1 |
2014.Június 8.(V) 01:13 időpontban Alex Efros ezt írta: |
2 |
> Hi! |
3 |
> |
4 |
> On Sat, Jun 07, 2014 at 11:48:53PM +0200, "Tóth Attila" wrote: |
5 |
>> > Some time ago I noticed this in kernel logs: |
6 |
>> > kern.alert: grsec: denied RWX mmap of <anonymous mapping> by |
7 |
>> > /usr/lib64/python-exec/python2.7/layman[layman:9717] uid/euid:0/0 |
8 |
>> > gid/egid:0/0, parent /bin/bash[sh:9695] uid/euid:0/0 gid/egid:0/0 |
9 |
>> > Looks like it doesn't break layman, but I still wonder why it happens |
10 |
>> and |
11 |
>> > is it possible to fix this (without paxmarking python, of course)? |
12 |
>> I don't see this in my logs. The python executable has the "E" flag on |
13 |
>> my |
14 |
>> systems. |
15 |
> |
16 |
> I've just re-emerged both pythons, here is flags: |
17 |
> |
18 |
> # paxctl-ng -v /usr/bin/python?.? |
19 |
> /usr/bin/python2.7: |
20 |
> PT_PAX : -e--- |
21 |
> XATTR_PAX : -E--- |
22 |
> |
23 |
> /usr/bin/python3.3: |
24 |
> PT_PAX : -e--- |
25 |
> XATTR_PAX : -E--- |
26 |
> |
27 |
> Next, I've run eix-sync and get this in kernel log: |
28 |
> |
29 |
> 2014-06-07_23:07:50.51597 kern.alert: grsec: denied RWX mmap of <anonymous |
30 |
> mapping> by /usr/lib64/python-exec/python2.7/layman[layman:3854] |
31 |
> uid/euid:0/0 gid/egid:0/0, parent /bin/bash[sh:3830] uid/euid:0/0 |
32 |
> gid/egid:0/0 |
33 |
> 2014-06-07_23:07:50.82796 kern.alert: grsec: denied RWX mmap of <anonymous |
34 |
> mapping> by /usr/bin/python3.3[emerge:3977] uid/euid:0/0 gid/egid:0/0, |
35 |
> parent /bin/bash[sh:3830] uid/euid:0/0 gid/egid:0/0 |
36 |
> 2014-06-07_23:07:56.00097 kern.alert: grsec: denied RWX mmap of <anonymous |
37 |
> mapping> by /usr/bin/python3.3[egencache:4009] uid/euid:0/0 gid/egid:0/0, |
38 |
> parent /bin/bash[sh:3830] uid/euid:0/0 gid/egid:0/0 |
39 |
> 2014-06-07_23:07:56.39894 kern.alert: grsec: denied RWX mmap of <anonymous |
40 |
> mapping> by /usr/bin/python3.3[egencache:4028] uid/euid:0/0 gid/egid:0/0, |
41 |
> parent /bin/bash[sh:3830] uid/euid:0/0 gid/egid:0/0 |
42 |
> |
43 |
> # cat /etc/eix-sync.conf |
44 |
> * |
45 |
> @egencache --repo=powerman --update |
46 |
> @egencache --repo=local --update |
47 |
|
48 |
As you can see, your PT_PAX and XATTR_PAX flags are not consistent. The |
49 |
XATTR_PAX flag holds the correct value, the PT_PAX flag is not OK. |
50 |
|
51 |
Pleas issue the following commands and retry running layman or eix-sync: |
52 |
paxctl-ng -f /usr/bin/python2.7 |
53 |
paxctl-ng -f /usr/bin/python3.3 |
54 |
|
55 |
"-f" sets the PT_PAX field according to the XATTR_PAX flags. |
56 |
|
57 |
How your system behaves in case of inconsistent PAX flags also depends on |
58 |
your kernel configuration. Although the behavior is not as I would expect |
59 |
in my experience. |
60 |
|
61 |
BR: Dw. |
62 |
-- |
63 |
dr Tóth Attila, Radiológus, 06-20-825-8057 |
64 |
Attila Toth MD, Radiologist, +36-20-825-8057 |
65 |
|
66 |
|
67 |
|
68 |
> |
69 |
> -- |
70 |
> WBR, Alex. |
71 |
> |