| 1 |
Hello! |
| 2 |
I suspect that I've got problem with hardened-sources in KVM VM. I'm not |
| 3 |
sure if I should fill a bug for this. I'd like to post it here before |
| 4 |
using b.g.o. |
| 5 |
I've got VM (it's KVM with qemu-2.0.0-r1), with |
| 6 |
hardened-sources-3.15.{5-r2,8}. I'm observing a kind of memory |
| 7 |
corruption. After a couple of hours of uptime I'm starting seeing random |
| 8 |
segfaults, general protection traps especially when process uses a lot |
| 9 |
of CPU and do many I/O operations (masscheck scripts written in perl for |
| 10 |
spamassasin rules). |
| 11 |
In log I've got e.g.: |
| 12 |
|
| 13 |
2014-08-25T13:05:23.243062+02:00 mohikanin kernel: [45571.239703] PAX: |
| 14 |
From 88.198.102.195: execution attempt in: (null), 00000000-00000000 |
| 15 |
00000000 |
| 16 |
2014-08-25T13:05:23.243088+02:00 mohikanin kernel: [45571.239707] PAX: |
| 17 |
terminating task: /usr/libexec/dovecot/pop3-login(pop3-login):2507, |
| 18 |
uid/euid: 105/105, PC: (nil), SP: 000003a8574e4c00 |
| 19 |
2014-08-25T13:05:23.243093+02:00 mohikanin kernel: [45571.239709] PAX: |
| 20 |
bytes at PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? |
| 21 |
2014-08-25T13:05:23.243095+02:00 mohikanin kernel: [45571.239735] PAX: |
| 22 |
bytes at SP-8: 0000000000000000 0000000000000000 00000059c6deceb0 |
| 23 |
0000000000000000 00000316027bc540 0000000000000001 000003160271dbb5 |
| 24 |
0000000000000000 0000000000000000 0000000000000000 0000000000000000 |
| 25 |
2014-08-25T13:24:42.943001+02:00 mohikanin kernel: [46730.931353] traps: |
| 26 |
spamd child[19681] general protection ip:2c572b6e163 sp:3ca7d000be0 |
| 27 |
error:0 in libc-2.19.so[2c572aee000+19e000] |
| 28 |
2014-08-25T13:24:42.943007+02:00 mohikanin kernel: [46730.931371] grsec: |
| 29 |
Segmentation fault occurred at (nil) in /usr/sbin/spamd[spamd |
| 30 |
child:19681] uid/euid:999/999 gid/egid:100/100, parent |
| 31 |
/usr/sbin/spamd[/usr/sbin/spamd:1255] uid/euid:0/0 gid/egid:0/0 |
| 32 |
2014-08-25T13:55:22.383032+02:00 mohikanin kernel: [48570.375917] traps: |
| 33 |
freshclam[6594] general protection ip:344cceb368d sp:3d5f5ced520 error:0 |
| 34 |
in libclamav.so.6.1.23[344ccdf1000+9d1000] |
| 35 |
2014-08-25T13:55:22.383050+02:00 mohikanin kernel: [48570.375968] grsec: |
| 36 |
Segmentation fault occurred at (nil) in |
| 37 |
/usr/bin/freshclam[freshclam:6594] uid/euid:104/104 gid/egid:115/115, |
| 38 |
parent /usr/bin/freshclam[freshclam:1159] uid/euid:104/104 gid/egid:115/115 |
| 39 |
|
| 40 |
Yesterday I switched kernel to gentoo-sources-3.14.14 and I don't see |
| 41 |
any unwanted behavior. This is why I suspect hardened-sources. Should I |
| 42 |
fill a bug? What should I do help find out the root of problem? |
| 43 |
(gcc is: gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4, pie-0.5.5) , |
