Re: Problem with (?) hardened-sources-3.15.x on kvm-vm

André Aparício <[email protected]>
Newsgroups gmane.linux.gentoo.hardened
Message-ID <[email protected]> 
I encountered the same problem with qemu/kvm but can't even login, I
get random segfaults and even failed malloc assertions
in /sbin/init, /sbin/rc or /bin/login (never past this).

But it works fine with CONFIG_PAX_MEMORY_UDEREF disabled.

Config that reproduces the problem.

$ grep -P "(GRK|PAX)" linux-3.15.8-hardened/.config
CONFIG_PAX_KERNEXEC_PLUGIN=y
CONFIG_PAX_PER_CPU_PGD=y
CONFIG_PAX_USERCOPY_SLABS=y
CONFIG_GRKERNSEC=y
CONFIG_GRKERNSEC_CONFIG_AUTO=y
# CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set
CONFIG_GRKERNSEC_CONFIG_SERVER=y
# CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set
# CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF is not set
CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY=y
CONFIG_GRKERNSEC_PROC_GID=10
CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID=100
CONFIG_GRKERNSEC_SYMLINKOWN_GID=100
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_XATTR_PAX_FLAGS=y
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_EMUTRAMP=y
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_MPROTECT_COMPAT is not set
# CONFIG_PAX_ELFRELOCS is not set
CONFIG_PAX_KERNEXEC=y
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts"
CONFIG_PAX_ASLR=y
# CONFIG_PAX_RANDKSTACK is not set
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_MEMORY_SANITIZE=y
CONFIG_PAX_MEMORY_STACKLEAK=y
CONFIG_PAX_MEMORY_STRUCTLEAK=y
CONFIG_PAX_MEMORY_UDEREF=y
CONFIG_PAX_REFCOUNT=y
CONFIG_PAX_CONSTIFY_PLUGIN=y
CONFIG_PAX_USERCOPY=y
# CONFIG_PAX_USERCOPY_DEBUG is not set
CONFIG_PAX_SIZE_OVERFLOW=y
CONFIG_PAX_LATENT_ENTROPY=y
CONFIG_GRKERNSEC_KMEM=y
CONFIG_GRKERNSEC_IO=y
CONFIG_GRKERNSEC_PERF_HARDEN=y
CONFIG_GRKERNSEC_RAND_THREADSTACK=y
CONFIG_GRKERNSEC_PROC_MEMMAP=y
CONFIG_GRKERNSEC_KSTACKOVERFLOW=y
CONFIG_GRKERNSEC_BRUTE=y
CONFIG_GRKERNSEC_HIDESYM=y
CONFIG_GRKERNSEC_RANDSTRUCT=y
# CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE is not set
# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
CONFIG_GRKERNSEC_NO_RBAC=y
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30
CONFIG_GRKERNSEC_PROC=y
# CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_SYMLINKOWN=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
# CONFIG_GRKERNSEC_ROFS is not set
CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_RESLOG=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
# CONFIG_GRKERNSEC_AUDIT_PTRACE is not set
# CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
# CONFIG_GRKERNSEC_AUDIT_MOUNT is not set
CONFIG_GRKERNSEC_SIGNAL=y
# CONFIG_GRKERNSEC_FORKFAIL is not set
CONFIG_GRKERNSEC_TIME=y
CONFIG_GRKERNSEC_PROC_IPADDR=y
CONFIG_GRKERNSEC_RWXMAP_LOG=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_HARDEN_PTRACE=y
CONFIG_GRKERNSEC_PTRACE_READEXEC=y
CONFIG_GRKERNSEC_SETXID=y
CONFIG_GRKERNSEC_HARDEN_IPC=y
CONFIG_GRKERNSEC_TPE=y
# CONFIG_GRKERNSEC_TPE_ALL is not set
# CONFIG_GRKERNSEC_TPE_INVERT is not set
CONFIG_GRKERNSEC_TPE_GID=100
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_BLACKHOLE=y
CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
# CONFIG_GRKERNSEC_SOCKET is not set
# CONFIG_GRKERNSEC_SYSCTL is not set
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=6

On Tue, 26 Aug 2014 11:24:26 +0100
Marcin Mirosław <[email protected]> wrote:

