Gentoo Archives: gentoo-hardened

From: Grant <emailgrant@×××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] miro segfaults when PAX is not in softmode
Date: Fri, 10 Apr 2009 16:18:15
Message-Id: 49bf44f10904100918l70e61364r4c0a23f6800a992f@mail.gmail.com
In Reply to: Re: [gentoo-hardened] miro segfaults when PAX is not in softmode by Matthew Summers
1 >> > >> I use a program called miro a lot, but since upgrading to gcc-4.3.3,
2 >> > >> it segfaults if I don't issue:
3 >> > >
4 >> > > what's the package name? or what ebuild do you use?
5 >> > >
6 >> > >> grsec: signal 11 sent to /usr/bin/miro.real[miro.real:19177]
7 >> > >> uid/euid:1000/1000 gid/egid:100/100, parent /usr/bin/miro[miro:19176]
8 >> > >> uid/euid:1000/1000 gid/egid:100/100
9 >> > >>
10 >> > >> and since miro.real is a python script:
11 >> > >
12 >> > > in that case you have to use paxctl on the python interpreter, not
13 >> > > the script. but before that it's better to find out why it crashes,
14 >> > > so you should produce a coredump and analyze it.
15 >> >
16 >> > Thank you, I ran 'paxctl -m /usr/bin/python' and now miro starts
17 >> > without softmode enabled.  I use the miro ebuild from this bug:
18 >> >
19 >> > http://bugs.gentoo.org/show_bug.cgi?id=131527
20 >> >
21 >> > - Gramt
22 >>
23 >> Don't know what miro is and didn't bother to look at the bug, but removing
24 >> MPROTECT on python is not good.  One alternative might be to write simple
25 >> wrapper in C for miro and paxctl that instead.
26 >>
27 >> Gordon Malm (gengor)
28 >>
29 >
30 > Miro is a slick little IPTV client written mostly in python. It was
31 > previously called democracy player or similar.
32 >
33 > Removing MPROTECT on python is simply the wrong thing to do.
34
35 I've got to run miro on this machine, so I think it's either softmode
36 or removing MPROTECT on python.
37
38 - Grant