[gentoo-amd64] Re: Trying gentoo-sources - getting segfaults

[Duncan]

Mark Knecht <markknecht@×××××.com> posted
5bdc1c8b0901301919q6936d05dj47d5a8a6808fa6bf@××××××××××.com, excerpted
below, on  Fri, 30 Jan 2009 19:19:47 -0800:

> OK, with the radeon driver loaded X isn't crashing when mythfrontend
> completes so that's good. Now, I see radeon loaded as a module but it
> doesn't show up in the lspci command, and I am still seeing a segfault
> on gnome-key-ring:

The gnome-key-ring issue /may/ be due to kernel security capabilities -- 
or the lack of them.  The background is that you don't want your keys 
being able to be retrieved from swap, which means gpg and the various 
keyring apps (like gnome-keyring) need to be able to lock memory in RAM, 
making it unswappable.  Except if every app could do that, it'd mean 
every user could crash the machine by locking huge amounts of memory, so 
traditionally locking like that required root privileges.  But 
unnecessarily running programs as root has its own risks, so security 
capabilities were developed.  If these are compiled into the kernel and 
configured correctly, it allows keyring apps and etc to be allowed only 
very limited security capacities, in this case, the ability to lock a 
limited amount of memory so it doesn't swap, or in the case of 
tcptraceroute and the like, the ability to use "raw" sockets, instead of 
running as root.

So what I'd guess is happening is that you had your kernel configured 
with capabilities before, and gnome-keyring built to use them (this is 
often controlled by USE=capabilities I believe, don't know if gnome-
keyring does it that way or not) but your current kernel isn't configured 
for them, so when gnome-keyring tries to use capabilities to lock memory, 
it fails and segfaults.

Unfortunately I don't know how to configure what apps get what 
capabilities and which don't -- I think it uses extended filesystem 
attributes which I don't have turned on here.  But, in the 2.6.29-rc2+ (I 
run git and update directly from Linus' git tree), the kernel config 
option should be (I think):

Security Options > File POSIX Capabilities

You will likely need either extended attributes or POSIX ACLs turned on 
for whatever filesystem the executable in question is on, as well.  
However, that's really reaching beyond the extent of my knowledge on the 
subject, so that's about all I can venture and that bit is only a guess.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman