OK using en\_US.utf8 and en\_GB.utf8 locale. It could be a good thing to add in the wiki “User Guide” page to change locale for the testing part: i’ll try to commit a clean edit 🙂.

So now i’m just getting the bitcoin test suite error but as buildbot encouters the same error _(test/rpc\_wallet\_tests.cpp(285): error: in “rpc\_wallet\_tests/rpc\_wallet”: unexpected exception thrown by CallRPC(“getblock 0”))_ i’m not worrying a lot about it.

Thanks for the tip, i didn’t think to this possibility!

---

<div class="post-metadata">

**Author:** ![mmoussouni](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/mmoussouni/32/7222_2.png) [@mmoussouni](https://forum.zcashcommunity.com/u/mmoussouni)\
**Post date:** [October 26, 2017, 6:33pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/6 "2017-10-26T18:33:30Z")

</div>

GitHub issue created to inform devs :

> <https://github.com/zcash/zcash/issues/2691>
>
> \### Issue description
> After clean compilation from source on CentOS7 by followi…ng step-by-step "1.0 User Guide" wiki page, Executing the full test suite on a non-english locale gives some fails while changing local to en\_GB or en\_US, rebooting, relaunching full test suite gives clean output with no error.
> 
> \### Issue is reproductible
> \#### Those steps are all made with the software versions described right below
> \`\`\`bash
> $ git clone https://github.com/zcash/zcash.git
> $ cd zcash/
> $ git checkout v1.0.12
> $ ./zcutil/fetch-params.sh
> 
> $ ./zcutil/build.sh --disable-rust -j 2
> 
> $ ./qa/zcash/full-test-suite.sh
> \`\`\`
> 
> I could reproduce the error with fr\_FR, de\_DE, es\_ES, it\_IT (all used as .utf8 variant)
> 
> \### With en\_US.utf8 or en\_GB.utf8 locale : Partial output
> \`\`\` bash
> ===== BEGIN: /usr/src/zcash/qa/zcash/check-security-hardening.sh
> make: Entering directory \`/usr/src/zcash/src'
> Checking binary security of \[zcashd zcash-cli zcash-tx\]...
> make: Leaving directory \`/usr/src/zcash/src'
> PASS: /usr/src/zcash/src/zcashd has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/zcash-cli has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/zcash-gtest has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/zcash-tx has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/test/test\_bitcoin has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/zcash/GenerateParams has no RPATH or RUNPATH.
> PASS: /usr/src/zcash/src/zcashd has FORTIFY\_SOURCE.
> PASS: /usr/src/zcash/src/zcash-cli has FORTIFY\_SOURCE.
> PASS: /usr/src/zcash/src/zcash-gtest has FORTIFY\_SOURCE.
> PASS: /usr/src/zcash/src/zcash-tx has FORTIFY\_SOURCE.
> PASS: /usr/src/zcash/src/test/test\_bitcoin has FORTIFY\_SOURCE.
> PASS: /usr/src/zcash/src/zcash/GenerateParams has FORTIFY\_SOURCE.
> ===== PASSED: /usr/src/zcash/qa/zcash/check-security-hardening.sh
> \`\`\`
> 
> \### With fr\_FR.utf8 locale : Partial output
> \`\`\` bash
> ===== BEGIN: /usr/src/zcash/qa/zcash/check-security-hardening.sh
> make: Entering directory \`/usr/src/zcash/src'
> Checking binary security of \[zcashd zcash-cli zcash-tx\]...
> zcash-cli: failed NX RELRO
> zcash-tx: failed NX RELRO
> make: \*\*\* \[check-security\] Erreur 1
> make: Leaving directory \`/usr/src/zcash/src'
> ===== FAILED: /usr/src/zcash/qa/zcash/check-security-hardening.sh
> \`\`\`
> 
> \### Build tool versions (Zcashd v1.0.12)
> \`\`\`
> autoconf.noarch 2.69-11.el7 @base
> automake.noarch 1.13.4-3.el7 @base
> 
> autotools-latest.x86\_64 1-14.el7.centos @praiskup-autotools-epel-7-x86\_64
> autotools-latest-autoconf.noarch 2.69-4.el7.centos @praiskup-autotools-epel-7-x86\_64
> autotools-latest-automake.noarch 1.15-4.el7.centos @praiskup-autotools-epel-7-x86\_64
> autotools-latest-libtool.x86\_64 2.4.2-16.el7.centos @praiskup-autotools-epel-7-x86\_64
> autotools-latest-m4.x86\_64 1.4.17-4.el7.centos @praiskup-autotools-epel-7-x86\_64
> autotools-latest-runtime.x86\_64 1-14.el7.centos @praiskup-autotools-epel-7-x86\_64
> 
> devtoolset-3.x86\_64 3.1-12.el7 @centos-sclo-rh
> devtoolset-3-binutils.x86\_64 2.24-18.el7 @centos-sclo-rh
> devtoolset-3-elfutils.x86\_64 0.161-1.el7 @centos-sclo-rh
> devtoolset-3-elfutils-libelf.x86\_64 0.161-1.el7 @centos-sclo-rh
> devtoolset-3-elfutils-libs.x86\_64 0.161-1.el7 @centos-sclo-rh
> devtoolset-3-gcc.x86\_64 4.9.2-6.el7 @centos-sclo-rh
> devtoolset-3-gcc-c++.x86\_64 4.9.2-6.el7 @centos-sclo-rhh
> devtoolset-3-gdb.x86\_64 7.8.2-38.el7 @centos-sclo-rh
> devtoolset-3-icu4j.noarch 1:54.1.1-4.4.el7 @centos-sclo-rh
> devtoolset-3-ide.x86\_64 3.1-12.el7 @centos-sclo-rhlo-rh
> devtoolset-3-libstdc++-devel.x86\_64 4.9.2-6.el7 @centos-sclo-rh
> devtoolset-3-runtime.x86\_64 3.1-12.el7 @centos-sclo-rh
> devtoolset-3-toolchain.x86\_64 3.1-12.el7 @centos-sclo-rh
> devtoolset-3-xmlrpc-client.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh
> devtoolset-3-xmlrpc-common.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh
> devtoolset-3-xmlrpc-server.noarch 1:3.1.3-8.4.el7 @centos-sclo-rh
> \`\`\`
> 
> \### Machine specs:
> \- Virtualization Software : Virtualbox 5.1.30
> \- OS name + version: CentOS Linux release 7.4.1708 (Core) - Hosted on Windows 10
> \- CPU: Physical i5-4430 / Virtual Quad-Threaded
> \- RAM Setup1: Physical 8Go / Virtual 2Go + 25Go swap
> \- RAM Setup2: Physical 8Go / Virtual 5Go + 25Go swap
> \- Disk size: LVM PV 500Go + 20Go / LV 495Go Root + 25 Go Swap
> \- Disk Type (HD/SDD): Physical HDD 7200rpm
> \- Linux kernel version (uname -a): 3.10.0-693.5.2.el7.x86\_64
> \- Compiler version (gcc -version): devtoolset-3-gcc.x86\_64 - 4.9.2-6.el7
> 
> \### Link to forum
> https://forum.z.cash/t/test-check-security-hardening-failed-solved/22652 - My case
> https://forum.z.cash/t/check-security-hardening-failed/3625 - Another case, may be related \*\*(no proof!)\*\*
> 
> \### TODO Proposition
> - If possible, temporarily set locale to en\_US.utf8 (locale used by buildbot) during tests.
> - Else, adapt wiki "1.0-User-Guide.md" and root "doc/unit-tests.md" to precise how to change locale so newcomers won't be destabilized.
> 
> 
> \_PS: Full log file will be attached tomorrow\_