| 44 |
with ld.gold) |
| 45 |
|
| 46 |
Marcin |
| 47 |
|
| 48 |
# grep -P "(GRK|PAX)" /boot/config-3.15.8-hardened |
| 49 |
CONFIG_PAX_KERNEXEC_PLUGIN=y |
| 50 |
CONFIG_PAX_PER_CPU_PGD=y |
| 51 |
CONFIG_PAX_USERCOPY_SLABS=y |
| 52 |
CONFIG_GRKERNSEC=y |
| 53 |
CONFIG_GRKERNSEC_CONFIG_AUTO=y |
| 54 |
# CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set |
| 55 |
CONFIG_GRKERNSEC_CONFIG_SERVER=y |
| 56 |
# CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set |
| 57 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set |
| 58 |
CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y |
| 59 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set |
| 60 |
CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y |
| 61 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set |
| 62 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set |
| 63 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set |
| 64 |
CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y |
| 65 |
# CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set |
| 66 |
CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF=y |
| 67 |
# CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY is not set |
| 68 |
CONFIG_GRKERNSEC_PROC_GID=55555 |
| 69 |
CONFIG_GRKERNSEC_TPE_TRUSTED_GID=55555 |
| 70 |
CONFIG_GRKERNSEC_SYMLINKOWN_GID=100 |
| 71 |
CONFIG_PAX=y |
| 72 |
# CONFIG_PAX_SOFTMODE is not set |
| 73 |
# CONFIG_PAX_PT_PAX_FLAGS is not set |
| 74 |
CONFIG_PAX_XATTR_PAX_FLAGS=y |
| 75 |
# CONFIG_PAX_NO_ACL_FLAGS is not set |
| 76 |
CONFIG_PAX_HAVE_ACL_FLAGS=y |
| 77 |
# CONFIG_PAX_HOOK_ACL_FLAGS is not set |
| 78 |
CONFIG_PAX_NOEXEC=y |
| 79 |
CONFIG_PAX_PAGEEXEC=y |
| 80 |
CONFIG_PAX_EMUTRAMP=y |
| 81 |
CONFIG_PAX_MPROTECT=y |
| 82 |
# CONFIG_PAX_MPROTECT_COMPAT is not set |
| 83 |
# CONFIG_PAX_ELFRELOCS is not set |
| 84 |
CONFIG_PAX_KERNEXEC=y |
| 85 |
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y |
| 86 |
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts" |
| 87 |
CONFIG_PAX_ASLR=y |
| 88 |
CONFIG_PAX_RANDKSTACK=y |
| 89 |
CONFIG_PAX_RANDUSTACK=y |
| 90 |
CONFIG_PAX_RANDMMAP=y |
| 91 |
# CONFIG_PAX_MEMORY_SANITIZE is not set |
| 92 |
CONFIG_PAX_MEMORY_STACKLEAK=y |
| 93 |
CONFIG_PAX_MEMORY_STRUCTLEAK=y |
| 94 |
CONFIG_PAX_MEMORY_UDEREF=y |
| 95 |
CONFIG_PAX_REFCOUNT=y |
| 96 |
CONFIG_PAX_CONSTIFY_PLUGIN=y |
| 97 |
CONFIG_PAX_USERCOPY=y |
| 98 |
# CONFIG_PAX_USERCOPY_DEBUG is not set |
| 99 |
CONFIG_PAX_SIZE_OVERFLOW=y |
| 100 |
CONFIG_PAX_LATENT_ENTROPY=y |
| 101 |
CONFIG_GRKERNSEC_KMEM=y |
| 102 |
CONFIG_GRKERNSEC_IO=y |
| 103 |
CONFIG_GRKERNSEC_JIT_HARDEN=y |
| 104 |
CONFIG_GRKERNSEC_PERF_HARDEN=y |
| 105 |
CONFIG_GRKERNSEC_RAND_THREADSTACK=y |
| 106 |
CONFIG_GRKERNSEC_PROC_MEMMAP=y |
| 107 |
CONFIG_GRKERNSEC_KSTACKOVERFLOW=y |
| 108 |
# CONFIG_GRKERNSEC_BRUTE is not set |
| 109 |
