Re: Corrupted files when run as daemon

Martin Zuziak <[email protected]> Mon, 9 May 2005 21:51:02 +0200
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Sat, May 07, 2005 at 04:42:41PM +0200, Martin Zuziak wrote:
> I usually use linux.intel.libc6.tar.Z but I just tested the glibc-2.2
> version. It detects the eicar.com test virus just fine. I use SuSE with
> glibc 2.3.

Maybe it doesn't work with SuSE. I start sophie as the target (non-root)
user instead of starting as root and just running the children as non-
root. This way it works just fine on SuSE. I have also tried on Fedora
Core 3. This method also works.

But if I start sophie as root and run the children as non-root I get the
"File corrupted..." error. This is on Fedora. I would expect the same
result on SuSE but haven't tried.

When starting as root strace shows this error (from the fork()'ed
child):

[pid 27498] semop(1048576, 0xbfffbfa0, 1) = -1 EACCES (Permission denied)

If I start as the target user I don't get this error.

So maybe the problem is with permissions during IPC. That would explain
why running the children as root works and possibly why the non-glibc-
2.2 version of sophos works. Because the glibc-2.2 version uses some
threading stuff the regular libc6 version doesn't.

> The sophie changelog (http://www.vanja.com/tools/sophie/v3/Changes) has
> an entry from 29-Apr-2003 about problems with Red Hat and glibc 2.3. It
> seems that the problem is with the glibc Red Hat ships.

Forget that paragraph. Short circuit in my brain...

Martin Zuziak <[email protected]>