Re: Corrupted files when run as daemon
Martin Zuziak <[email protected]> Mon, 9 May 2005 21:51:02 +0200
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
On Sat, May 07, 2005 at 04:42:41PM +0200, Martin Zuziak wrote: > I usually use linux.intel.libc6.tar.Z but I just tested the glibc-2.2 > version. It detects the eicar.com test virus just fine. I use SuSE with > glibc 2.3. Maybe it doesn't work with SuSE. I start sophie as the target (non-root) user instead of starting as root and just running the children as non- root. This way it works just fine on SuSE. I have also tried on Fedora Core 3. This method also works. But if I start sophie as root and run the children as non-root I get the "File corrupted..." error. This is on Fedora. I would expect the same result on SuSE but haven't tried. When starting as root strace shows this error (from the fork()'ed child): [pid 27498] semop(1048576, 0xbfffbfa0, 1) = -1 EACCES (Permission denied) If I start as the target user I don't get this error. So maybe the problem is with permissions during IPC. That would explain why running the children as root works and possibly why the non-glibc- 2.2 version of sophos works. Because the glibc-2.2 version uses some threading stuff the regular libc6 version doesn't. > The sophie changelog (http://www.vanja.com/tools/sophie/v3/Changes) has > an entry from 29-Apr-2003 about problems with Red Hat and glibc 2.3. It > seems that the problem is with the glibc Red Hat ships. Forget that paragraph. Short circuit in my brain... Martin Zuziak <[email protected]>