CONFIG_GRKERNSEC_MODHARDEN=y |
| 110 |
CONFIG_GRKERNSEC_HIDESYM=y |
| 111 |
CONFIG_GRKERNSEC_RANDSTRUCT=y |
| 112 |
CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y |
| 113 |
# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set |
| 114 |
CONFIG_GRKERNSEC_NO_RBAC=y |
| 115 |
# CONFIG_GRKERNSEC_ACL_HIDEKERN is not set |
| 116 |
CONFIG_GRKERNSEC_ACL_MAXTRIES=3 |
| 117 |
CONFIG_GRKERNSEC_ACL_TIMEOUT=30 |
| 118 |
CONFIG_GRKERNSEC_PROC=y |
| 119 |
CONFIG_GRKERNSEC_PROC_USER=y |
| 120 |
CONFIG_GRKERNSEC_PROC_ADD=y |
| 121 |
CONFIG_GRKERNSEC_LINK=y |
| 122 |
CONFIG_GRKERNSEC_SYMLINKOWN=y |
| 123 |
CONFIG_GRKERNSEC_FIFO=y |
| 124 |
CONFIG_GRKERNSEC_SYSFS_RESTRICT=y |
| 125 |
# CONFIG_GRKERNSEC_ROFS is not set |
| 126 |
CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y |
| 127 |
CONFIG_GRKERNSEC_CHROOT=y |
| 128 |
CONFIG_GRKERNSEC_CHROOT_MOUNT=y |
| 129 |
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y |
| 130 |
CONFIG_GRKERNSEC_CHROOT_PIVOT=y |
| 131 |
CONFIG_GRKERNSEC_CHROOT_CHDIR=y |
| 132 |
CONFIG_GRKERNSEC_CHROOT_CHMOD=y |
| 133 |
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y |
| 134 |
CONFIG_GRKERNSEC_CHROOT_MKNOD=y |
| 135 |
CONFIG_GRKERNSEC_CHROOT_SHMAT=y |
| 136 |
CONFIG_GRKERNSEC_CHROOT_UNIX=y |
| 137 |
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y |
| 138 |
CONFIG_GRKERNSEC_CHROOT_NICE=y |
| 139 |
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y |
| 140 |
CONFIG_GRKERNSEC_CHROOT_CAPS=y |
| 141 |
CONFIG_GRKERNSEC_CHROOT_INITRD=y |
| 142 |
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set |
| 143 |
# CONFIG_GRKERNSEC_EXECLOG is not set |
| 144 |
CONFIG_GRKERNSEC_RESLOG=y |
| 145 |
# CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set |
| 146 |
# CONFIG_GRKERNSEC_AUDIT_PTRACE is not set |
| 147 |
# CONFIG_GRKERNSEC_AUDIT_CHDIR is not set |
| 148 |
CONFIG_GRKERNSEC_AUDIT_MOUNT=y |
| 149 |
CONFIG_GRKERNSEC_SIGNAL=y |
| 150 |
CONFIG_GRKERNSEC_FORKFAIL=y |
| 151 |
CONFIG_GRKERNSEC_TIME=y |
| 152 |
CONFIG_GRKERNSEC_PROC_IPADDR=y |
| 153 |
CONFIG_GRKERNSEC_RWXMAP_LOG=y |
| 154 |
CONFIG_GRKERNSEC_DMESG=y |
| 155 |
CONFIG_GRKERNSEC_HARDEN_PTRACE=y |
| 156 |
CONFIG_GRKERNSEC_PTRACE_READEXEC=y |
| 157 |
CONFIG_GRKERNSEC_SETXID=y |
| 158 |
CONFIG_GRKERNSEC_HARDEN_IPC=y |
| 159 |
CONFIG_GRKERNSEC_TPE=y |
| 160 |
CONFIG_GRKERNSEC_TPE_ALL=y |
| 161 |
CONFIG_GRKERNSEC_TPE_INVERT=y |
| 162 |
CONFIG_GRKERNSEC_TPE_GID=55555 |
| 163 |
CONFIG_GRKERNSEC_RANDNET=y |
| 164 |
CONFIG_GRKERNSEC_BLACKHOLE=y |
| 165 |
CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y |
| 166 |
# CONFIG_GRKERNSEC_SOCKET is not set |
| 167 |
CONFIG_GRKERNSEC_SYSCTL=y |
| 168 |
# CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set |
| 169 |
CONFIG_GRKERNSEC_SYSCTL_ON=y |
| 170 |
CONFIG_GRKERNSEC_FLOODTIME=10 |
| 171 |
CONFIG_GRKERNSEC_FLOODBURST=6 |
Archives