Hi!
On Mon, Sep 29, 2008 at 06:10:00PM +0200, Javier Mart?nez wrote:
> PD: to see why the stack growth so much you can only pass gdb to the
> binary itself, as you can suppose I can't know why it happens to you.
While trying to strace I got smaller example which has same effect - it
generate grsec alert - just like qmail-smtpd, and that happens randomly,
i.e. not on each execution - just like qmail-smtpd.
Below is two executions,
$ perl -e 'system("strace -p $$ -o pwd.strace.$$ &"); sleep 1; exec @ARGV'
/bin/pwd
Process 4440 attached - interrupt to quit
/home/powerman
Process 4440 detached
$ perl -e 'system("strace -p $$ -o pwd.strace.$$ &"); sleep 1; exec @ARGV'
/bin/pwd
Process 4495 attached - interrupt to quit
/home/powerman
Process 4495 detached
and second have generated grsec alert:
2008-09-29_16:16:39.16191 kern.alert: grsec: denied resource overstep
by requesting 35188736 for RLIMIT_STACK against limit 8388608 for
/bin/pwd[pwd:4495] uid/euid:1000/1000 gid/egid:100/100, parent
/bin/bash[bash:28139] uid/euid:1000/1000 gid/egid:100/100
I've attached both strace logs, but, as far as I see, there nothing
significant there. If you give me an example how to gather important
information using gdb - I'll do it too (I'm Perl programmer and sysadmin
and not familiar with gdb).
--
WBR, Alex.
restart_syscall(<... resuming interrupted call ...>) = 0
time(NULL) = 1222704996
rt_sigaction(SIGFPE, {SIG_DFL}, {SIG_IGN}, 8) = 0
execve("/bin/pwd", ["/bin/pwd"], [/* 57 vars */]) = 0
brk(0) = 0x105f1114
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=73219, ...}) = 0
mmap2(NULL, 73219, PROT_READ, MAP_PRIVATE, 3, 0) = 0x543f9000
close(3) = 0
open("/lib/libc.so.6", O_RDONLY) = 3
read(3, "[EMAIL PROTECTED]"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1249516, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x543f8000
mmap2(NULL, 1255696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x542c5000
mmap2(0x543f2000, 12288, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12d) = 0x543f2000
mmap2(0x543f5000, 10512, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x543f5000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x542c4000
set_thread_area({entry_number:-1 -> 6, base_addr:0x542c46c0, limit:1048575,
seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0,
useable:1}) = 0
open("/dev/urandom", O_RDONLY) = 3
read(3, "\263\205\37\245", 4) = 4
close(3) = 0
mprotect(0x543f2000, 8192, PROT_READ) = 0
mprotect(0x105ec000, 4096, PROT_READ) = 0
mprotect(0x54426000, 4096, PROT_READ) = 0
munmap(0x543f9000, 73219) = 0
brk(0) = 0x105f1114
brk(0x10612114) = 0x10612114
brk(0x10613000) = 0x10613000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=2684224, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x540c4000
close(3) = 0
getcwd("/home/powerman", 4096) = 15
brk(0x10612000) = 0x10612000
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 8), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x5440a000
write(1, "/home/powerman\n", 15) = 15
close(1) = 0
munmap(0x5440a000, 4096) = 0
close(2) = 0
exit_group(0) = ?
restart_syscall(<... resuming interrupted call ...>) = 0
time(NULL) = 1222704999
rt_sigaction(SIGFPE, {SIG_DFL}, {SIG_IGN}, 8) = 0
execve("/bin/pwd", ["/bin/pwd"], [/* 57 vars */]) = 0
brk(0) = 0x13801194
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=73219, ...}) = 0
mmap2(NULL, 73219, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4a691000
close(3) = 0
open("/lib/libc.so.6", O_RDONLY) = 3
read(3, "[EMAIL PROTECTED]"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1249516, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x4a690000
mmap2(NULL, 1255696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x4a55d000
mmap2(0x4a68a000, 12288, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12d) = 0x4a68a000
mmap2(0x4a68d000, 10512, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4a68d000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x4a55c000
set_thread_area({entry_number:-1 -> 6, base_addr:0x4a55c6c0, limit:1048575,
seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0,
useable:1}) = 0
open("/dev/urandom", O_RDONLY) = 3
read(3, "\347s\367u", 4) = 4
close(3) = 0
mprotect(0x4a68a000, 8192, PROT_READ) = 0
mprotect(0x137f1000, 4096, PROT_READ) = 0
mprotect(0x4a6be000, 4096, PROT_READ) = 0
munmap(0x4a691000, 73219) = 0
brk(0) = 0x13801194
brk(0x13822194) = 0x13822194
brk(0x13823000) = 0x13823000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=2684224, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4a35c000
close(3) = 0
getcwd("/home/powerman", 4096) = 15
brk(0x13822000) = 0x13822000
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 8), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x4a6a2000
write(1, "/home/powerman\n", 15) = 15
close(1) = 0
munmap(0x4a6a2000, 4096) = 0
close(2) = 0
exit_group(0) = ?
