Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #66930 > unrolled thread

Bug#959070: klibc-utils: fstype falsely claims to need an executable stack

Back to article view | Back to linux.debian.kernel

Contents

  Bug#959070: klibc-utils: fstype falsely claims to need an executable stack Russell Coker <russell@coker.com.au> - 2020-04-29 06:20 +0200
    Bug#959070: klibc-utils: fstype falsely claims to need an executable stack Ben Hutchings <ben@decadent.org.uk> - 2020-04-29 15:40 +0200
    Processed: Re: Bug#959070: klibc-utils: fstype falsely claims to  need an executable stack "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-04-29 15:40 +0200
    Bug#959070: klibc-utils: fstype falsely claims to need an executable stack Thorsten Glaser <tg@mirbsd.de> - 2020-04-29 21:20 +0200
    Bug#959070: klibc-utils: fstype falsely claims to need an executable stack Ben Hutchings <ben@decadent.org.uk> - 2020-04-29 23:20 +0200
    Bug#959070: marked as done (klibc-utils: fstype falsely claims to  need an executable stack) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-08-21 03:00 +0200

#66930 — Bug#959070: klibc-utils: fstype falsely claims to need an executable stack

Package: klibc-utils
Version: 2.0.7-1
Severity: normal

root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
Segmentation fault
root@sevm:~/pol# execstack -c /usr/lib/klibc/bin/fstype
root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
FSTYPE=btrfs
FSSIZE=719360278528

The fstype program is listed as needing an executable stack, which will cause
it to crash when run on a system with a security policy preventing executable
stacke.  If you clear the execstack bit it appears to work correctly.

https://akkadia.org/drepper/nonselsec.pdf

Page 8 of Ulrich Drepper's document about non-SE Linux security explains the
options for dealing with this.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.5.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8), LANGUAGE=en_AU:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Enforcing - Policy name: default

Versions of packages klibc-utils depends on:
ii  libklibc  2.0.7-1

klibc-utils recommends no packages.

klibc-utils suggests no packages.

-- no debconf information

-- debsums errors found:
debsums: changed file /usr/lib/klibc/bin/fstype (from klibc-utils package)

[toc] | [next] | [standalone]

#66933

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 upstream fixed-upstream patch

On Wed, 2020-04-29 at 14:12 +1000, Russell Coker wrote:
> Package: klibc-utils
> Version: 2.0.7-1
> Severity: normal
> 
> root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
> Segmentation fault
> root@sevm:~/pol# execstack -c /usr/lib/klibc/bin/fstype
> root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
> FSTYPE=btrfs
> FSSIZE=719360278528
> 
> The fstype program is listed as needing an executable stack, which will cause
> it to crash when run on a system with a security policy preventing executable
> stacke.  If you clear the execstack bit it appears to work correctly.
[...]

I've fixed this upstream but not made a new release yet:

https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9d8d648e604026b32cad00a84ed6c29cbd157641

Ben.

-- 
Ben Hutchings
Horngren's Observation:
              Among economists, the real world is often a special case.

[toc] | [prev] | [next] | [standalone]

#66934 — Processed: Re: Bug#959070: klibc-utils: fstype falsely claims to need an executable stack

Processing control commands:

> tag -1 upstream fixed-upstream patch
Bug #959070 [klibc-utils] klibc-utils: fstype falsely claims to need an executable stack
Added tag(s) patch, upstream, and fixed-upstream.

-- 
959070: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959070
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#66951

Helge Deller dixit:

>On hppa/parisc we still need executable stacks for the signal
>trampoline return code. Might your patch then maybe break fstype on
>hppa? I didn't tested it...

I think it only changed the assembly parts of the library to
signal to the linker that there’s no need for an executable
stack on their account, but the signal handling code should¹
add one on hppa then.

① also not tested, maybe you should ☻

bye,
//mirabilos
--  
When he found out that the m68k port was in a pretty bad shape, he did
not, like many before him, shrug and move on; instead, he took it upon
himself to start compiling things, just so he could compile his shell.
How's that for dedication. -- Wouter, about my Debian/m68k revival

[toc] | [prev] | [next] | [standalone]

#66955

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2020-04-29 at 20:41 +0200, Helge Deller wrote:
> On 29.04.20 15:36, Ben Hutchings wrote:
> > Control: tag -1 upstream fixed-upstream patch
> > 
> > On Wed, 2020-04-29 at 14:12 +1000, Russell Coker wrote:
> > > Package: klibc-utils
> > > Version: 2.0.7-1
> > > Severity: normal
> > > 
> > > root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
> > > Segmentation fault
> > > root@sevm:~/pol# execstack -c /usr/lib/klibc/bin/fstype
> > > root@sevm:~/pol# /usr/lib/klibc/bin/fstype < /dev/sda2
> > > FSTYPE=btrfs
> > > FSSIZE=719360278528
> > > 
> > > The fstype program is listed as needing an executable stack, which will cause
> > > it to crash when run on a system with a security policy preventing executable
> > > stacke.  If you clear the execstack bit it appears to work correctly.
> > [...]
> > 
> > I've fixed this upstream but not made a new release yet:
> > 
> > https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9d8d648e604026b32cad00a84ed6c29cbd157641
> 
> On hppa/parisc we still need executable stacks for the signal trampoline return code. 
> Might your patch then maybe break fstype on hppa? 
> I didn't tested it...

Kees Cook mentioned that too:
https://lists.zytor.com/archives/klibc/2020-February/004273.html
but I couldn't find any sign of it in the current code.

Looking again, I see that I was confused: the *kernel* creates these
trampolines on the stack.  On some architecturers (m68k and parisc)
this is done unconditionally; on others (alpha, s390, and sparc 32-bit) 
it's done if sa_restorer is not set (and we don't set it for them).

Presumably m68k and parisc are actually fine at the moment, as gcc
won't disable execstack on its output.  However alpha, s390, and sparc
will be broken if gcc is configured assuming the C library will set
sa_restorer and it disables execstack.

I shall make the execstack flag setting arch-dependent.

Ben.

-- 
Ben Hutchings
Horngren's Observation:
              Among economists, the real world is often a special case.

[toc] | [prev] | [next] | [standalone]

#67810 — Bug#959070: marked as done (klibc-utils: fstype falsely claims to need an executable stack)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Fri, 21 Aug 2020 00:48:48 +0000
with message-id <E1k8vEe-0007hO-UZ@fasolo.debian.org>
and subject line Bug#959070: fixed in klibc 2.0.8-1
has caused the Debian Bug report #959070,
regarding klibc-utils: fstype falsely claims to need an executable stack
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
959070: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959070
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web