Re: runit running under linux 2.4 with openwall patches

["Csillag Tamás" <cstamas@digitus.itk.ppke.hu>]

I am sorry if this is a bit OT here.

On 01/25, Vincent Danen wrote:
> 
> On Jan 25, 2005, at 17:44, Csillag Tamás wrote:
> 
> >>>Yes, it's dietlibc. Dietlibc executes code from the stack during
> >>>system calls,
> >>>afaict.
> >>
> >>Well, it's definitely dietlibc.  I compiled runit with glibc
> >>(statically) and it works just fine.   Very strange.
> >I got the same with grsecurity (www.grsecurity.org).
> >Well it did not stated exactly in the log that the stack operation is 
> >the
> >cause of killing that process.
> >
> >It could happen for *all* dietlibc linked program.
> >(I experienced in: runsv svlogd fnord tcpsvd ... )
> 
> Odd thing here is that I tried a few other apps that were 
> dietlibc-compiled and didn't see a problem.
> 
> Hmmm... spoke too soon.  None of the services requiring tcpsvd were 
> installed, so I tried with rsync and if I start supervise on those 
> services, nothing happens.  But if "sh -x run" myself, I can see the 
> services are starting.  Not sure if recompiling ipsvd without dietlibc 
> will help, but it's something I'll have to try.
You cannot predict when will it happen.
In fnord-cgi it only happend when it executed the cgis. I blamed myself
that something is missing inside it's chroot, but it worked well if I
ran it 'strace -f' (I mean fnord).

In runsv when you signal a service runsv itself gets killed, and
runsvdir will restart it (you can see that log -service has the same
'uptime' as the supervisioned process).
> 
> >In grsec I use the chpax utility to bypass this security checks on 
> >these
> >(and only these) programs.
> 
> Ouch.  Not a good solution.
> 
> >Maybe it is worth asking the author of dietlibc..
> >http://www.fefe.de/dietlibc/
> 
> I have... and am in the middle of a conversation with him.  He's very 
> interested in seeing this resolved.
Nice. 
It is not on the dietlibc -list is not it?
(I do not see it there)
Please send me a summary when it gets resolved.

(Maybe here too, I think the guys maybe also interested in this,
and if you already started it here ;-)

Thanks.

-- 
cstamas