> Hello!
> I suspect that I've got problem with hardened-sources in KVM VM. I'm
> not sure if I should fill a bug for this. I'd like to post it here
> before using b.g.o.
> I've got VM (it's KVM with qemu-2.0.0-r1), with
> hardened-sources-3.15.{5-r2,8}. I'm observing a kind of memory
> corruption. After a couple of hours of uptime I'm starting seeing
> random segfaults, general protection traps especially when process
> uses a lot of CPU and do many I/O operations (masscheck scripts
> written in perl for spamassasin rules).
> In log I've got e.g.:
> 
> 2014-08-25T13:05:23.243062+02:00 mohikanin kernel: [45571.239703] PAX:
> >From 88.198.102.195: execution attempt in: (null), 00000000-00000000
> 00000000
> 2014-08-25T13:05:23.243088+02:00 mohikanin kernel: [45571.239707] PAX:
> terminating task: /usr/libexec/dovecot/pop3-login(pop3-login):2507,
> uid/euid: 105/105, PC:            (nil), SP: 000003a8574e4c00
> 2014-08-25T13:05:23.243093+02:00 mohikanin kernel: [45571.239709] PAX:
> bytes at
> PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
> 2014-08-25T13:05:23.243095+02:00 mohikanin kernel: [45571.239735]
> PAX: bytes at SP-8: 0000000000000000 0000000000000000
> 00000059c6deceb0 0000000000000000 00000316027bc540 0000000000000001
> 000003160271dbb5 0000000000000000 0000000000000000 0000000000000000
> 0000000000000000 2014-08-25T13:24:42.943001+02:00 mohikanin kernel:
> [46730.931353] traps: spamd child[19681] general protection
> ip:2c572b6e163 sp:3ca7d000be0 error:0 in
> libc-2.19.so[2c572aee000+19e000] 2014-08-25T13:24:42.943007+02:00
> mohikanin kernel: [46730.931371] grsec: Segmentation fault occurred
> at            (nil) in /usr/sbin/spamd[spamd child:19681]
> uid/euid:999/999 gid/egid:100/100,
> parent /usr/sbin/spamd[/usr/sbin/spamd:1255] uid/euid:0/0
> gid/egid:0/0 2014-08-25T13:55:22.383032+02:00 mohikanin kernel:
> [48570.375917] traps: freshclam[6594] general protection
> ip:344cceb368d sp:3d5f5ced520 error:0 in
> libclamav.so.6.1.23[344ccdf1000+9d1000]
> 2014-08-25T13:55:22.383050+02:00 mohikanin kernel: [48570.375968]
> grsec: Segmentation fault occurred at            (nil)
> in /usr/bin/freshclam[freshclam:6594] uid/euid:104/104
> gid/egid:115/115, parent /usr/bin/freshclam[freshclam:1159]
> uid/euid:104/104 gid/egid:115/115
> 
> Yesterday I switched kernel to gentoo-sources-3.14.14 and I don't see
> any unwanted behavior. This is why I suspect hardened-sources. Should
> I fill a bug? What should I do help find out the root of problem?
> (gcc is: gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4,
> pie-0.5.5) , with ld.gold)
> 
> Marcin
> 
> # grep -P "(GRK|PAX)" /boot/config-3.15.8-hardened
> CONFIG_PAX_KERNEXEC_PLUGIN=y
> CONFIG_PAX_PER_CPU_PGD=y
> CONFIG_PAX_USERCOPY_SLABS=y
> CONFIG_GRKERNSEC=y
> CONFIG_GRKERNSEC_CONFIG_AUTO=y
> # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set
> CONFIG_GRKERNSEC_CONFIG_SERVER=y
> # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set
> CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF=y
> # CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY is not set
> CONFIG_GRKERNSEC_PROC_GID=55555
> CONFIG_GRKERNSEC_TPE_TRUSTED_GID=55555
> CONFIG_GRKERNSEC_SYMLINKOWN_GID=100
> CONFIG_PAX=y
> # CONFIG_PAX_SOFTMODE is not set
> # CONFIG_PAX_PT_PAX_FLAGS is not set
> CONFIG_PAX_XATTR_PAX_FLAGS=y
> # CONFIG_PAX_NO_ACL_FLAGS is not set
> CONFIG_PAX_HAVE_ACL_FLAGS=y
> # CONFIG_PAX_HOOK_ACL_FLAGS is not set
> CONFIG_PAX_NOEXEC=y
> CONFIG_PAX_PAGEEXEC=y
> CONFIG_PAX_EMUTRAMP=y
> CONFIG_PAX_MPROTECT=y
> # CONFIG_PAX_MPROTECT_COMPAT is not set
> # CONFIG_PAX_ELFRELOCS is not set
> CONFIG_PAX_KERNEXEC=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts"
> CONFIG_PAX_ASLR=y
> CONFIG_PAX_RANDKSTACK=y
> CONFIG_PAX_RANDUSTACK=y
> CONFIG_PAX_RANDMMAP=y
> # CONFIG_PAX_MEMORY_SANITIZE is not set
> CONFIG_PAX_MEMORY_STACKLEAK=y
> CONFIG_PAX_MEMORY_STRUCTLEAK=y
> CONFIG_PAX_MEMORY_UDEREF=y
> CONFIG_PAX_REFCOUNT=y
> CONFIG_PAX_CONSTIFY_PLUGIN=y
> CONFIG_PAX_USERCOPY=y
> # CONFIG_PAX_USERCOPY_DEBUG is not set
> CONFIG_PAX_SIZE_OVERFLOW=y
> CONFIG_PAX_LATENT_ENTROPY=y
> CONFIG_GRKERNSEC_KMEM=y
> CONFIG_GRKERNSEC_IO=y
> CONFIG_GRKERNSEC_JIT_HARDEN=y
> CONFIG_GRKERNSEC_PERF_HARDEN=y
> CONFIG_GRKERNSEC_RAND_THREADSTACK=y
> CONFIG_GRKERNSEC_PROC_MEMMAP=y
> CONFIG_GRKERNSEC_KSTACKOVERFLOW=y
> # CONFIG_GRKERNSEC_BRUTE is not set
> CONFIG_GRKERNSEC_MODHARDEN=y
> CONFIG_GRKERNSEC_HIDESYM=y
> CONFIG_GRKERNSEC_RANDSTRUCT=y
> CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y
> # CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
> CONFIG_GRKERNSEC_NO_RBAC=y
> # CONFIG_GRKERNSEC_ACL_HIDEKERN is not set
> CONFIG_GRKERNSEC_ACL_MAXTRIES=3
> CONFIG_GRKERNSEC_ACL_TIMEOUT=30
> CONFIG_GRKERNSEC_PROC=y
> CONFIG_GRKERNSEC_PROC_USER=y
> CONFIG_GRKERNSEC_PROC_ADD=y
> CONFIG_GRKERNSEC_LINK=y
> CONFIG_GRKERNSEC_SYMLINKOWN=y
> CONFIG_GRKERNSEC_FIFO=y
> CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
> # CONFIG_GRKERNSEC_ROFS is not set
> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
> CONFIG_GRKERNSEC_CHROOT=y
> CONFIG_GRKERNSEC_CHROOT_MOUNT=y
> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
> CONFIG_GRKERNSEC_CHROOT_PIVOT=y
> CONFIG_GRKERNSEC_CHROOT_CHDIR=y
> CONFIG_GRKERNSEC_CHROOT_CHMOD=y
> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
> CONFIG_GRKERNSEC_CHROOT_MKNOD=y
> CONFIG_GRKERNSEC_CHROOT_SHMAT=y
> CONFIG_GRKERNSEC_CHROOT_UNIX=y
> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
> CONFIG_GRKERNSEC_CHROOT_NICE=y
> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
> CONFIG_GRKERNSEC_CHROOT_CAPS=y
> CONFIG_GRKERNSEC_CHROOT_INITRD=y
> # CONFIG_GRKERNSEC_AUDIT_GROUP is not set
> # CONFIG_GRKERNSEC_EXECLOG is not set
> CONFIG_GRKERNSEC_RESLOG=y
> # CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set
> # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set
> # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
> CONFIG_GRKERNSEC_AUDIT_MOUNT=y
> CONFIG_GRKERNSEC_SIGNAL=y
> CONFIG_GRKERNSEC_FORKFAIL=y
> CONFIG_GRKERNSEC_TIME=y
> CONFIG_GRKERNSEC_PROC_IPADDR=y
> CONFIG_GRKERNSEC_RWXMAP_LOG=y
> CONFIG_GRKERNSEC_DMESG=y
> CONFIG_GRKERNSEC_HARDEN_PTRACE=y
> CONFIG_GRKERNSEC_PTRACE_READEXEC=y
> CONFIG_GRKERNSEC_SETXID=y
> CONFIG_GRKERNSEC_HARDEN_IPC=y
> CONFIG_GRKERNSEC_TPE=y
> CONFIG_GRKERNSEC_TPE_ALL=y
> CONFIG_GRKERNSEC_TPE_INVERT=y
> CONFIG_GRKERNSEC_TPE_GID=55555
> CONFIG_GRKERNSEC_RANDNET=y
> CONFIG_GRKERNSEC_BLACKHOLE=y
> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
> # CONFIG_GRKERNSEC_SOCKET is not set
> CONFIG_GRKERNSEC_SYSCTL=y
> # CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set
> CONFIG_GRKERNSEC_SYSCTL_ON=y
> CONFIG_GRKERNSEC_FLOODTIME=10
> CONFIG_GRKERNSEC_FLOODBURST=6
> 



