Gentoo Archives: gentoo-hardened

From: Alexander Tiurin <alexanderyt@×××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] linux32 chroot issue
Date: Mon, 24 Mar 2014 16:52:29
Message-Id: 533062FB.8010809@gmail.com
In Reply to: Re: [gentoo-hardened] linux32 chroot issue by "Anthony G. Basile"
1 On 27.02.2014 17:31, Anthony G. Basile wrote:
2 > On 02/26/2014 01:09 PM, Alexander Tiurin wrote:
3 >> I tried to reproduce this issue on another hardware (core2quad instead
4 >> core i7). emerge works fine. No errors detected.
5 >> Kernel, kernel config and enviroment is equal.
6 >> That's odd.
7 >>
8 > Okay. Thanks for getting back because I was at a loss to help you. If
9 > you figure out what *is* different let us know.
10 >
11
12 I upgraded kernel up to 3.13.2-hardened-r3, and portage return error:
13
14 ACCESS DENIED mkdir: /var
15 (line 2035 in http://pastebin.com/nsCV06Ca)
16
17
18
19
20 emerge proftp without debug info. Now no errors as ACCESS DENIED
21 /dev/{tty,null}
22
23 >>> Verifying ebuild manifests
24 >>> Emerging (1 of 1) net-ftp/proftpd-1.3.4c
25 >>> Failed to emerge net-ftp/proftpd-1.3.4c, Log file:
26 >>> '/var/log/portage/net-ftp:proftpd-1.3.4c:20140324-160939.log'
27 >>> Jobs: 0 of 1 complete, 1 failed Load avg: 1.59,
28 1.34, 1.46
29 * Package: net-ftp/proftpd-1.3.4c
30 * Repository: gentoo
31 * Maintainer: bernd@×××××××××××.com
32 voyageur@g.o,slyfox@g.o,net-ftp@g.o,proxy-maint@g.o
33 * USE: acl caps elibc_glibc kernel_linux ncurses nls pam pcre
34 tcpd userland_GNU x86
35 * FEATURES: sandbox
36 ACCESS DENIED mkdir: /var
37 install: cannot change permissions of
38 ‘/var/tmp/portage/net-ftp/proftpd-1.3.4c/work’: No such file or directory
39 * ERROR: net-ftp/proftpd-1.3.4c failed (unpack phase):
40 * Failed to create dir '/var/tmp/portage/net-ftp/proftpd-1.3.4c/work'
41 *
42 * Call stack:
43 * ebuild.sh, line 708: Called ebuild_main 'unpack'
44 * phase-functions.sh, line 955: Called dyn_unpack
45 * phase-functions.sh, line 243: Called die
46 * The specific snippet of code:
47 * install -m${PORTAGE_WORKDIR_MODE:-0700} -d "${WORKDIR}"
48 || die "Failed to create dir '${WORKDIR}'"
49 *
50 * If you need support, post the output of `emerge --info
51 '=net-ftp/proftpd-1.3.4c'`,
52 * the complete build log and the output of `emerge -pqv
53 '=net-ftp/proftpd-1.3.4c'`.
54 * The complete build log is located at
55 '/var/log/portage/net-ftp:proftpd-1.3.4c:20140324-160939.log'.
56 * For convenience, a symlink to the build log is located at
57 '/var/tmp/portage/net-ftp/proftpd-1.3.4c/temp/build.log'.
58 * The ebuild environment file is located at
59 '/var/tmp/portage/net-ftp/proftpd-1.3.4c/temp/environment'.
60 * Working directory: '/var/tmp/portage/net-ftp/proftpd-1.3.4c'
61 * S: '/var/tmp/portage/net-ftp/proftpd-1.3.4c/work/proftpd-1.3.4c'
62 --------------------------- ACCESS VIOLATION SUMMARY
63 ---------------------------
64 LOG FILE "/var/log/sandbox/sandbox-13354.log"
65
66 VERSION 1.0
67 FORMAT: F - Function called
68 FORMAT: S - Access Status
69 FORMAT: P - Path as passed to function
70 FORMAT: A - Absolute Path (not canonical)
71 FORMAT: R - Canonical Path
72 FORMAT: C - Command Line
73
74 F: mkdir
75 S: deny
76 P: /var
77 A: /var
78 R: /var
79 C: install -m0700 -d /var tmp/portage/net-ftp/proftpd-1.3.4c/work
80
81
82
83 I changed step by step grsec kernel config options, but it not worked
84 for me. Maybe I missed something.