Re: Problem with (?) hardened-sources-3.15.x on kvm-vm

Marcin Mirosław <[email protected]>
Newsgroups gmane.linux.gentoo.hardened
Message-ID <[email protected]> 
W dniu 27.08.2014 o 18:34, André Aparício pisze:
> I encountered the same problem with qemu/kvm but can't even login, I
> get random segfaults and even failed malloc assertions
> in /sbin/init, /sbin/rc or /bin/login (never past this).
> 
> But it works fine with CONFIG_PAX_MEMORY_UDEREF disabled.


It looks that disabling CONFIG_PAX_MEMORY_UDEREF solves problem on my
host too.


> Config that reproduces the problem.
> 
> $ grep -P "(GRK|PAX)" linux-3.15.8-hardened/.config
> CONFIG_PAX_KERNEXEC_PLUGIN=y
> CONFIG_PAX_PER_CPU_PGD=y
> CONFIG_PAX_USERCOPY_SLABS=y
> CONFIG_GRKERNSEC=y
> CONFIG_GRKERNSEC_CONFIG_AUTO=y
> # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set
> CONFIG_GRKERNSEC_CONFIG_SERVER=y
> # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set
> # CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set
> CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y
> # CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set
> # CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF is not set
> CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY=y
> CONFIG_GRKERNSEC_PROC_GID=10
> CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID=100
> CONFIG_GRKERNSEC_SYMLINKOWN_GID=100
> CONFIG_PAX=y
> # CONFIG_PAX_SOFTMODE is not set
> CONFIG_PAX_PT_PAX_FLAGS=y
> CONFIG_PAX_XATTR_PAX_FLAGS=y
> # CONFIG_PAX_NO_ACL_FLAGS is not set
> CONFIG_PAX_HAVE_ACL_FLAGS=y
> # CONFIG_PAX_HOOK_ACL_FLAGS is not set
> CONFIG_PAX_NOEXEC=y
> CONFIG_PAX_PAGEEXEC=y
> CONFIG_PAX_EMUTRAMP=y
> CONFIG_PAX_MPROTECT=y
> # CONFIG_PAX_MPROTECT_COMPAT is not set
> # CONFIG_PAX_ELFRELOCS is not set
> CONFIG_PAX_KERNEXEC=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts"
> CONFIG_PAX_ASLR=y
> # CONFIG_PAX_RANDKSTACK is not set
> CONFIG_PAX_RANDUSTACK=y
> CONFIG_PAX_RANDMMAP=y
> CONFIG_PAX_MEMORY_SANITIZE=y
> CONFIG_PAX_MEMORY_STACKLEAK=y
> CONFIG_PAX_MEMORY_STRUCTLEAK=y
> CONFIG_PAX_MEMORY_UDEREF=y
> CONFIG_PAX_REFCOUNT=y
> CONFIG_PAX_CONSTIFY_PLUGIN=y
> CONFIG_PAX_USERCOPY=y
> # CONFIG_PAX_USERCOPY_DEBUG is not set
> CONFIG_PAX_SIZE_OVERFLOW=y
> CONFIG_PAX_LATENT_ENTROPY=y
> CONFIG_GRKERNSEC_KMEM=y
> CONFIG_GRKERNSEC_IO=y
> CONFIG_GRKERNSEC_PERF_HARDEN=y
> CONFIG_GRKERNSEC_RAND_THREADSTACK=y
> CONFIG_GRKERNSEC_PROC_MEMMAP=y
> CONFIG_GRKERNSEC_KSTACKOVERFLOW=y
> CONFIG_GRKERNSEC_BRUTE=y
> CONFIG_GRKERNSEC_HIDESYM=y
> CONFIG_GRKERNSEC_RANDSTRUCT=y
> # CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE is not set
> # CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
> CONFIG_GRKERNSEC_NO_RBAC=y
