Re: Release of Sophie v3.04

Chris Stromsoe <[email protected]> Fri, 3 Jun 2005 08:39:32 -0700 (PDT)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Thu, 2 Jun 2005, Chris Stromsoe wrote:

> On Wed, 1 Jun 2005, Richard Baldry wrote:
>
>> Sophos have confirmed that they will not be reversing the changes that 
>> caused SAVI to report files as corrupt when scanned by Sophie in daemon 
>> mode. This was due to the introduction of new semaphores to enhance 
>> thread safety around the engine. If you want to continue using the 
>> latest versions of Sophos Anti-Virus with Sophie v3.x you will need to 
>> upgrade to v3.04 soon.
>
> Running sophie 3.04 with Sophos SAVI 3.94 for glibc 2.2, I'm seeing 
> "Error: File corrupted, Sophie could not proceed." logged.  After 
> starting, sophie scanned ~80 messages normally.  One of the children 
> segfaulted.  No scan completed successfully afterward.  sophie is 
> running under a non-root uid. Switching back to 3.04rc2 and SAVI 3.92 
> brought things back to normal.

Immediately before the messages start getting logged, sophie is logging:

Jun  2 21:43:33 sophie[23435]: NOTICE           : SIGNAL '11' caught - cleaning up and exiting.
Jun  2 21:43:34 sophie[23435]: NOTICE           : pSAVI cleaned up and released/terminated

23435 was one of the children.

Last August I wrote a patch against 3.04rc2 that fixed issues where a 
child would segfault and sig_exit() would get called.  It looks like it 
was not rolled into 3.04.  I've attached an updated version.  The patch 
avoids calling sophie_end() in sig_exit() if called from a child.  It's 
been running for about 8 hours and the problems I was seeing have 
disapeared.  I'm still getting occasional 'Error: File corrupted...' 
entries logged, but not over and over and scanning still works after they 
happen.



-Chris

_______________________________________________
vtools mailing list
[email protected]
http://www.vanja.com/list/listinfo.cgi/vtools
sophie.c.diff.2 (text/plain, 1.2 KB)
--- sophie.c.orig	Tue May 31 16:08:14 2005
+++ sophie.c	Fri Jun  3 01:08:01 2005
@@ -39,6 +39,8 @@
 	NULL
 };
 
+static int child = -1;
+
 /* Configuration file */
 char config_file[MAXPATHLEN];
 
@@ -112,6 +114,12 @@
 /* Cleanup and exit */
 void sig_exit(int sig)
 {
+	if (child == 0) {
+		sophie_print(1, "%s SIGNAL '%d' caught by the child, ignoring",
+			NOTESTR, sig);
+		return;
+	}
+
 	sophie_print(0, "%s SIGNAL '%d' caught - cleaning up and exiting.", NOTESTR, sig);
 	sophie_end();	
 	exit(0);
@@ -690,16 +698,16 @@
 			sigaddset(&bset, SIGCHLD);
 			sigprocmask(SIG_BLOCK, &bset, NULL);
 
-			cpid = fork();
+			child = fork();
 
-			if (cpid == -1)
+			if (child == -1)
 			{
 				sigprocmask(SIG_UNBLOCK, &bset, NULL);
 				sophie_print(0, "%s fork() failed! [%s]", ERRSTR, strerror(errno));
 				close(msgsock);
 				goto LOOP;
 			}
-			else if (cpid > 0)
+			else if (child > 0)
 			{
 				close(msgsock);
 #ifdef SOPHIE_NET
@@ -710,7 +718,7 @@
 				sophie_print(1, "%s fork()ed a child - everything seems ok", NOTESTR);
 				continue;
 			}
-			else if (cpid == 0)
+			else if (child == 0)
 			{
 				struct sophie_notification notification;
 #ifdef USE_FGETS