W dniu 27.08.2014 o 18:34, André Aparício pisze: > I encountered the same problem with qemu/kvm but can't even login, I > get random segfaults and even failed malloc assertions > in /sbin/init, /sbin/rc or /bin/login (never past this). > > But it works fine with CONFIG_PAX_MEMORY_UDEREF disabled.
It looks that disabling CONFIG_PAX_MEMORY_UDEREF solves problem on my host too. > Config that reproduces the problem. > > $ grep -P "(GRK|PAX)" linux-3.15.8-hardened/.config > CONFIG_PAX_KERNEXEC_PLUGIN=y > CONFIG_PAX_PER_CPU_PGD=y > CONFIG_PAX_USERCOPY_SLABS=y > CONFIG_GRKERNSEC=y > CONFIG_GRKERNSEC_CONFIG_AUTO=y > # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set > CONFIG_GRKERNSEC_CONFIG_SERVER=y > # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set > # CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set > CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y > # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set > CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y > # CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set > # CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set > # CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set > CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y > # CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set > # CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF is not set > CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY=y > CONFIG_GRKERNSEC_PROC_GID=10 > CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID=100 > CONFIG_GRKERNSEC_SYMLINKOWN_GID=100 > CONFIG_PAX=y > # CONFIG_PAX_SOFTMODE is not set > CONFIG_PAX_PT_PAX_FLAGS=y > CONFIG_PAX_XATTR_PAX_FLAGS=y > # CONFIG_PAX_NO_ACL_FLAGS is not set > CONFIG_PAX_HAVE_ACL_FLAGS=y > # CONFIG_PAX_HOOK_ACL_FLAGS is not set > CONFIG_PAX_NOEXEC=y > CONFIG_PAX_PAGEEXEC=y > CONFIG_PAX_EMUTRAMP=y > CONFIG_PAX_MPROTECT=y > # CONFIG_PAX_MPROTECT_COMPAT is not set > # CONFIG_PAX_ELFRELOCS is not set > CONFIG_PAX_KERNEXEC=y > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts" > CONFIG_PAX_ASLR=y > # CONFIG_PAX_RANDKSTACK is not set > CONFIG_PAX_RANDUSTACK=y > CONFIG_PAX_RANDMMAP=y > CONFIG_PAX_MEMORY_SANITIZE=y > CONFIG_PAX_MEMORY_STACKLEAK=y > CONFIG_PAX_MEMORY_STRUCTLEAK=y > CONFIG_PAX_MEMORY_UDEREF=y > CONFIG_PAX_REFCOUNT=y > CONFIG_PAX_CONSTIFY_PLUGIN=y > CONFIG_PAX_USERCOPY=y > # CONFIG_PAX_USERCOPY_DEBUG is not set > CONFIG_PAX_SIZE_OVERFLOW=y > CONFIG_PAX_LATENT_ENTROPY=y > CONFIG_GRKERNSEC_KMEM=y > CONFIG_GRKERNSEC_IO=y > CONFIG_GRKERNSEC_PERF_HARDEN=y > CONFIG_GRKERNSEC_RAND_THREADSTACK=y > CONFIG_GRKERNSEC_PROC_MEMMAP=y > CONFIG_GRKERNSEC_KSTACKOVERFLOW=y > CONFIG_GRKERNSEC_BRUTE=y > CONFIG_GRKERNSEC_HIDESYM=y > CONFIG_GRKERNSEC_RANDSTRUCT=y > # CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE is not set > # CONFIG_GRKERNSEC_KERN_LOCKOUT is not set > CONFIG_GRKERNSEC_NO_RBAC=y > CONFIG_GRKERNSEC_ACL_HIDEKERN=y > CONFIG_GRKERNSEC_ACL_MAXTRIES=3 > CONFIG_GRKERNSEC_ACL_TIMEOUT=30 > CONFIG_GRKERNSEC_PROC=y > # CONFIG_GRKERNSEC_PROC_USER is not set > CONFIG_GRKERNSEC_PROC_USERGROUP=y > CONFIG_GRKERNSEC_PROC_ADD=y > CONFIG_GRKERNSEC_LINK=y > CONFIG_GRKERNSEC_SYMLINKOWN=y > CONFIG_GRKERNSEC_FIFO=y > CONFIG_GRKERNSEC_SYSFS_RESTRICT=y > # CONFIG_GRKERNSEC_ROFS is not set > CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y > CONFIG_GRKERNSEC_CHROOT=y > CONFIG_GRKERNSEC_CHROOT_MOUNT=y > CONFIG_GRKERNSEC_CHROOT_DOUBLE=y > CONFIG_GRKERNSEC_CHROOT_PIVOT=y > CONFIG_GRKERNSEC_CHROOT_CHDIR=y > CONFIG_GRKERNSEC_CHROOT_CHMOD=y > CONFIG_GRKERNSEC_CHROOT_FCHDIR=y > CONFIG_GRKERNSEC_CHROOT_MKNOD=y > CONFIG_GRKERNSEC_CHROOT_SHMAT=y > CONFIG_GRKERNSEC_CHROOT_UNIX=y > CONFIG_GRKERNSEC_CHROOT_FINDTASK=y > CONFIG_GRKERNSEC_CHROOT_NICE=y > CONFIG_GRKERNSEC_CHROOT_SYSCTL=y > CONFIG_GRKERNSEC_CHROOT_CAPS=y > # CONFIG_GRKERNSEC_AUDIT_GROUP is not set > CONFIG_GRKERNSEC_EXECLOG=y > CONFIG_GRKERNSEC_RESLOG=y > CONFIG_GRKERNSEC_CHROOT_EXECLOG=y > # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set > # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set > # CONFIG_GRKERNSEC_AUDIT_MOUNT is not set > CONFIG_GRKERNSEC_SIGNAL=y > # CONFIG_GRKERNSEC_FORKFAIL is not set > CONFIG_GRKERNSEC_TIME=y > CONFIG_GRKERNSEC_PROC_IPADDR=y > CONFIG_GRKERNSEC_RWXMAP_LOG=y > CONFIG_GRKERNSEC_DMESG=y > CONFIG_GRKERNSEC_HARDEN_PTRACE=y > CONFIG_GRKERNSEC_PTRACE_READEXEC=y > CONFIG_GRKERNSEC_SETXID=y > CONFIG_GRKERNSEC_HARDEN_IPC=y > CONFIG_GRKERNSEC_TPE=y > # CONFIG_GRKERNSEC_TPE_ALL is not set > # CONFIG_GRKERNSEC_TPE_INVERT is not set > CONFIG_GRKERNSEC_TPE_GID=100 > CONFIG_GRKERNSEC_RANDNET=y > CONFIG_GRKERNSEC_BLACKHOLE=y > CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y > # CONFIG_GRKERNSEC_SOCKET is not set > # CONFIG_GRKERNSEC_SYSCTL is not set > CONFIG_GRKERNSEC_FLOODTIME=10 > CONFIG_GRKERNSEC_FLOODBURST=6 > > On Tue, 26 Aug 2014 11:24:26 +0100 > Marcin Mirosław <[email protected]> wrote: > >> Hello! >> I suspect that I've got problem with hardened-sources in KVM VM. I'm >> not sure if I should fill a bug for this. I'd like to post it here >> before using b.g.o. >> I've got VM (it's KVM with qemu-2.0.0-r1), with >> hardened-sources-3.15.{5-r2,8}. I'm observing a kind of memory >> corruption. After a couple of hours of uptime I'm starting seeing >> random segfaults, general protection traps especially when process >> uses a lot of CPU and do many I/O operations (masscheck scripts >> written in perl for spamassasin rules). >> In log I've got e.g.: >> >> 2014-08-25T13:05:23.243062+02:00 mohikanin kernel: [45571.239703] PAX: >> >From 88.198.102.195: execution attempt in: (null), 00000000-00000000 >> 00000000 >> 2014-08-25T13:05:23.243088+02:00 mohikanin kernel: [45571.239707] PAX: >> terminating task: /usr/libexec/dovecot/pop3-login(pop3-login):2507, >> uid/euid: 105/105, PC: (nil), SP: 000003a8574e4c00 >> 2014-08-25T13:05:23.243093+02:00 mohikanin kernel: [45571.239709] PAX: >> bytes at >> PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? >> 2014-08-25T13:05:23.243095+02:00 mohikanin kernel: [45571.239735] >> PAX: bytes at SP-8: 0000000000000000 0000000000000000 >> 00000059c6deceb0 0000000000000000 00000316027bc540 0000000000000001 >> 000003160271dbb5 