> CONFIG_GRKERNSEC_ACL_HIDEKERN=y
> CONFIG_GRKERNSEC_ACL_MAXTRIES=3
> CONFIG_GRKERNSEC_ACL_TIMEOUT=30
> CONFIG_GRKERNSEC_PROC=y
> # CONFIG_GRKERNSEC_PROC_USER is not set
> CONFIG_GRKERNSEC_PROC_USERGROUP=y
> CONFIG_GRKERNSEC_PROC_ADD=y
> CONFIG_GRKERNSEC_LINK=y
> CONFIG_GRKERNSEC_SYMLINKOWN=y
> CONFIG_GRKERNSEC_FIFO=y
> CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
> # CONFIG_GRKERNSEC_ROFS is not set
> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
> CONFIG_GRKERNSEC_CHROOT=y
> CONFIG_GRKERNSEC_CHROOT_MOUNT=y
> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
> CONFIG_GRKERNSEC_CHROOT_PIVOT=y
> CONFIG_GRKERNSEC_CHROOT_CHDIR=y
> CONFIG_GRKERNSEC_CHROOT_CHMOD=y
> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
> CONFIG_GRKERNSEC_CHROOT_MKNOD=y
> CONFIG_GRKERNSEC_CHROOT_SHMAT=y
> CONFIG_GRKERNSEC_CHROOT_UNIX=y
> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
> CONFIG_GRKERNSEC_CHROOT_NICE=y
> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
> CONFIG_GRKERNSEC_CHROOT_CAPS=y
> # CONFIG_GRKERNSEC_AUDIT_GROUP is not set
> CONFIG_GRKERNSEC_EXECLOG=y
> CONFIG_GRKERNSEC_RESLOG=y
> CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
> # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set
> # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
> # CONFIG_GRKERNSEC_AUDIT_MOUNT is not set
> CONFIG_GRKERNSEC_SIGNAL=y
> # CONFIG_GRKERNSEC_FORKFAIL is not set
> CONFIG_GRKERNSEC_TIME=y
> CONFIG_GRKERNSEC_PROC_IPADDR=y
> CONFIG_GRKERNSEC_RWXMAP_LOG=y
> CONFIG_GRKERNSEC_DMESG=y
> CONFIG_GRKERNSEC_HARDEN_PTRACE=y
> CONFIG_GRKERNSEC_PTRACE_READEXEC=y
> CONFIG_GRKERNSEC_SETXID=y
> CONFIG_GRKERNSEC_HARDEN_IPC=y
> CONFIG_GRKERNSEC_TPE=y
> # CONFIG_GRKERNSEC_TPE_ALL is not set
> # CONFIG_GRKERNSEC_TPE_INVERT is not set
> CONFIG_GRKERNSEC_TPE_GID=100
> CONFIG_GRKERNSEC_RANDNET=y
> CONFIG_GRKERNSEC_BLACKHOLE=y
> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
> # CONFIG_GRKERNSEC_SOCKET is not set
> # CONFIG_GRKERNSEC_SYSCTL is not set
> CONFIG_GRKERNSEC_FLOODTIME=10
> CONFIG_GRKERNSEC_FLOODBURST=6
> 
> On Tue, 26 Aug 2014 11:24:26 +0100
> Marcin Mirosław <[email protected]> wrote:
> 
>> Hello!
>> I suspect that I've got problem with hardened-sources in KVM VM. I'm
>> not sure if I should fill a bug for this. I'd like to post it here
>> before using b.g.o.
>> I've got VM (it's KVM with qemu-2.0.0-r1), with
>> hardened-sources-3.15.{5-r2,8}. I'm observing a kind of memory
>> corruption. After a couple of hours of uptime I'm starting seeing
>> random segfaults, general protection traps especially when process
>> uses a lot of CPU and do many I/O operations (masscheck scripts
>> written in perl for spamassasin rules).
