[Bug 220892] personality flags like ADDR_NO_RANDOMIZE lost on exec of 32-bit program on 64-bit host.
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=220892
--- Comment #8 from Roland McGrath <roland(a)redhat.com> 2010-06-18 02:55:41 EDT ---
Created an attachment (id=425019)
--> (https://bugzilla.redhat.com/attachment.cgi?id=425019)
systemtap script demonstrating personality and PF_RANDOMIZE state
This is not a personality issue. On kernel-2.6.33.5-124.fc13.x86_64 the
attached stap script shows:
magilla 30 % stap -c ~/redhat/testcases/ADDR_NO_RANDOMIZE-32 pers.stp
"/home/roland/redhat/testcases/ADDR_NO_RANDOMIZE-32"
"/home/roland/redhat/testcases/ADDR_NO_RANDOMIZE-32" "0x555558ac" "check"
"/home/roland/redhat/testcases/ADDR_NO_RANDOMIZE-32" "0" "nonrandom1"
"/home/roland/redhat/testcases/ADDR_NO_RANDOMIZE-32" "0x5d48ac" "nonrandom2"
nonrandom2: Even with ADDR_NO_RANDOMIZE: prev 0x5d48ac vs. now 0x52e8ac
0x402040 (R) execve("/home/roland/redhat/testcases/ADDR_NO_RANDOMIZE-32")
0x402040 (R) kernel.function("flush_old_exec@fs/exec.c:958")
0x40 (!R) kernel.function("flush_old_exec@fs/exec.c:958").return
0x400000 (R) elf_map(0x0, 0x1544) => 0x55555000
0x400000 (R) elf_map(0x55557544, 0x158) => 0x55557000
0x400000 (R) elf_map(0x0, 0x1d944) => 0x55558000
0x400000 (R) elf_map(0x55576c60, 0xbd8) => 0x55576000
0x400000 (R) execve => 0
0x400000 (R) write(1, "\"/home/roland/redhat/testcases/ADDR_NO_RANDO"..., 53)
0x400000 (R) personality(0xffffffff)
0x400000 (R) personality(0x0)
0x400000 (R) execve("/proc/self/exe")
0x400000 (R) kernel.function("flush_old_exec@fs/exec.c:958")
0x0 (!R) kernel.function("flush_old_exec@fs/exec.c:958").return
0x400000 (R) elf_map(0x0, 0x1544) => 0x3e0000
0x400000 (R) elf_map(0x3e2544, 0x158) => 0x3e2000
0x400000 (R) elf_map(0x0, 0x1d944) => 0x401000
0x400000 (R) elf_map(0x41fc60, 0xbd8) => 0x41f000
0x400000 (R) execve => 0
0x402000 (R) write(1, "\"/home/roland/redhat/testcases/ADDR_NO_RANDO"..., 74)
0x402000 (R) personality(0xffffffff)
0x402000 (R) personality(0x40000)
0x402000 (R) execve("/proc/self/exe")
0x402000 (R) kernel.function("flush_old_exec@fs/exec.c:958")
0x0 (!R) kernel.function("flush_old_exec@fs/exec.c:958").return
0x0 (!R) elf_map(0x0, 0x1544) => 0x5d4000
0x0 (!R) elf_map(0x5d6544, 0x158) => 0x5d6000
0x0 (!R) elf_map(0x0, 0x1d944) => 0x3aa000
0x0 (!R) elf_map(0x3c8c60, 0xbd8) => 0x3c8000
0x0 (!R) execve => 0
0x2000 (!R) write(1, "\"/home/roland/redhat/testcases/ADDR_NO_RANDO"..., 70)
0x2000 (!R) personality(0xffffffff)
0x2000 (!R) execve("/proc/self/exe")
0x2000 (!R) kernel.function("flush_old_exec@fs/exec.c:958")
0x0 (!R) kernel.function("flush_old_exec@fs/exec.c:958").return
0x0 (!R) elf_map(0x0, 0x1544) => 0x52e000
0x0 (!R) elf_map(0x530544, 0x158) => 0x530000
0x0 (!R) elf_map(0x0, 0x1d944) => 0x85b000
0x0 (!R) elf_map(0x879c60, 0xbd8) => 0x879000
0x0 (!R) execve => 0
0x2000 (!R) write(1, "\"/home/roland/redhat/testcases/ADDR_NO_RANDO"..., 77)
0x2000 (!R) personality(0xffffffff)
0x2000 (!R) write(2, "nonrandom2: Even with ADDR_NO_RANDOMIZE: prev"..., 72)
magilla 31 %
This shows that the PF_RANDOMIZE flag is cleared, but the mmap innards are
doing randomization anyway.
This does not happen on upstream 2.6.35-rc3. I'll investigate.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
13 years, 10 months
[Bug 459530] Security: Mailman private archives are available to all local users
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=459530
Jan Kaluža <jkaluza(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flag| |needinfo?(hpa(a)zytor.com)
--- Comment #14 from Jan Kaluža <jkaluza(a)redhat.com> 2010-06-17 09:11:53 EDT ---
I'm not sure if I understand it well, but can't it be fixed by changing
"private" directory owner to http server and change mode to o-x?
chown <web-server-user> private
chmod o-x private
I understand that just now it can't be used straightly in packages, because
each http server uses different "user", but that's what upstream advises. If
this fixes that situation I will try to find the way how to achieve it.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
13 years, 10 months