Gentoo Archives: gentoo-hardened

From: "Anthony G. Basile" <blueness@g.o>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] UDEREF vs. Apache MMAP
Date: Sat, 08 Jan 2011 14:08:08
Message-Id: 4D2862D0.9050407@gentoo.org
In Reply to: [gentoo-hardened] UDEREF vs. Apache MMAP by Michael Orlitzky
1 On 01/07/2011 11:57 PM, Michael Orlitzky wrote:
2 > I was able to figure out my new apache problem. It seems that
3 > PAX_MEMORY_UDEREF and apache's EnableMMAP directive don't get along
4 > sometimes:
5 >
6 > http://httpd.apache.org/docs/2.2/mod/core.html#enablemmap
7 >
8 > With UDEREF enabled and MMAP on, I get random inappropriate 206 response
9 > codes everywhere causing headers, images, and CSS files to fail to
10 > transfer properly.
11 >
12 > This is sufficiently into the realm of what I consider voodoo. Is there
13 > anything I can do to help narrow down the problem, or should I just
14 > disable MMAP and be happy?
15
16 It sounds like a problem in the way apache is doing the mmap and PaX is
17 killing it. The new stricter PaX rules don't allow the permission of
18 allocated pages to be changed, eg RW -> RX, or to be RWX. This has come
19 up elsewhere, see
20
21 http://bugs.gentoo.org/show_bug.cgi?id=329499
22
23 To verify my suspicion, an strace would be helpful. If you don't mind,
24 open up a bug with your findings, give your emerge --info, the flags you
25 used with apache, and an strace of apache going bad. This will be a
26 start for us.
27
28 --
29 Anthony G. Basile, Ph.D.
30 Gentoo Developer