>> In log I've got e.g.:
>>
>> 2014-08-25T13:05:23.243062+02:00 mohikanin kernel: [45571.239703] PAX:
>> >From 88.198.102.195: execution attempt in: (null), 00000000-00000000
>> 00000000
>> 2014-08-25T13:05:23.243088+02:00 mohikanin kernel: [45571.239707] PAX:
>> terminating task: /usr/libexec/dovecot/pop3-login(pop3-login):2507,
>> uid/euid: 105/105, PC:            (nil), SP: 000003a8574e4c00
>> 2014-08-25T13:05:23.243093+02:00 mohikanin kernel: [45571.239709] PAX:
>> bytes at
>> PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
>> 2014-08-25T13:05:23.243095+02:00 mohikanin kernel: [45571.239735]
>> PAX: bytes at SP-8: 0000000000000000 0000000000000000
>> 00000059c6deceb0 0000000000000000 00000316027bc540 0000000000000001
>> 000003160271dbb5 0000000000000000 0000000000000000 0000000000000000
>> 0000000000000000 2014-08-25T13:24:42.943001+02:00 mohikanin kernel:
>> [46730.931353] traps: spamd child[19681] general protection
>> ip:2c572b6e163 sp:3ca7d000be0 error:0 in
>> libc-2.19.so[2c572aee000+19e000] 2014-08-25T13:24:42.943007+02:00
>> mohikanin kernel: [46730.931371] grsec: Segmentation fault occurred
>> at            (nil) in /usr/sbin/spamd[spamd child:19681]
>> uid/euid:999/999 gid/egid:100/100,
>> parent /usr/sbin/spamd[/usr/sbin/spamd:1255] uid/euid:0/0
>> gid/egid:0/0 2014-08-25T13:55:22.383032+02:00 mohikanin kernel:
>> [48570.375917] traps: freshclam[6594] general protection
>> ip:344cceb368d sp:3d5f5ced520 error:0 in
>> libclamav.so.6.1.23[344ccdf1000+9d1000]
>> 2014-08-25T13:55:22.383050+02:00 mohikanin kernel: [48570.375968]
>> grsec: Segmentation fault occurred at            (nil)
>> in /usr/bin/freshclam[freshclam:6594] uid/euid:104/104
>> gid/egid:115/115, parent /usr/bin/freshclam[freshclam:1159]
>> uid/euid:104/104 gid/egid:115/115
>>
>> Yesterday I switched kernel to gentoo-sources-3.14.14 and I don't see
>> any unwanted behavior. This is why I suspect hardened-sources. Should
>> I fill a bug? What should I do help find out the root of problem?
>> (gcc is: gcc version 4.7.3 (Gentoo Hardened 4.7.3-r1 p1.4,
>> pie-0.5.5) , with ld.gold)
>>
>> Marcin
>>
>> # grep -P "(GRK|PAX)" /boot/config-3.15.8-hardened
>> CONFIG_PAX_KERNEXEC_PLUGIN=y
>> CONFIG_PAX_PER_CPU_PGD=y
>> CONFIG_PAX_USERCOPY_SLABS=y
>> CONFIG_GRKERNSEC=y
>> CONFIG_GRKERNSEC_CONFIG_AUTO=y
>> # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set
>> CONFIG_GRKERNSEC_CONFIG_SERVER=y
>> # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set
>> CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST=y
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set
>> CONFIG_GRKERNSEC_CONFIG_VIRT_EPT=y
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT is not set
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set
>> CONFIG_GRKERNSEC_CONFIG_VIRT_KVM=y
>> # CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX is not set
>> CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF=y
>> # CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY is not set
>> CONFIG_GRKERNSEC_PROC_GID=55555
>> CONFIG_GRKERNSEC_TPE_TRUSTED_GID=55555
>> CONFIG_GRKERNSEC_SYMLINKOWN_GID=100
>> CONFIG_PAX=y
>> # CONFIG_PAX_SOFTMODE is not set
>> # CONFIG_PAX_PT_PAX_FLAGS is not set
>> CONFIG_PAX_XATTR_PAX_FLAGS=y
>> # CONFIG_PAX_NO_ACL_FLAGS is not set
>> CONFIG_PAX_HAVE_ACL_FLAGS=y
>> # CONFIG_PAX_HOOK_ACL_FLAGS is not set
>> CONFIG_PAX_NOEXEC=y
>> CONFIG_PAX_PAGEEXEC=y
>> CONFIG_PAX_EMUTRAMP=y
>> CONFIG_PAX_MPROTECT=y
