Re: [gentoo-hardened] Security Level: high/server/workstation/virtualization

[Alex Efros]

Hi!

On Fri, Jan 27, 2012 at 10:40:43PM +0200, pageexec@××××××××.hu wrote:
> > 2)  When wireshark started by non-root user this option kill all my
> >     processes (https://bugs.gentoo.org/show_bug.cgi?id=379369):
> can you generate a coredump and see what the backtrace shows?

Actually I can't get core. :-/ Look:

I've re-emerged wireshark using this:

# CFLAGS="-march=prescott -O1 -pipe -ggdb" \
  FEATURES="userpriv usersandbox userfetch parallel-fetch nostrip" \
  emerge wireshark

Now:

$ sudo zgrep ELF_CORE /proc/config.gz 
CONFIG_ELF_CORE=y
$ cat /proc/sys/kernel/core_pattern
core
$ grep core /etc/security/limits.conf | grep -v '^#'
*               soft    core            unlimited
$ cat /etc/limits.conf 
*       C20480
$ ulimit -c unlimited
$ ulimit -c
unlimited
$ dumpcap 
Segmentation fault
$ ls -l core
ls: cannot access core: No such file or directory

But under strace core generated ok:

$ strace dumpcap
...
socket(PF_PACKET, SOCK_RAW, 768)        = -1 EPERM (Operation not permitted)
socket(PF_INET, SOCK_PACKET, 0x300 /* IPPROTO_??? */) = -1 EPERM (Operation not permitted)
open("/sys/class/net", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
--- {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x4} (Segmentation fault) ---
+++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)

$ ls -l core 
-rw------- 1 powerman users 446464 Jan 28 00:59 core

$ gdb
(gdb) core core
[New LWP 26950]
Core was generated by `strace dumpcap'.
Program terminated with signal 11, Segmentation fault.
#0  0xa6dda422 in __kernel_vsyscall ()
(gdb) bt
#0  0xa6dda422 in __kernel_vsyscall ()
#1  0xa6c946a6 in ?? ()
#2  0x1f69cd64 in ?? ()
#3  0x1f663179 in ?? ()
#4  0x0000000b in ?? ()
#5  0x00000000 in ?? ()
(gdb)

Here is another way:

$ gdb dumpcap
(gdb) run
Starting program: /usr/bin/dumpcap 

Program received signal SIGSEGV, Segmentation fault.
0xab94e152 in ?? ()
(gdb) bt
#0  0xab94e152 in ?? ()
#1  0xaba4c197 in ?? ()
#2  0xaba4fd99 in ?? ()
#3  0xaba51e37 in ?? ()
#4  0x16f4269d in get_interface_list_findalldevs (err=0xbdaff4a8, err_str=0xbdaff4a4)
    at capture-pcap-util.c:174
#5  0x16f409c0 in get_interface_list (err=0xbdaff4a8, err_str=0xbdaff4a4)
    at capture-pcap-util-unix.c:110
#6  0x16f469d2 in capture_interface_list (err=0xbdaff4a8, err_str=0xbdaff4a4) at dumpcap.c:797
#7  0x16f42345 in capture_opts_trim_iface (capture_opts=0x16f4e060, capture_device=0x0)
    at capture_opts.c:770
#8  0x16f476cd in main (argc=<optimized out>, argv=<optimized out>) at dumpcap.c:3850
(gdb)

Is this enough, or I can do more?

-- 
			WBR, Alex.