Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #84013 > unrolled thread
| Started by | Alfred Agrell <blubban@gmail.com> |
|---|---|
| First post | 2024-09-17 11:50 +0200 |
| Last post | 2024-09-25 23:00 +0200 |
| Articles | 5 — 4 participants |
Back to article view | Back to linux.debian.kernel
Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot Alfred Agrell <blubban@gmail.com> - 2024-09-17 11:50 +0200
Processed: Re: Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-09-24 01:40 +0200
Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot Ben Hutchings <ben@decadent.org.uk> - 2024-09-24 01:40 +0200
Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot Salvatore Bonaccorso <carnil@debian.org> - 2024-09-25 23:00 +0200
Processed: Re: Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot "Debian Bug Tracking System" <owner@bugs.debian.org> - 2024-09-25 23:00 +0200
| From | Alfred Agrell <blubban@gmail.com> |
|---|---|
| Date | 2024-09-17 11:50 +0200 |
| Subject | Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot |
| Message-ID | <JnD0l-cUcI-11@gated-at.bofh.it> |
Package: src:linux
Version: 6.1.106-3
Severity: normal
X-Debbugs-Cc: blubban@gmail.com
Dear Maintainer,
Please run the following program (as root, so the chroot succeeds):
#define _GNU_SOURCE
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
int main(int argc, char** argv)
{
chdir("/lib/");
if (chroot("/lib/") != 0)
perror("chroot (needs root)");
execveat(open("./x86_64-linux-gnu/ld-linux-x86-64.so.2", O_RDONLY), "", NULL, NULL, AT_EMPTY_PATH);
perror("execveat");
}
Result:
The execveat returns ENOENT.
Running
bpftrace -e 'kretfunc:tomoyo_realpath_nofollow { printf("a %s %p\n", comm, retval); } kretprobe:tomoyo_bprm_check_security { printf("b %s %d\n", comm, retval); } kretprobe:bprm_execve { printf("c %s %d\n", comm, retval); }' -c './a.out'
reveals that it's the TOMOYO LSM rejecting the operation.
Expected:
Since TOMOYO is not configured (/sys/kernel/security/tomoyo/profile is just a PROFILE_VERSION), it should permit everything.
I originally discovered this with a memfd, but simplified it a bit.
I also tested kernel version linux-image-6.10.6+bpo-amd64; the issue reproduces with no changes.
-- Package-specific info:
** Version:
Linux version 6.1.0-25-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.106-3 (2024-08-26)
** Command line:
BOOT_IMAGE=/boot/vmlinuz-6.1.0-25-amd64 root=UUID=3f03a19e-1f7e-43c8-a4e9-6297f87ce127 ro quiet
** Not tainted
** Kernel log:
[ 1.986370] input: HDA Intel PCH Front Mic as /devices/pci0000:00/0000:00:1f.3/sound/card0/input11
[ 1.986386] input: HDA Intel PCH Line as /devices/pci0000:00/0000:00:1f.3/sound/card0/input12
[ 1.986402] input: HDA Intel PCH Line Out as /devices/pci0000:00/0000:00:1f.3/sound/card0/input13
[ 1.986419] input: HDA Intel PCH Front Headphone as /devices/pci0000:00/0000:00:1f.3/sound/card0/input14
[ 1.986435] input: HDA Intel PCH HDMI/DP,pcm=3 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input15
[ 1.986451] input: HDA Intel PCH HDMI/DP,pcm=7 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input16
[ 1.986468] input: HDA Intel PCH HDMI/DP,pcm=8 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input17
[ 1.986485] input: HDA Intel PCH HDMI/DP,pcm=9 as /devices/pci0000:00/0000:00:1f.3/sound/card0/input18
[ 2.067683] usb 1-14: New USB device found, idVendor=04ca, idProduct=3015, bcdDevice= 0.01
[ 2.067691] usb 1-14: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 2.120659] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.120687] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 2.120690] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 2.120694] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 2.120711] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.120726] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 2.127450] alg: No test for fips(ansi_cprng) (fips_ansi_cprng)
