Update to fix sophie following SAVI semaphore changes

Richard Baldry <[email protected]> Wed, 18 May 2005 04:10:58 +0000
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
One of my colleagues has developed a patch to sophie 3.04rc2 that
resolves the issue encountered recently where SAVI reports files
as corrupt when sophie is started as root.

The problem has arisen because of some new semaphores that were
added to improve thread safety for the virus data reloading
functionality. These semaphores were, of necessity, created with
relatively restrictive permissions. This means that when sophie
changes to a less privileged id after forking it can no longer
access the semaphore. It's not clear why this returns a 'corrupt'
error, but that's another story.

The patch can be downloaded from 

http://www.clanfield.info/sophie/sophie-semaphore-fix-3.04rc2.patch.gz

This patch changes the way sophie starts up. The main process
now just creates the socket and the pidfile. It then forks a 
new master process under the less privilged uid and gid. This
process creates the SAVI instance and monitors the socket for
connections. The main process just sits and waits for the 
master process to terminate. THis means that you will always see
at least 2 sophie processes running.

If you've experienced the problems, please try the patch and let
me know how you get on.

Note that switching back to the non glibc-2.2 version of SAVI is
not a long-term solution because Sophos will be making the 
same changes to that version next month.

Regards
Rich