Re: Re: sophie under Solaris doesn't work with Sophos ver. 3.92
Alain Fauconnet <[email protected]> Wed, 30 Mar 2005 17:08:19 +0700
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Mar 30, 2005 at 10:50:46AM +0200, Andrzej Marecki wrote:
> Alain Fauconnet wrote:
>
> > Which version of Solaris, on what hardware?
>
> 2.6 on Sparc Ultra-2.
>
> > Have you tried running Sophie with debug on, in foreground
> > (non-daemon) mode? ("sophie -d")
>
> Yes.
>
> > Any error message?
>
> Here's a piece of the log pertinent to the critical event. Let me reiterate
> that the final result of the abnormal operation of sophie with the latest
> version of libsavi.so (3.92) for Solaris is that the socket file disappears
> and so any further analyses are not possible.
>
> NOTICE : accept() set, scan type [1] /DEBUG,3470/
> NOTICE : fork()ed a child - everything seems ok /DEBUG,3470/
> NOTICE : Current PROC_COUNT is '0' /DEBUG,3541/
> NOTICE : Successful setgid() to '70' /DEBUG,3541/
> NOTICE : Successful setuid() to '70' /DEBUG,3541/
> NOTICE : Cleared buf using memset() /DEBUG,3541/
> NOTICE : read 49 bytes from socket /DEBUG,3541/
> NOTICE : Read: '/var/spool/MIMEDefang/mdefang-j2TDKNlc017877/Work' /DEBUG,3541/
> NOTICE : Scanning file '/var/spool/MIMEDefang/mdefang-j2TDKNlc017877/Work/msg-3505-2.virus' /DEBUG,3541/
> NOTICE : SIGNAL '11' caught - cleaning up and exiting.
It has segfaulted. Now if you want to make any progress, you'd have to
run it under gdb to find where and why.
For this, you need a debuggable executable.
Edit the Makefile in your Sophie source tree manually
to compile it with '-g', no optimization and not stripping the
executable file. If you don't know how to do this, post the two
lines of your Makefiles setting CFLAGS and LDFLAGS.
I don't have a Solaris box at hand to test (much less 2.6!)
If you can generate a debug executable, run it under gdb:
$ gdb ./sophie
(gdb) run -d
When Sophie segfaults, you will be thrown to the gdb prompt again.
Here, type:
(gdb) bt
and post the output.
Of course, if the segfault occurs in libsavi itself, which I fear, it
won't tell us much...
Greets,
_Alain_