_PS: I can’t edit my own posts, have to make a new one each time…_

---

<div class="post-metadata">

**Author:** ![mtve](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mtve](https://forum.zcashcommunity.com/u/mtve)\
**Post date:** [October 26, 2017, 7:37pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/7 "2017-10-26T19:37:27Z")

</div>

> [@mmoussouni](#):
>
> unexpected exception thrown by CallRPC(“getblock 0”)

would you please try just of curiosity:

```
zcash-cli getblock {anything}

```

i suspect it’s broken regex of centos system gcc.

---

<div class="post-metadata">

**Author:** ![mmoussouni](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/mmoussouni/32/7222_2.png) [@mmoussouni](https://forum.zcashcommunity.com/u/mmoussouni)\
**Post date:** [October 26, 2017, 10:22pm UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/8 "2017-10-26T22:22:49Z")

</div>

> [@mtve](#):
>
> would you please try just of curiosity:
> 
> zcash-cli getblock {anything}
> 
> i suspect it’s broken regex of centos system gcc.

Here is the output (for info, i’m with en\_GB.utf8 local but i guess it’s not coming from here this time) :

```
[root@cryptocurrency zcash]# src/zcash-cli getblock 1000 # In-range
error code: -1
error message:
regex_error
[root@cryptocurrency zcash]# src/zcash-cli getblock 100000 # Out of range
error code: -1
error message:
regex_error

[root@cryptocurrency zcash]# src/zcash-cli getblockchaininfo # Current downloaded blocks
{
  "chain": "main",
  "blocks": 1465,
[...]

```

---

<div class="post-metadata">

**Author:** ![daira](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/daira/32/43253_2.png) [@daira](https://forum.zcashcommunity.com/u/daira)\
**Post date:** [October 27, 2017, 6:52am UTC](https://forum.zcashcommunity.com/t/test-check-security-hardening-failed-solved/22652/9 "2017-10-27T06:52:37Z")

</div>

Please file a separate Github issue for the regex\_error problem, thanks.