Re: [gentoo-hardened] what RLIMIT_STACK mean?

[Alex Efros]

Hi!

On Mon, Sep 29, 2008 at 06:10:00PM +0200, Javier Mart?nez wrote:
> PD: to see why the stack growth so much you can only pass  gdb to the
> binary itself, as you can suppose I can't know why it happens to you.

While trying to strace I got smaller example which has same effect - it
generate grsec alert - just like qmail-smtpd, and that happens randomly,
i.e. not on each execution - just like qmail-smtpd.

Below is two executions,

    $ perl -e 'system("strace -p $$ -o pwd.strace.$$ &"); sleep 1; exec @ARGV' /bin/pwd
    Process 4440 attached - interrupt to quit
    /home/powerman
    Process 4440 detached

    $ perl -e 'system("strace -p $$ -o pwd.strace.$$ &"); sleep 1; exec @ARGV' /bin/pwd
    Process 4495 attached - interrupt to quit
    /home/powerman
    Process 4495 detached

and second have generated grsec alert:

    2008-09-29_16:16:39.16191 kern.alert: grsec: denied resource overstep
    by requesting 35188736 for RLIMIT_STACK against limit 8388608 for
    /bin/pwd[pwd:4495] uid/euid:1000/1000 gid/egid:100/100, parent
    /bin/bash[bash:28139] uid/euid:1000/1000 gid/egid:100/100

I've attached both strace logs, but, as far as I see, there nothing
significant there. If you give me an example how to gather important
information using gdb - I'll do it too (I'm Perl programmer and sysadmin
and not familiar with gdb).

-- 
			WBR, Alex.