coolstar / electra

Electra iOS 11.0 - 11.1.2 jailbreak toolkit based on async_awake
GNU General Public License v3.0
656 stars 163 forks source link

Dropbear leaving zombie processes #17

Closed coolstar closed 6 years ago

coolstar commented 6 years ago

I noticed my iPad ran into the issue where no apps would launch, and no new processes would spawn.

jailbreakd still seemed to be printing out messages, and amfid also appeared to be working...

However I noticed a message: "proc: table is full"

After a reboot and rejailbreak I decided to take a look at the process table after a few minutes of use and found the culprit...

root             350   0.0  0.0        0      0   ??  Z     2:10AM   0:00.00 (dropbear)         235
root             349   0.0  0.0        0      0   ??  Z     2:09AM   0:00.00 (dropbear)         235
root             254   0.0  0.0        0      0   ??  Z     1:43AM   0:00.00 (dropbear)         235
root             345   0.0  0.0        0      0   ??  Z     2:08AM   0:00.00 (dropbear)         235
root             342   0.0  0.0        0      0   ??  Z     2:07AM   0:00.00 (dropbear)         235
root             341   0.0  0.0        0      0   ??  Z     2:06AM   0:00.00 (dropbear)         235
root             337   0.0  0.0        0      0   ??  Z     2:04AM   0:00.00 (dropbear)         235
root             336   0.0  0.0        0      0   ??  Z     2:03AM   0:00.00 (dropbear)         235
root             329   0.0  0.0        0      0   ??  Z     2:02AM   0:00.00 (dropbear)         235
root             321   0.0  0.0        0      0   ??  Z     2:01AM   0:00.00 (dropbear)         235
root             291   0.0  0.0        0      0   ??  Z     2:00AM   0:00.00 (dropbear)         235
root             286   0.0  0.0        0      0   ??  Z     1:59AM   0:00.00 (dropbear)         235
root             285   0.0  0.0        0      0   ??  Z     1:58AM   0:00.00 (dropbear)         235
root             284   0.0  0.0        0      0   ??  Z     1:58AM   0:00.00 (dropbear)         235
root             283   0.0  0.0        0      0   ??  Z     1:57AM   0:00.00 (dropbear)         235
root             282   0.0  0.0        0      0   ??  Z     1:55AM   0:00.00 (dropbear)         235
root             281   0.0  0.0        0      0   ??  Z     1:55AM   0:00.00 (dropbear)         235
root             274   0.0  0.0        0      0   ??  Z     1:54AM   0:00.00 (dropbear)         235
root             273   0.0  0.0        0      0   ??  Z     1:53AM   0:00.00 (dropbear)         235
root             272   0.0  0.0        0      0   ??  Z     1:52AM   0:00.00 (dropbear)         235
root             271   0.0  0.0        0      0   ??  Z     1:51AM   0:00.00 (dropbear)         235
root             270   0.0  0.0        0      0   ??  Z     1:50AM   0:00.00 (dropbear)         235
root             269   0.0  0.0        0      0   ??  Z     1:49AM   0:00.00 (dropbear)         235
root             267   0.0  0.0        0      0   ??  Z     1:48AM   0:00.00 (dropbear)         235
root             265   0.0  0.0        0      0   ??  Z     1:46AM   0:00.00 (dropbear)         235
root             264   0.0  0.0        0      0   ??  Z     1:45AM   0:00.00 (dropbear)         235
root             261   0.0  0.0        0      0   ??  Z     1:44AM   0:00.00 (dropbear)         235
root             351   0.0  0.1  1584256   1328 s000  R+    2:10AM   0:00.00 ps aux -o ppid     293
root             258   0.0  0.0        0      0   ??  Z     1:43AM   0:00.00 (dropbear)         235

(235 is the very first instance of dropbear and is the parent of all these zombie processes)

stek29 commented 6 years ago

@coolstar anything spawned from the app stays as zombie -- as well as inject_*

Using LaunchDaemons would overcome this issue, but I guess it still has to be figured out. It's going from async_awake for sure.

coolstar commented 6 years ago

@stek29 I actually have a separate “launchjailbreak” binary which does a double fork before starting dropbear (which is how dropbear can still accept connections after the app exits)

Interestingly if I run “killall -9 dropbear && dropbear -S /bootstrap -p 22 -p 2222” over SSH, it both clears out the zombie processes, and the new dropbear that spawns doesn’t leave any zombies behind...

ninoz commented 6 years ago

Perhaps an additional toggle on the Electra screen similar to the "tweaks" for controling SSH could be a stopgap.

I also wonder if dropbear should be listening on 127.0.0.1, i would love to see how many root:alpine devices are sitting on networks now!

dallasgroot commented 6 years ago

I was having issues with SSH using LibertiOS services so commands like uncache wouldn't work, little work around was to Edit profile found in /etc/profile and change the last line to: export PATH=/bootstrap/bin:/bootstrap/usr/local/bin, though some commands still don't work, uicache does

coolstar commented 6 years ago

/etc/profile is not included as part of electra. It is probably left over from liberios; you can simply delete the file

dallasgroot commented 6 years ago

‘ Now when I ssh this happens. # zsh: failed to load module `zsh/zle': dlopen(/usr/local/lib/zsh/5.0.8/zsh/zle.so, 9): no suitable image found. Did find:\n\t/usr/local/lib/zsh/5.0.8/zsh/zle.so: code signing blocked mmap() of '/usr/local/lib/zsh/5.0.8/zsh/zle.so'\h:\w \u$ ls.aks_migrate.bootstrappedApplication Support.aks_whitelist.mkb_seshat_healthLibrary.bash_history.obliteratedMedia# \h:\w \u$ ’

Dallas Groot about.me/dallasgroot

On Jan 15, 2018, at 10:59 PM, CoolStar notifications@github.com wrote:

/etc/profile is not included as part of electra. It is probably left over from liberios; you can simply delete the file

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

stek29 commented 6 years ago

@dallasgroot zsh is leftover from liberios too. I love zsh, but I prefer bash on mobile devices :)

Also, see #15.