>> # CONFIG_PAX_MPROTECT_COMPAT is not set
>> # CONFIG_PAX_ELFRELOCS is not set
>> CONFIG_PAX_KERNEXEC=y
>> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y
>> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts"
>> CONFIG_PAX_ASLR=y
>> CONFIG_PAX_RANDKSTACK=y
>> CONFIG_PAX_RANDUSTACK=y
>> CONFIG_PAX_RANDMMAP=y
>> # CONFIG_PAX_MEMORY_SANITIZE is not set
>> CONFIG_PAX_MEMORY_STACKLEAK=y
>> CONFIG_PAX_MEMORY_STRUCTLEAK=y
>> CONFIG_PAX_MEMORY_UDEREF=y
>> CONFIG_PAX_REFCOUNT=y
>> CONFIG_PAX_CONSTIFY_PLUGIN=y
>> CONFIG_PAX_USERCOPY=y
>> # CONFIG_PAX_USERCOPY_DEBUG is not set
>> CONFIG_PAX_SIZE_OVERFLOW=y
>> CONFIG_PAX_LATENT_ENTROPY=y
>> CONFIG_GRKERNSEC_KMEM=y
>> CONFIG_GRKERNSEC_IO=y
>> CONFIG_GRKERNSEC_JIT_HARDEN=y
>> CONFIG_GRKERNSEC_PERF_HARDEN=y
>> CONFIG_GRKERNSEC_RAND_THREADSTACK=y
>> CONFIG_GRKERNSEC_PROC_MEMMAP=y
>> CONFIG_GRKERNSEC_KSTACKOVERFLOW=y
>> # CONFIG_GRKERNSEC_BRUTE is not set
>> CONFIG_GRKERNSEC_MODHARDEN=y
>> CONFIG_GRKERNSEC_HIDESYM=y
>> CONFIG_GRKERNSEC_RANDSTRUCT=y
>> CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y
>> # CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
>> CONFIG_GRKERNSEC_NO_RBAC=y
>> # CONFIG_GRKERNSEC_ACL_HIDEKERN is not set
>> CONFIG_GRKERNSEC_ACL_MAXTRIES=3
>> CONFIG_GRKERNSEC_ACL_TIMEOUT=30
>> CONFIG_GRKERNSEC_PROC=y
>> CONFIG_GRKERNSEC_PROC_USER=y
>> CONFIG_GRKERNSEC_PROC_ADD=y
>> CONFIG_GRKERNSEC_LINK=y
>> CONFIG_GRKERNSEC_SYMLINKOWN=y
>> CONFIG_GRKERNSEC_FIFO=y
>> CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
>> # CONFIG_GRKERNSEC_ROFS is not set
>> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
>> CONFIG_GRKERNSEC_CHROOT=y
>> CONFIG_GRKERNSEC_CHROOT_MOUNT=y
>> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
>> CONFIG_GRKERNSEC_CHROOT_PIVOT=y
>> CONFIG_GRKERNSEC_CHROOT_CHDIR=y
>> CONFIG_GRKERNSEC_CHROOT_CHMOD=y
>> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
>> CONFIG_GRKERNSEC_CHROOT_MKNOD=y
>> CONFIG_GRKERNSEC_CHROOT_SHMAT=y
>> CONFIG_GRKERNSEC_CHROOT_UNIX=y
>> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
>> CONFIG_GRKERNSEC_CHROOT_NICE=y
>> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
>> CONFIG_GRKERNSEC_CHROOT_CAPS=y
>> CONFIG_GRKERNSEC_CHROOT_INITRD=y
>> # CONFIG_GRKERNSEC_AUDIT_GROUP is not set
>> # CONFIG_GRKERNSEC_EXECLOG is not set
>> CONFIG_GRKERNSEC_RESLOG=y
>> # CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set
>> # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set
>> # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
>> CONFIG_GRKERNSEC_AUDIT_MOUNT=y
>> CONFIG_GRKERNSEC_SIGNAL=y
>> CONFIG_GRKERNSEC_FORKFAIL=y
>> CONFIG_GRKERNSEC_TIME=y
>> CONFIG_GRKERNSEC_PROC_IPADDR=y
>> CONFIG_GRKERNSEC_RWXMAP_LOG=y
>> CONFIG_GRKERNSEC_DMESG=y
>> CONFIG_GRKERNSEC_HARDEN_PTRACE=y
>> CONFIG_GRKERNSEC_PTRACE_READEXEC=y
>> CONFIG_GRKERNSEC_SETXID=y
>> CONFIG_GRKERNSEC_HARDEN_IPC=y
>> CONFIG_GRKERNSEC_TPE=y
>> CONFIG_GRKERNSEC_TPE_ALL=y
>> CONFIG_GRKERNSEC_TPE_INVERT=y
>> CONFIG_GRKERNSEC_TPE_GID=55555
>> CONFIG_GRKERNSEC_RANDNET=y
>> CONFIG_GRKERNSEC_BLACKHOLE=y
>> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
>> # CONFIG_GRKERNSEC_SOCKET is not set
>> CONFIG_GRKERNSEC_SYSCTL=y
>> # CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set
>> CONFIG_GRKERNSEC_SYSCTL_ON=y
>> CONFIG_GRKERNSEC_FLOODTIME=10
>> CONFIG_GRKERNSEC_FLOODBURST=6
>>
> 
> 
> 


-- 
xmpp (jabber): marcin  [at]  mejor.pl
www: http://blog.mejor.pl/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.