[ 2.154261] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.154288] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 2.154290] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 2.154293] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 2.154301] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.154314] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 2.154316] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.154329] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 2.154331] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.154344] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 2.154345] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.154358] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 2.179535] Bluetooth: Core ver 2.22
[ 2.179548] NET: Registered PF_BLUETOOTH protocol family
[ 2.179549] Bluetooth: HCI device and connection manager initialized
[ 2.179551] Bluetooth: HCI socket layer initialized
[ 2.179553] Bluetooth: L2CAP socket layer initialized
[ 2.179555] Bluetooth: SCO socket layer initialized
[ 2.184596] usbcore: registered new interface driver btusb
[ 2.184884] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[ 2.254218] ath10k_pci 0000:03:00.0: firmware: failed to load ath10k/pre-cal-pci-0000:03:00.0.bin (-2)
[ 2.254266] firmware_class: See https://wiki.debian.org/Firmware for information about missing firmware
[ 2.254321] ath10k_pci 0000:03:00.0: firmware: failed to load ath10k/pre-cal-pci-0000:03:00.0.bin (-2)
[ 2.254372] ath10k_pci 0000:03:00.0: firmware: failed to load ath10k/cal-pci-0000:03:00.0.bin (-2)
[ 2.254415] ath10k_pci 0000:03:00.0: firmware: failed to load ath10k/cal-pci-0000:03:00.0.bin (-2)
[ 2.256737] ath10k_pci 0000:03:00.0: firmware: direct-loading firmware ath10k/QCA9377/hw1.0/firmware-6.bin
[ 2.256746] ath10k_pci 0000:03:00.0: qca9377 hw1.1 target 0x05020001 chip_id 0x003821ff sub 11ad:08a6
[ 2.256750] ath10k_pci 0000:03:00.0: kconfig debug 0 debugfs 0 tracing 0 dfs 0 testmode 0
[ 2.257752] ath10k_pci 0000:03:00.0: firmware ver WLAN.TF.2.1-00021-QCARMSWP-1 api 6 features wowlan,ignore-otp crc32 42e41877
[ 2.322632] ath10k_pci 0000:03:00.0: firmware: direct-loading firmware ath10k/QCA9377/hw1.0/board-2.bin
[ 2.322756] ath10k_pci 0000:03:00.0: board_file api 2 bmi_id N/A crc32 8aedfa4a
[ 2.420296] ath10k_pci 0000:03:00.0: htt-ver 3.56 wmi-op 4 htt-op 3 cal otp max-sta 32 raw 0 hwcrypto 1
[ 2.507568] ath: EEPROM regdomain: 0x69
[ 2.507571] ath: EEPROM indicates we should expect a direct regpair map
[ 2.507572] ath: Country alpha2 being used: 00
[ 2.507573] ath: Regpair used: 0x69
[ 2.534050] ath10k_pci 0000:03:00.0 wlp3s0: renamed from wlan0
[ 2.645690] EXT4-fs (nvme0n1p4): mounted filesystem with ordered data mode. Quota mode: none.
[ 2.648220] EXT4-fs (nvme0n1p3): mounted filesystem with ordered data mode. Quota mode: none.
[ 2.673043] audit: type=1400 audit(1726529497.707:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-xpdfimport" pid=687 comm="apparmor_parser"
[ 2.673138] audit: type=1400 audit(1726529497.707:3): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-senddoc" pid=685 comm="apparmor_parser"
[ 2.673371] audit: type=1400 audit(1726529497.707:4): apparmor="STATUS" operation="profile_load" profile="unconfined" name="libreoffice-oosplash" pid=684 comm="apparmor_parser"
[ 2.673759] audit: type=1400 audit(1726529497.707:5): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe" pid=680 comm="apparmor_parser"
[ 2.673761] audit: type=1400 audit(1726529497.707:6): apparmor="STATUS" operation="profile_load" profile="unconfined" name="nvidia_modprobe//kmod" pid=680 comm="apparmor_parser"
[ 2.673859] audit: type=1400 audit(1726529497.711:7): apparmor="STATUS" operation="profile_load" profile="unconfined" name="lsb_release" pid=679 comm="apparmor_parser"
[ 2.674277] audit: type=1400 audit(1726529497.711:8): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/bin/man" pid=682 comm="apparmor_parser"
[ 2.674284] audit: type=1400 audit(1726529497.711:9): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_filter" pid=682 comm="apparmor_parser"
[ 2.674289] audit: type=1400 audit(1726529497.711:10): apparmor="STATUS" operation="profile_load" profile="unconfined" name="man_groff" pid=682 comm="apparmor_parser"