0000000000000000 0000000000000000 0000000000000000 >> 0000000000000000 2014-08-25T13:24:42.943001+02:00 mohikanin kernel: >> [46730.931353] traps: spamd child[19681] general protection >> ip:2c572b6e163 sp:3ca7d000be0 error:0 in >> libc-2.19.so[2c572aee000+19e000] 2014-08-25T13:24:42.943007+02:00 >> mohikanin kernel: [46730.931371] grsec: Segmentation fault occurred >> at (nil) in /usr/sbin/spamd[spamd child:19681] >> uid/euid:999/999 gid/egid:100/100, >> parent /usr/sbin/spamd[/usr/sbin/spamd:1255] uid/euid:0/0 >> gid/egid:0/0 2014-08-25T13:55:22.383032+02:00 mohikanin kernel: >> [48570.375917] traps: freshclam[6594] general protection >> ip:344cceb368d sp:3d5f5ced520 error:0 in >> libclamav.so.6.1.23[344ccdf1000+9d1000] >> 2014-08-25T13:55:22.383050+02:00 mohikanin kernel: [48570.375968] >> grsec: Segmentation fault occurred at (nil) >> in /usr/bin/freshclam[freshclam:6594] uid/euid:104/104 >> gid/egid:115/115, parent /usr/bin/freshclam[freshclam:1159] >> uid/euid:104/104 gid/egid:115/115 >> >> Yesterday I switched kernel to gentoo-sources-3.14.14 and I don't see >> any unwanted behavior. This is why I suspect hardened-sources. Should >> I fill a bug? What should I do help find out the root of problem? >> (gcc is: gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4, >> pie-0.5.5) , with ld.gold) >> >> Marcin >> >> # grep -P "(GRK|PAX)" /boot/config-3.15.8-hardened >> CONFIG_PAX_KERNEXEC_PLUGIN=y >> CONFIG_PAX_PER_CPU_PGD=y >> CONFIG_PAX_USERCOPY_SLABS=y >> CONFIG_GRKERNSEC=y >> CONFIG_GRKERNSEC_CONFIG_AUTO=y >> # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set >> CONFIG_GRKERNSEC_CONFIG_SERVER=y >> # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set >> # CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set >> CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y >> # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set >> CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y >> # CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set >> # CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set >> # CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set >> CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y >> # CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set >> CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF=y >> # CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY is not set >> CONFIG_GRKERNSEC_PROC_GID=55555 >> CONFIG_GRKERNSEC_TPE_TRUSTED_GID=55555 >> CONFIG_GRKERNSEC_SYMLINKOWN_GID=100 >> CONFIG_PAX=y >> # CONFIG_PAX_SOFTMODE is not set >> # CONFIG_PAX_PT_PAX_FLAGS is not set >> CONFIG_PAX_XATTR_PAX_FLAGS=y >> # CONFIG_PAX_NO_ACL_FLAGS is not set >> CONFIG_PAX_HAVE_ACL_FLAGS=y >> # CONFIG_PAX_HOOK_ACL_FLAGS is not set >> CONFIG_PAX_NOEXEC=y >> CONFIG_PAX_PAGEEXEC=y >> CONFIG_PAX_EMUTRAMP=y >> CONFIG_PAX_MPROTECT=y >> # CONFIG_PAX_MPROTECT_COMPAT is not set >> # CONFIG_PAX_ELFRELOCS is not set >> CONFIG_PAX_KERNEXEC=y >> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y >> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts" >> CONFIG_PAX_ASLR=y >> CONFIG_PAX_RANDKSTACK=y >> CONFIG_PAX_RANDUSTACK=y >> CONFIG_PAX_RANDMMAP=y >> # CONFIG_PAX_MEMORY_SANITIZE is not set >> CONFIG_PAX_MEMORY_STACKLEAK=y >> CONFIG_PAX_MEMORY_STRUCTLEAK=y >> CONFIG_PAX_MEMORY_UDEREF=y >> CONFIG_PAX_REFCOUNT=y >> CONFIG_PAX_CONSTIFY_PLUGIN=y >> CONFIG_PAX_USERCOPY=y >> # CONFIG_PAX_USERCOPY_DEBUG is not set >> CONFIG_PAX_SIZE_OVERFLOW=y >> CONFIG_PAX_LATENT_ENTROPY=y >> CONFIG_GRKERNSEC_KMEM=y >> CONFIG_GRKERNSEC_IO=y >> CONFIG_GRKERNSEC_JIT_HARDEN=y >> CONFIG_GRKERNSEC_PERF_HARDEN=y >> CONFIG_GRKERNSEC_RAND_THREADSTACK=y >> CONFIG_GRKERNSEC_PROC_MEMMAP=y >> CONFIG_GRKERNSEC_KSTACKOVERFLOW=y >> # CONFIG_GRKERNSEC_BRUTE is not set >> CONFIG_GRKERNSEC_MODHARDEN=y >> CONFIG_GRKERNSEC_HIDESYM=y >> CONFIG_GRKERNSEC_RANDSTRUCT=y >> CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y >> # CONFIG_GRKERNSEC_KERN_LOCKOUT is not set >> CONFIG_GRKERNSEC_NO_RBAC=y >> # CONFIG_GRKERNSEC_ACL_HIDEKERN is not set >> CONFIG_GRKERNSEC_ACL_MAXTRIES=3 >> CONFIG_GRKERNSEC_ACL_TIMEOUT=30 >> CONFIG_GRKERNSEC_PROC=y >> CONFIG_GRKERNSEC_PROC_USER=y >> CONFIG_GRKERNSEC_PROC_ADD=y >> CONFIG_GRKERNSEC_LINK=y >> CONFIG_GRKERNSEC_SYMLINKOWN=y >> CONFIG_GRKERNSEC_FIFO=y >> CONFIG_GRKERNSEC_SYSFS_RESTRICT=y >> # CONFIG_GRKERNSEC_ROFS is not set >> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y >> CONFIG_GRKERNSEC_CHROOT=y >> CONFIG_GRKERNSEC_CHROOT_MOUNT=y >> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y >> CONFIG_GRKERNSEC_CHROOT_PIVOT=y >> CONFIG_GRKERNSEC_CHROOT_CHDIR=y >> CONFIG_GRKERNSEC_CHROOT_CHMOD=y >> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y >> CONFIG_GRKERNSEC_CHROOT_MKNOD=y >> CONFIG_GRKERNSEC_CHROOT_SHMAT=y >> CONFIG_GRKERNSEC_CHROOT_UNIX=y >> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y >> CONFIG_GRKERNSEC_CHROOT_NICE=y >> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y >> CONFIG_GRKERNSEC_CHROOT_CAPS=y >> CONFIG_GRKERNSEC_CHROOT_INITRD=y >> # CONFIG_GRKERNSEC_AUDIT_GROUP is not set >> # CONFIG_GRKERNSEC_EXECLOG is not set >> CONFIG_GRKERNSEC_RESLOG=y >> # CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set >> # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set >> # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set >> CONFIG_GRKERNSEC_AUDIT_MOUNT=y >> CONFIG_GRKERNSEC_SIGNAL=y >> CONFIG_GRKERNSEC_FORKFAIL=y >> CONFIG_GRKERNSEC_TIME=y >> CONFIG_GRKERNSEC_PROC_IPADDR=y >> CONFIG_GRKERNSEC_RWXMAP_LOG=y >> CONFIG_GRKERNSEC_DMESG=y >> CONFIG_GRKERNSEC_HARDEN_PTRACE=y >> CONFIG_GRKERNSEC_PTRACE_READEXEC=y >> CONFIG_GRKERNSEC_SETXID=y >> CONFIG_GRKERNSEC_HARDEN_IPC=y >> CONFIG_GRKERNSEC_TPE=y >> CONFIG_GRKERNSEC_TPE_ALL=y >> CONFIG_GRKERNSEC_TPE_INVERT=y >> CONFIG_GRKERNSEC_TPE_GID=55555 >> CONFIG_GRKERNSEC_RANDNET=y >> CONFIG_GRKERNSEC_BLACKHOLE=y >> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y >> # CONFIG_GRKERNSEC_SOCKET is not set >> CONFIG_GRKERNSEC_SYSCTL=y >> # CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set >> CONFIG_GRKERNSEC_SYSCTL_ON=y >> CONFIG_GRKERNSEC_FLOODTIME=10 >> CONFIG_GRKERNSEC_FLOODBURST=6 >> > > > -- xmpp (jabber): marcin [at] mejor.pl www: http://blog.mejor.pl/
