Re: [gentoo-hardened] cpufreqd-1.1.1 segmentation fault with hardened

[Alexander Gabert]

Barry Dunn wrote:
> Hi, I've converted a recent install to hardened (USE=hardened, changed
> the profile to hardened-x86-2004.0, emerge gcc binutils glibc && emerge
> -e world, using hardened-dev-sources-2.6.7-r3) and now cpufreqd won't
> start, it segfaults every time. I will be using grsec/pax but have
> removed them from the kernel for now, cpufreqd is still the same though.
>
> Guess I need to post a bug report, just thought I'd see if anyone had
> any suggestions first on things to try. There's an strace below fwiw.
>
> Now that flags like -pie and -fstack-protector are deprecated in favour
> of the hardened use flag, can anyone tell me how best to disable
> hardened stuff when compiling particular packages, to work around any
> problem like this? (I confess I'm not too clear on what all the compiler
> options do or how they interrelate... more reading required.)
>
> Anyway, must say the conversion went very smoothly overall, looking
> forward to getting to grips with it all... thank you contributors for
> your time and efforts. :)
>
> Barry
>
>
> strace output:
>
> execve("/usr/sbin/cpufreqd", ["/usr/sbin/cpufreqd"], [/* 31 vars */]) =
> 0 uname({sys="Linux", node="tin", ...})   = 0
> brk(0)                                  = 0x800075e0
> open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or
> directory) open("/etc/ld.so.cache", O_RDONLY)      = 3
> fstat64(3, {st_mode=S_IFREG|0644, st_size=31190, ...}) = 0
> mmap2(NULL, 31190, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40014000
> close(3)                                = 0
> open("/lib/libdl.so.2", O_RDONLY)       = 3
> read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\\\33\0"...,
> 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=10452, ...}) = 0
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0x4001c000 mmap2(NULL, 12072, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3,
> 0) = 0x4001d000 mmap2(0x4001f000, 4096, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_FIXED, 3, 0x1) = 0x4001f000 close(3)
>            = 0 open("/lib/libc.so.6", O_RDONLY)        = 3
> read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0001Y\1\000"...,
> 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1182840, ...}) = 0
> mmap2(NULL, 1103620, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) =
> 0x40020000 mmap2(0x40128000, 12288, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_FIXED, 3, 0x107) = 0x40128000 mmap2(0x4012b000, 9988,
> PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) =
> 0x4012b000 close(3)                                = 0
> munmap(0x40014000, 31190)               = 0
> open("/dev/urandom", O_RDONLY)          = 3
> read(3, "\17;\256\334", 4)              = 4
> close(3)                                = 0
> brk(0)                                  = 0x800075e0
> brk(0x800285e0)                         = 0x800285e0
> brk(0)                                  = 0x800285e0
> brk(0x80029000)                         = 0x80029000
> stat64("/proc/cpufreq", 0xbffff92c)     = -1 ENOENT (No such file or
> directory) stat64("/sys/devices/system/cpu/cpu0/cpufreq",
> {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0 open("/etc/cpufreqd.conf",
> O_RDONLY)    = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1687, ...}) =
> 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0x40014000 read(3, "# cpufreqd.conf\n\n[General]\npidfi"..., 4096)
> = 1687 time([1090190008])                      = 1090190008
> open("/etc/localtime", O_RDONLY)        = 4
> fstat64(4, {st_mode=S_IFREG|0644, st_size=1323, ...}) = 0
> mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
> 0) = 0x40015000 read(4,
> "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\7\0\0\0\7\0"..., 4096) =
> 1323 close(4)                                = 0
> munmap(0x40015000, 4096)                = 0
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> socket(PF_UNIX, SOCK_DGRAM, 0)          = 4
> fcntl64(4, F_SETFD, FD_CLOEXEC)         = 0
> connect(4, {sa_family=AF_UNIX, path="/dev/log"}, 16) = -1 EPROTOTYPE
> (Protocol wrong type for socket) close(4)
> = 0 socket(PF_UNIX, SOCK_STREAM, 0)         = 4
> fcntl64(4, F_SETFD, FD_CLOEXEC)         = 0
> connect(4, {sa_family=AF_UNIX, path="/dev/log"}, 16) = 0
> send(4, "<28>Jul 18 23:33:28 cpufreqd: pa"..., 80, 0) = 80
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> read(3, "", 4096)                       = 0
> close(3)                                = 0
> munmap(0x40014000, 4096)                = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: pa"..., 91, 0) = 91
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: pa"..., 87, 0) = 87
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: pa"..., 84, 0) = 84
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: pa"..., 89, 0) = 89
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: pa"..., 89, 0) = 89
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> geteuid32()                             = 0
> time([1090190008])                      = 1090190008
> rt_sigaction(SIGPIPE, {0x400ceef2, [], 0}, {SIG_DFL}, 8) = 0
> send(4, "<29>Jul 18 23:33:28 cpufreqd: St"..., 52, 0) = 52
> rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0
> rt_sigaction(SIGTERM, {0x800032fa, [HUP INT TERM], 0}, NULL, 8) = 0
> rt_sigaction(SIGINT, {0x8000327c, [HUP INT TERM], 0}, NULL, 8) = 0
> rt_sigaction(SIGHUP, {0x800031fe, [HUP INT TERM], 0}, NULL, 8) = 0
> open("/usr/lib/libsys_acpi.so", O_RDONLY) = 3
> read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\f\0"...,
> 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=10168, ...}) = 0
> mmap2(NULL, 9000, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40014000
> mmap2(0x40016000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3,
> 0x2) = 0x40016000 close(3)                                = 0
> --- SIGSEGV (Segmentation fault) @ 0 (0) ---
> +++ killed by SIGSEGV +++
>
> --
> gentoo-hardened@g.o mailing list
>
please try chpaxing or paxctling it:

chpax -pemsrv or paxctl --help

and then find out which protection needs to be disabled, reenable all 
the others and tell us what thing you had to turn on/off to make it work.

i doubt its the hardened and i assume its some kind of memory access/io 
access that leads it to fail.

thanks,

Alex

-- 
Chaos is just a perceptional disorder of reality.

--
gentoo-hardened@g.o mailing list