[ 2.822853] NET: Registered PF_QIPCRTR protocol family
[ 2.827339] r8169 0000:02:00.0: firmware: failed to load rtl_nic/rtl8168h-2.fw (-2)
[ 2.827898] r8169 0000:02:00.0: firmware: failed to load rtl_nic/rtl8168h-2.fw (-2)
[ 2.828418] r8169 0000:02:00.0: Direct firmware load for rtl_nic/rtl8168h-2.fw failed with error -2
[ 2.828421] r8169 0000:02:00.0: Unable to load firmware rtl_nic/rtl8168h-2.fw (-2)
[ 2.857900] Generic FE-GE Realtek PHY r8169-0-200:00: attached PHY driver (mii_bus:phy_addr=r8169-0-200:00, irq=MAC)
[ 2.982412] r8169 0000:02:00.0 enp2s0: Link is Down
[ 2.984725] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 2.984743] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 2.984745] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 2.984747] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 3.023900] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.023915] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 3.023916] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 3.023917] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 3.387543] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 3.388147] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.388162] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 3.388163] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 3.388165] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 3.427794] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.427811] pcieport 0000:00:1c.5: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID)
[ 3.427812] pcieport 0000:00:1c.5: device [8086:43bd] error status/mask=00000001/00002000
[ 3.427814] pcieport 0000:00:1c.5: [ 0] RxErr (First)
[ 3.427820] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.427832] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 3.427833] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.427845] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 3.427846] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.427857] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 3.427858] pcieport 0000:00:1c.5: AER: Multiple Corrected error message received from 0000:00:1c.5
[ 3.427870] pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
[ 4.529403] r8169 0000:02:00.0 enp2s0: Link is Up - 100Mbps/Full - flow control rx/tx
[ 4.529458] IPv6: ADDRCONF(NETDEV_CHANGE): enp2s0: link becomes ready
[ 10.445478] exFAT-fs (sda1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
** Model information
sys_vendor: Acer
product_name: Aspire XC-1660
product_version:
chassis_vendor: Acer
chassis_version:
bios_vendor: American Megatrends Inc.
bios_version: R01-A2
board_vendor: Acer
board_name: Aspire XC-1660
board_version: V:1.1
** Loaded modules:
exfat
xt_CHECKSUM
xt_MASQUERADE
xt_conntrack
ipt_REJECT
nf_reject_ipv4
xt_tcpudp
nft_compat
nft_chain_nat
nf_nat
nf_conntrack
nf_defrag_ipv6
nf_defrag_ipv4
nf_tables
libcrc32c
nfnetlink
bridge
stp
llc
qrtr
binfmt_misc
nls_ascii
nls_cp437
vfat
fat
btusb
btrtl
btbcm
btintel
btmtk
bluetooth
jitterentropy_rng
ctr
drbg
ansi_cprng
ecdh_generic
joydev
ecc
snd_sof_pci_intel_tgl
ath10k_pci
snd_sof_intel_hda_common
ath10k_core
soundwire_intel
intel_rapl_msr
soundwire_generic_allocation
intel_rapl_common
soundwire_cadence
x86_pkg_temp_thermal
snd_sof_intel_hda
intel_powerclamp
ath
snd_sof_pci
snd_hda_codec_hdmi
coretemp
snd_sof_xtensa_dsp
mac80211
snd_sof
snd_sof_utils
kvm_intel
snd_soc_hdac_hda
snd_hda_ext_core
snd_soc_acpi_intel_match
snd_soc_acpi
libarc4
snd_hda_codec_realtek
snd_soc_core
snd_hda_codec_generic
snd_compress
cfg80211
ledtrig_audio
kvm
soundwire_bus
irqbypass
snd_hda_intel
snd_intel_dspcfg
snd_intel_sdw_acpi
ghash_clmulni_intel
snd_hda_codec
cryptd
snd_hda_core
sha512_ssse3
sd_mod
snd_hwdep
sha512_generic
sg
snd_pcm
sha256_ssse3
mei_hdcp
sha1_ssse3
snd_timer
iTCO_wdt
intel_cstate
uas
usb_storage
snd
intel_uncore
mei_me
intel_pmc_bxt
ee1004
rfkill
intel_wmi_thunderbolt
iTCO_vendor_support
soundcore
mei
watchdog
serio_raw
pcspkr
wmi_bmof
intel_pmc_core
acpi_pad
evdev
acpi_tad
fuse
dm_mod
loop
efi_pstore
configfs
efivarfs
ip_tables
x_tables
autofs4
ext4
crc16
mbcache
