In automatic policy generation and when running known good policies, the process dies/systrace kills it with: systrace: intercept_get_string: ioctl: Bad address Usually happens with server processes Reproducible: Always Steps to Reproduce: 1.Enable systrace in kernel, build systrace userland 2.systrace -A /usr/bin/rsync --daemon --no-detach -4 3.try to rsync to your server 4.die with systrace: intercept_get_string: ioctl: Bad address Actual Results: systrace: intercept_get_string: ioctl: Bad address Expected Results: systrace would generate /root/.systrace/usr_bin_rsync without dying. Then rsync server could be run as systrace -AiU /usr/bin/rsync --daemon -4 (securely)
on #gentoo-hardened, they said this should be assigned to pfeifer I have a patch for gentoo-sources for systrace 1.3, but I get the same results. I have used a vanilla kernel and patched it, so I know that policy generation should work. I have been doing alot to fix this, but I'm no kernel guru. Please email me if I can do anything to help.
Fixed in pfeifer-sources-2.4.21-pre2 with systrace 1.3 (as a side note, 1.4 is out). As I understand it, this will be the next gentoo-sources (from pfeifer's postings). Pfeifer, thanks for the great work. I will close this bug when the new gentoo-sources comes out. Jeb Campbell jebc@c4solutions.net
sorry, i meant to post an update to this bug when i thought i had it fixed. glad you caught it. yes, the pfeifer-sources-2.4.21_preX series is destined for gentoo-sources. Jay
oh, and yes, i worked in 1.4 to pre3 back on the 3rd. I'm going to try and wrap-up diffs for pre3 in the next 24-hours. Thanks, Jay
feedback for systrace 1.4 on pfeifer-sources-2.4.21_pre3 would be great... i'm just about ready to roll this into gentoo-sources. Thanks, Jay
Just compiled and tested here with same config (plus the new Apple FS -- thanks for that one). Systrace works great. Let me know if I can do anything else. Jeb Campbell jebc@c4solutions.net
see also the patch in #18715 for 2.4.20-r2, which is still working for me in -r5
systrace in 2.4.21-pfeifer-r1_pre4 is working well for me
see comment #2, comment #3