-- 
André Aparício
andre.aparicio-uH/OstjU21ln3AaRe/[email protected]

Administração de Sistemas da Rede das Novas Licenciaturas
Técnico Lisboa

web: http://www.rnl.tecnico.ulisboa.pt
email: rnl-uH/OstjU21ln3AaRe/[email protected]
telefone: +351 218 41 77 71
signature.asc (application/pgp-signature, 490 B) 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBAgAGBQJT/giPAAoJEN1p2TvJJBrHatYH/2m0YFTBMHAS2FOjVyLFZqsK
KSg8zeaiaAhGzp9o0CtIRx75NiZ6ExrzMvobteto7TvoqWxqDkKUib72cFTHo6zi
kZ3Aq40N3CMOoEOC1F7SNuBwEJbzf8lRPtw92HRkmwVv8n/SUvasSfxYKgVZNAVd
fYdI6tqqvXcDuKtL5+i3hIjCqcWra/7GCizzOukjCDUvnHyQMa7+L70RzPEhD0eC
bTszk/OuCjzbejMItA8yspD+oMDfmTIBprSEjV7Rcoj2KDhXeLTt4p8cStF/SFmW
asf0jFQqTF9pI10g63p4OrTtO4PYPU2CAyX+hifH2gKraF96G9EYCUJNMLtuit4=
=mp9j
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.