Dear Alex, Your one liner triggers the message on my system: "grsec: (atoth:U:/) denied resource overstep by requesting 137445376 for RLIMIT_STACK against limit 8388608 for /bin/pwd[pwd:23459] uid/euid:1000/1000 gid/egid:100/100, parent /bin/bash[bash:23425] uid/euid:1000/1000 gid/egid:100/100"
The only cron job which contains "rm" is rkhunter's daily script. However the message showed up very rarely on my system. And not always with "rm". Since I could find a way to reproduce it, I pushed that issue in the background and stayed there for long until now. To pageexec: I'm reporting the symptom using a 2.6.27-hardened, which is based on 2.6.27.4 and uses grsec-2.1.12-2.6.27.4-200811011834 To Alex: CONFIG_GRKERNSEC_RESLOG is the kernel option IMHO which makes these messages visible. That's why you can't see it with PaX alone. It can be an error how grsec tries to detect limit violations, but there can also be a flaw in the implementation in some userspace component of the system. I usually have some of these while I'm listening to music: grsec: (atoth:U:/usr/bin/audacious) denied resource overstep by requesting 135168 for RLIMIT_MEMLOCK against limit 32768 for /usr/bin/audacious[audacious:24077] uid/euid:1000/1000 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 and usual report about signal 11s for eg. with java while browsing. Of course that RLMIT_MEMLOCK value requested is not so insane like that for perl & pwd. Question is: do you use a hardened toolchain pie-ssp enabled, or a regular? It would be interesting to test it using a non-hardened userland with a grsec-enabled kernel... Regards, Dw. -- dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962 Attila Toth MD, Radiologist in Training, +36-20-825-8057, +36-30-5962-962 On Hét, November 10, 2008 10:24, Alex Efros wrote: > Hi! > > On Mon, Nov 10, 2008 at 07:13:52AM +0100, [EMAIL PROTECTED] wrote: >> It would be good from Alex to provide his recipe for me to try out. > > This one doesn't trigger it on your system? > for i in $(seq 1 10); do perl -e 'exec @ARGV' /bin/pwd; done > Can you show your cron job then? > > -- > WBR, Alex. >