jbd2
crc32c_generic
hid_generic
usbhid
hid
i915
drm_buddy
i2c_algo_bit
drm_display_helper
cec
rc_core
ttm
drm_kms_helper
ahci
xhci_pci
nvme
libahci
xhci_hcd
nvme_core
t10_pi
drm
libata
r8169
usbcore
realtek
crc64_rocksoft
mdio_devres
crc64
scsi_mod
psmouse
libphy
crc32_pclmul
crc_t10dif
crc32c_intel
i2c_i801
crct10dif_generic
crct10dif_pclmul
i2c_smbus
crct10dif_common
scsi_common
usb_common
fan
video
wmi
button
** Network interface configuration:
*** /etc/network/interfaces:
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
** Network status:
*** IP interfaces and addresses:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 1c:69:7a:98:75:b8 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic noprefixroute enp2s0
valid_lft 7089sec preferred_lft 7089sec
inet6 fe80::1e69:7aff:fe98:75b8/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: wlp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 0a:8a:b1:87:4d:84 brd ff:ff:ff:ff:ff:ff permaddr 74:4c:a1:80:ca:0d
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 52:54:00:9f:0c:98 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
*** Device statistics:
Inter-| Receive | Transmit
face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed
lo: 2264 18 0 0 0 0 0 0 2264 18 0 0 0 0 0 0
enp2s0: 2891112 3581 0 0 0 0 0 2 302835 2817 0 0 0 0 0 0
wlp3s0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
virbr0: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation Device [8086:4c43] (rev 01)
DeviceName: Onboard Realtek Ethernet
Subsystem: Acer Incorporated [ALI] Device [1025:1515]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
IOMMU group: 1
Expansion ROM at <ignored>
Kernel driver in use: icl_uncore
00:02.0 VGA compatible controller [0300]: Intel Corporation RocketLake-S GT1 [UHD Graphics 750] [8086:4c8a] (rev 04) (prog-if 00 [VGA controller])
DeviceName: Onboard Intel Graphics
Subsystem: Acer Incorporated [ALI] RocketLake-S GT1 [UHD Graphics 750] [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 144
IOMMU group: 0
Region 0: Memory at 6000000000 (64-bit, non-prefetchable) [size=16M]
Region 2: Memory at 4000000000 (64-bit, prefetchable) [size=256M]
Region 4: I/O ports at 4000 [size=64]
Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
Capabilities: <access denied>
Kernel driver in use: i915
Kernel modules: i915
00:14.0 USB controller [0c03]: Intel Corporation Tiger Lake-H USB 3.2 Gen 2x1 xHCI Host Controller [8086:43ed] (rev 11) (prog-if 30 [XHCI])
Subsystem: Acer Incorporated [ALI] Tiger Lake-H USB 3.2 Gen 2x1 xHCI Host Controller [1025:1515]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 128
IOMMU group: 2
Region 0: Memory at 6001100000 (64-bit, non-prefetchable) [size=64K]
Capabilities: <access denied>
Kernel driver in use: xhci_hcd
Kernel modules: xhci_pci
00:14.2 RAM memory [0500]: Intel Corporation Tiger Lake-H Shared SRAM [8086:43ef] (rev 11)
Subsystem: Acer Incorporated [ALI] Tiger Lake-H Shared SRAM [1025:1515]
Control: I/O- Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
IOMMU group: 2
Region 0: Memory at 6001114000 (64-bit, non-prefetchable) [disabled] [size=16K]
Region 2: Memory at 600111a000 (64-bit, non-prefetchable) [disabled] [size=4K]
Capabilities: <access denied>
00:16.0 Communication controller [0780]: Intel Corporation Tiger Lake-H Management Engine Interface [8086:43e0] (rev 11)
Subsystem: Acer Incorporated [ALI] Tiger Lake-H Management Engine Interface [1025:1515]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 145
IOMMU group: 3
Region 0: Memory at 6001119000 (64-bit, non-prefetchable) [size=4K]
Capabilities: <access denied>
Kernel driver in use: mei_me
Kernel modules: mei_me
00:17.0 SATA controller [0106]: Intel Corporation Device [8086:43d2] (rev 11) (prog-if 01 [AHCI 1.0])
DeviceName: Onboard Intel SATA Controller
Subsystem: Acer Incorporated [ALI] Device [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 126
IOMMU group: 4
Region 0: Memory at 9fc00000 (32-bit, non-prefetchable) [size=8K]
Region 1: Memory at 9fc03000 (32-bit, non-prefetchable) [size=256]
Region 2: I/O ports at 4090 [size=8]
