vmihalko / t2_polkit

Other
0 stars 0 forks source link

sys-auth/polkit-0.113-r2::gentoo segfault and error 4 in libpthread-2.23.so when enabled PAX_NOEXEC(linux hardened) #5

Open vmihalko opened 7 years ago

vmihalko commented 7 years ago

In GitLab by @bugzilla-migration on Mar 3, 2017, 19:06

Submitted by xde..@..il.com

Assigned to David Zeuthen @david

Link to original bug (#100054)

Description

sys-auth/polkit-0.113-r2::gentoo was built with the following: USE="gtk introspection nls pam (-elogind) -examples -jit -kde (-selinux) -systemd -test"

sh bash 4.4_p12 ld GNU ld (Gentoo 2.26.1 p1.0) 2.26.1 ccache version 3.3.4 [enabled] app-shells/bash: 4.4_p12::gentoo dev-java/java-config: 2.2.0-r3::gentoo dev-lang/perl: 5.24.1::gentoo dev-lang/python: 2.7.13::gentoo, 3.4.6::gentoo, 3.5.3::gentoo dev-util/ccache: 3.3.4::gentoo dev-util/cmake: 3.7.2::gentoo dev-util/pkgconfig: 0.29.1::gentoo sys-apps/baselayout: 2.3::gentoo sys-apps/openrc: 0.22.4::gentoo sys-apps/sandbox: 2.10-r3::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69-r2::gentoo sys-devel/automake: 1.11.6-r2::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15-r2::gentoo sys-devel/binutils: 2.26.1::gentoo, 2.27::gentoo sys-devel/gcc: 5.4.0-r2::gentoo sys-devel/gcc-config: 1.8-r1::gentoo sys-devel/libtool: 2.4.6-r3::gentoo sys-devel/make: 4.2.1::gentoo sys-kernel/linux-headers: 4.9::gentoo (virtual/os-headers) sys-libs/glibc: 2.23-r3::gentoo

HERE:

gdb -q /usr/bin/pkaction

Reading symbols from /usr/bin/pkaction...(no debugging symbols found)...done. (gdb) run Starting program: /usr/bin/pkaction warning: Cannot call inferior functions, Linux kernel PaX protection forbids return to non-executable pages! [New LWP 10752] [New LWP 10753] Error getting authority: Error initializing authority: Error calling StartServiceByName for org.freedesktop.PolicyKit1: GDBus.Error:org.freedesktop.DBus.Error.Spawn.ChildSignaled: Process org.freedesktop.PolicyKit1 received signal 11 [LWP 10752 exited] [LWP 10740 exited] [Inferior 1 (process 10740) exited with code 01]

dmesg LOG:

[24394.960110] PAX: execution attempt in: <anonymous mapping>, 39ca97f2000-39ca97f3000 39ca97f2000
[24394.960115] PAX: terminating task: /usr/bin/gdb(gdb):10743, uid/euid: 0/0, PC: 0000039ca97f2000, SP: 000003a80217e4b0
[24394.960118] PAX: bytes at PC: cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[24394.960132] PAX: bytes at SP-8: 0000039ca97f2000 0000039ca7eed788 0000000000000000 0000000000000018 0000001f9fce145f 000003a80217e4d8 d9b33c462bec4500 00000000000029f5 00000000000029f5 000003a80217e514 00000000000029f5

[24395.076960] polkitd[10756]: segfault at 10 ip 000003963b468a93 sp 000003fe59ec9620 error 4 in libpthread-2.23.so[3963b45f000+17000]

vmihalko commented 7 years ago

In GitLab by @bugzilla-migration on Mar 3, 2017, 20:36

:speech_balloon: Simon McVittie said:

(In reply to xdev52 from comment 0)

gdb -q /usr/bin/pkaction

It is polkitd that is crashing, not pkaction, so you will need to attach gdb to polkitd (not pkaction) to get a useful backtrace.

polkit uses mozjs (the Mozilla JavaScript engine) to interpret its domain-specific language, and JavaScript interpreters typically use JIT which relies on generating executable code in memory and running it. This makes me speculate that the version of mozjs you have might not be compatible with the PAX kernel.

I notice you have configured "-jit" which suggests that your kernel is known not to work well with JIT. Perhaps that setting has not actually been effective in preventing mozjs from using JIT?

You might get better results by talking to the Hardened Gentoo maintainers - I would guess that they see this sort of thing a lot. If so, please respond here with any more information you/they can provide.

vmihalko commented 7 years ago

In GitLab by @bugzilla-migration on Mar 3, 2017, 21:34

:speech_balloon: xde..@..il.com said:

(In reply to Simon McVittie from comment 1) (In reply to xdev52 from comment 0)

gdb -q /usr/bin/pkaction

It is polkitd that is crashing, not pkaction, so you will need to attach gdb to polkitd (not pkaction) to get a useful backtrace.

polkit uses mozjs (the Mozilla JavaScript engine) to interpret its domain-specific language, and JavaScript interpreters typically use JIT which relies on generating executable code in memory and running it. This makes me speculate that the version of mozjs you have might not be compatible with the PAX kernel.

I notice you have configured "-jit" which suggests that your kernel is known not to work well with JIT. Perhaps that setting has not actually been effective in preventing mozjs from using JIT?

You might get better results by talking to the Hardened Gentoo maintainers - I would guess that they see this sort of thing a lot. If so, please respond here with any more information you/they can provide.

here:

gdb -q /usr/lib/polkit-1/polkitd

Reading symbols from /usr/lib/polkit-1/polkitd...(no debugging symbols found)...done. (gdb) run Starting program: /usr/lib64/polkit-1/polkitd warning: Cannot call inferior functions, Linux kernel PaX protection forbids return to non-executable pages! Successfully changed to user polkitd [New LWP 16284] [New LWP 16285]

Thread 1 "polkitd" received signal SIGSEGV, Segmentation fault. 0x000003556bf5ba93 in ?? ()

dmesg:

[34060.196688] PAX: execution attempt in: <anonymous mapping>, 35f60a57000-35f60a58000 35f60a57000
[34060.196693] PAX: terminating task: /usr/bin/gdb(gdb):16274, uid/euid: 0/0, PC: 0000035f60a57000, SP: 000003a625e87570
[34060.196695] PAX: bytes at PC: cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[34060.196709] PAX: bytes at SP-8: 0000035f60a57000 0000035f5f152788 0000000000000000 0000000000000018 00000002e30cc45f 000003a625e87598 a28b850286a0fd00 0000000000003f90 0000000000003f90 000003a625e875d4 0000000000003f90