Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 322839 - mail-filter/spamdyke-4.0.10 is killed under hardened unless PaX exceptions are set
Summary: mail-filter/spamdyke-4.0.10 is killed under hardened unless PaX exceptions ar...
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: AMD64 Linux
: High minor (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-06-05 12:15 UTC by Gianni Ceccarelli
Modified: 2010-10-28 16:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gianni Ceccarelli 2010-06-05 12:15:28 UTC
On a default installaton of spamdyke on a hardened profile with PaX, running it results in the message "Killed" and the following on dmesg:

PAX: execution attempt in: <anonymous mapping>, 79fe6a24a000-79fe6a260000 7ffffffe9000
PAX: terminating task: /usr/bin/spamdyke(spamdyke):5181, uid/euid: 0/0, PC: 000079fe6a251e90, SP: 000079fe6a2508a8
PAX: bytes at PC: 49 bb 70 92 e2 dc 98 0e 00 00 49 ba 20 e0 25 6a fe 79 00 00 
PAX: bytes at SP-8: 


"paxctl -psEm /usr/bin/spamdyke" allows spamdyke to work.

From the compilation log:

configuration.c: In function `prepare_settings':
configuration.c:2816: warning: generating trampoline in object (requires executable stack)

Also, the QA notice says to report this:

 RWX --- --- usr/bin/spamdyke


Reproducible: Always

Steps to Reproduce:
1. emerge spamdyke on a hardened profile with PaX
2. try to run "/usr/bin/spamdyke -h"

Actual Results:  
"Killed" in the console, PaX report on dmesg

Expected Results:  
The help message form spamdyke

# emerge --info

Portage 2.1.8.3 (hardened/linux/amd64/10.0, gcc-3.4.6, glibc-2.10.1-r1, 2.6.28-hardened-r7 x86_64)
=================================================================
System uname: Linux-2.6.28-hardened-r7-x86_64-AMD_Phenom-tm-_II_X3_720_Processor-with-gentoo-1.12.13
Timestamp of tree: Sat, 05 Jun 2010 02:45:01 +0000
app-shells/bash:     4.0_p37
dev-java/java-config: 2.1.10
dev-lang/python:     2.6.4-r1
dev-python/pycrypto: 2.1.0_beta1
dev-util/cmake:      2.6.4-r3
sys-apps/baselayout: 1.12.13
sys-apps/sandbox:    1.6-r2
sys-devel/autoconf:  2.63-r1
sys-devel/automake:  1.11.1
sys-devel/binutils:  2.18-r3
sys-devel/gcc:       3.4.6-r2, 4.3.4
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.6b
virtual/os-headers:  2.6.30-r1
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=opteron -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /var/qmail/alias /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/eselect/postgresql /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=opteron -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests distlocks fixpackages news parallel-fetch protect-owned sandbox sfperms strict unmerge-logs unmerge-orphans userfetch"
GENTOO_MIRRORS="http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/ http://mirror.jamit.de/gentoo/ http://gentoo.mirror.dkm.cz/pub/gentoo/"
LC_ALL="en_US.UTF-8"
LDFLAGS="-Wl,-O1"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise /usr/local/portage/layman/dakkar"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="acl acpi amd64 apache2 bash-completion berkdb bzip2 cjk cli cracklib crypt cxx doc dri emacs foomatic gdbm gpm hardened iconv imap innodb justify ldap leim libwww logrotate maildir mailwrapper mmx modules mudflap mule multilib ncurses nptl nptlonly openmp pam pcre perl pic ppds pppd python readline reflection samba session snmp spl sse sse2 ssl sysfs tcpd threads truetype unicode urandom xinetd xml xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic auth_digest authn_anon authn_dbd authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock dbd deflate dir disk_cache env expires ext_filter file_cache filter headers ident imagemap include info log_config logio mem_cache mime mime_magic negotiation proxy proxy_ajp proxy_balancer proxy_connect proxy_http rewrite setenvif so speling status unique_id userdir usertrack vhost_alias" APACHE2_MPMS="worker" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga neomagic nv r128 radeon savage sis tdfx trident vesa via vmware voodoo" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

- PaX related kernel config lines:

CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_NOELFRELOCS is not set
CONFIG_PAX_KERNEXEC=y
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_MEMORY_SANITIZE=y
# CONFIG_PAX_REFCOUNT is not set
# CONFIG_KEYS is not set
# CONFIG_SECURITY is not set
# CONFIG_SECURITYFS is not set
# CONFIG_SECURITY_FILE_CAPABILITIES is not set
Comment 1 Magnus Granberg gentoo-dev 2010-10-28 16:26:31 UTC
Reopen if it still fails with gcc-4.4.4-r2