Region 3: I/O ports at 4080 [size=4]
Region 4: I/O ports at 4060 [size=32]
Region 5: Memory at 9fc02000 (32-bit, non-prefetchable) [size=2K]
Capabilities: <access denied>
Kernel driver in use: ahci
Kernel modules: ahci
00:1b.0 PCI bridge [0604]: Intel Corporation Device [8086:43c4] (rev 11) (prog-if 00 [Normal decode])
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 122
IOMMU group: 5
Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
I/O behind bridge: [disabled] [16-bit]
Memory behind bridge: 9fb00000-9fbfffff [size=1M] [32-bit]
Prefetchable memory behind bridge: [disabled] [64-bit]
Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16+ MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
Kernel driver in use: pcieport
00:1c.0 PCI bridge [0604]: Intel Corporation Tiger Lake-H PCI Express Root Port #5 [8086:43bc] (rev 11) (prog-if 00 [Normal decode])
Subsystem: Acer Incorporated [ALI] Tiger Lake-H PCI Express Root Port [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 123
IOMMU group: 6
Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
I/O behind bridge: 3000-3fff [size=4K] [16-bit]
Memory behind bridge: 9fa00000-9fafffff [size=1M] [32-bit]
Prefetchable memory behind bridge: [disabled] [64-bit]
Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16+ MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
Kernel driver in use: pcieport
00:1c.5 PCI bridge [0604]: Intel Corporation Device [8086:43bd] (rev 11) (prog-if 00 [Normal decode])
Subsystem: Acer Incorporated [ALI] Device [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin B routed to IRQ 124
IOMMU group: 7
Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
I/O behind bridge: [disabled] [16-bit]
Memory behind bridge: 9f800000-9f9fffff [size=2M] [32-bit]
Prefetchable memory behind bridge: [disabled] [64-bit]
Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort+ <SERR- <PERR-
BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16+ MAbort- >Reset- FastB2B-
PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
Capabilities: <access denied>
Kernel driver in use: pcieport
00:1f.0 ISA bridge [0601]: Intel Corporation B560 LPC/eSPI Controller [8086:4387] (rev 11)
Subsystem: Acer Incorporated [ALI] B560 LPC/eSPI Controller [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
IOMMU group: 8
00:1f.3 Audio device [0403]: Intel Corporation Tiger Lake-H HD Audio Controller [8086:43c8] (rev 11)
Subsystem: Acer Incorporated [ALI] Tiger Lake-H HD Audio Controller [1025:1515]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 32, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 146
IOMMU group: 8
Region 0: Memory at 6001110000 (64-bit, non-prefetchable) [size=16K]
Region 4: Memory at 6001000000 (64-bit, non-prefetchable) [size=1M]
Capabilities: <access denied>
Kernel driver in use: snd_hda_intel
Kernel modules: snd_hda_intel, snd_sof_pci_intel_tgl
00:1f.4 SMBus [0c05]: Intel Corporation Tiger Lake-H SMBus Controller [8086:43a3] (rev 11)
Subsystem: Acer Incorporated [ALI] Tiger Lake-H SMBus Controller [1025:1515]
Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Interrupt: pin A routed to IRQ 16
IOMMU group: 8
Region 0: Memory at 6001118000 (64-bit, non-prefetchable) [size=256]
Region 4: I/O ports at efa0 [size=32]
Kernel driver in use: i801_smbus
Kernel modules: i2c_i801
00:1f.5 Serial bus controller [0c80]: Intel Corporation Tiger Lake-H SPI Controller [8086:43a4] (rev 11)
Subsystem: Acer Incorporated [ALI] Tiger Lake-H SPI Controller [1025:1515]
Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
IOMMU group: 8
Region 0: Memory at 9fc04000 (32-bit, non-prefetchable) [size=4K]
01:00.0 Non-Volatile memory controller [0108]: Micron Technology Inc 2210 NVMe SSD [Cobain] [1344:5404] (rev 03) (prog-if 02 [NVM Express])
Subsystem: Micron Technology Inc 2210 NVMe SSD [Cobain] [1344:2100]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 16
IOMMU group: 9
Region 0: Memory at 9fb00000 (64-bit, non-prefetchable) [size=16K]
Capabilities: <access denied>
Kernel driver in use: nvme
Kernel modules: nvme
02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller [10ec:8168] (rev 15)
