Re: [gentoo-hardened] what RLIMIT_STACK mean?

[Kerin Millar]

2008/11/10  <pageexec@××××××××.hu>:
> On 10 Nov 2008 at 7:24, Brian Kroth wrote:
>
>> atoth@××××××××××.hu <atoth@××××××××××.hu> 2008-11-10 12:31:

[snip]

>> grsec: denied resource overstep by requesting 4511036391424 for
>> RLIMIT_STACK against limit 8388608 for /bin/pwd[pwd:18765]
>> uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:18636]
>> uid/euid:1000/1000 gid/egid:1000/1000
>
> now this one definitely looks fishy and spender's looking into it already.

I experience a similar pattern with postfix. Here's a recent excerpt
from my kernel buffer:

[   59.748463] grsec: denied resource overstep by requesting
6014915829760 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:2981] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:2962]
uid/euid:0/0 gid/egid:0/0
[91229.698383] grsec: From 212.183.136.195: denied resource overstep
by requesting 2982265733120 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:15670] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:15663]
uid/euid:0/0 gid/egid:0/0
[91466.615149] grsec: From 212.183.136.195: denied resource overstep
by requesting 7585593999360 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:15876] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:15869]
uid/euid:0/0 gid/egid:0/0
[91852.302529] grsec: From 212.183.136.195: denied resource overstep
by requesting 4286678908928 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:16148] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:16141]
uid/euid:0/0 gid/egid:0/0
[97084.194476] grsec: From 192.168.254.88: denied resource overstep by
requesting 12760106696704 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:18069] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18062]
uid/euid:0/0 gid/egid:0/0
[97084.591375] grsec: From 192.168.254.88: denied resource overstep by
requesting 6147866898432 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:18084] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18076]
uid/euid:0/0 gid/egid:0/0
[97104.279223] grsec: From 192.168.254.88: denied resource overstep by
requesting 3078062882816 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:18183] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18175]
uid/euid:0/0 gid/egid:0/0
[98499.165117] grsec: From 192.168.254.88: denied resource overstep by
requesting 973333118976 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:18685] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18677]
uid/euid:0/0 gid/egid:0/0
[335157.025790] grsec: From 212.183.134.66: denied resource overstep
by requesting 10497186820096 for RLIMIT_STACK against limit 8388608
for /etc/postfix/postfix-script[postfix-script:1557] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:1550]
uid/euid:0/0 gid/egid:0/0
[431086.838131] grsec: From 192.168.254.88: denied resource overstep
by requesting 3096323715072 for RLIMIT_STACK against limit 8388608 for
/etc/postfix/postfix-script[postfix-script:23575] uid/euid:0/0
gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:23568]
uid/euid:0/0 gid/egid:0/0

This has been going on for a long time now. I had assumed that postfix
was to blame and was intending to investigate further at some point
(but, of course, I never did). If there is anything that I can do that
may help to shed light on the matter then please do let me know.

Cheers,

--Kerin