Subsystem: Acer Incorporated [ALI] RTL8111/8168/8211/8411 PCI Express Gigabit Ethernet Controller [1025:1515]
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 16
IOMMU group: 10
Region 0: I/O ports at 3000 [size=256]
Region 2: Memory at 9fa04000 (64-bit, non-prefetchable) [size=4K]
Region 4: Memory at 9fa00000 (64-bit, non-prefetchable) [size=16K]
Capabilities: <access denied>
Kernel driver in use: r8169
Kernel modules: r8169
03:00.0 Network controller [0280]: Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter [168c:0042] (rev 31)
Subsystem: Lite-On Communications Inc Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter [11ad:08a6]
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0, Cache Line Size: 64 bytes
Interrupt: pin A routed to IRQ 147
IOMMU group: 11
Region 0: Memory at 9f800000 (64-bit, non-prefetchable) [size=2M]
Capabilities: <access denied>
Kernel driver in use: ath10k_pci
Kernel modules: ath10k_pci
** USB devices:
Bus 002 Device 002: ID 0bc2:2030 Seagate RSS LLC Expansion HDD
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 003: ID 046d:c34b Logitech, Inc. USB Keyboard
Bus 001 Device 002: ID 046d:c077 Logitech, Inc. Mouse
Bus 001 Device 004: ID 04ca:3015 Lite-On Technology Corp. Qualcomm Atheros QCA9377 Bluetooth
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
-- System Information:
Debian Release: 12.7
APT prefers stable-security
APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.1.0-25-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages linux-image-6.1.0-25-amd64 depends on:
ii initramfs-tools [linux-initramfs-tool] 0.142+deb12u1
ii kmod 30+20221128-1
ii linux-base 4.9
Versions of packages linux-image-6.1.0-25-amd64 recommends:
ii apparmor 3.0.8-3
ii firmware-linux-free 20200122-1
Versions of packages linux-image-6.1.0-25-amd64 suggests:
pn debian-kernel-handbook <none>
ii grub-efi-amd64 2.06-13+deb12u1
pn linux-doc-6.1 <none>
Versions of packages linux-image-6.1.0-25-amd64 is related to:
pn firmware-amd-graphics <none>
ii firmware-atheros 20230210-5
pn firmware-bnx2 <none>
pn firmware-bnx2x <none>
pn firmware-brcm80211 <none>
pn firmware-cavium <none>
pn firmware-intel-sound <none>
pn firmware-intelwimax <none>
pn firmware-ipw2x00 <none>
pn firmware-ivtv <none>
pn firmware-iwlwifi <none>
pn firmware-libertas <none>
pn firmware-linux-nonfree <none>
ii firmware-misc-nonfree 20230210-5
pn firmware-myricom <none>
pn firmware-netxen <none>
pn firmware-qlogic <none>
pn firmware-realtek <none>
pn firmware-samsung <none>
pn firmware-siano <none>
pn firmware-ti-connectivity <none>
pn xen-hypervisor <none>
-- no debconf information
[toc] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2024-09-24 01:40 +0200 |
| Subject | Processed: Re: Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot |
| Message-ID | <Jq0OR-enF6-1@gated-at.bofh.it> |
| In reply to | #84013 |
Processing control commands: > tag -1 upstream Bug #1082001 [src:linux] linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot Added tag(s) upstream. -- 1082001: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082001 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Date | 2024-09-24 01:40 +0200 |
| Message-ID | <Jq0OR-enF6-3@gated-at.bofh.it> |
| In reply to | #84013 |
[Multipart message — attachments visible in raw view] — view raw
Control: tag -1 upstream
On Tue, 2024-09-17 at 01:45 +0200, Alfred Agrell wrote:
> Package: src:linux
> Version: 6.1.106-3
> Severity: normal
> X-Debbugs-Cc: blubban@gmail.com
>
> Dear Maintainer,
>
> Please run the following program (as root, so the chroot succeeds):
>
>
> #define _GNU_SOURCE
> #include <unistd.h>
> #include <fcntl.h>
> #include <stdio.h>
>
> int main(int argc, char** argv)
> {
> chdir("/lib/");
> if (chroot("/lib/") != 0)
> perror("chroot (needs root)");
> execveat(open("./x86_64-linux-gnu/ld-linux-x86-64.so.2", O_RDONLY), "", NULL, NULL, AT_EMPTY_PATH);
> perror("execveat");
> }
[...]
When you pass an fd other than AT_FDCWD to execveat(), the fd and
filename are translated internally to a filename starting with
"/dev/fd/". It's noted in the manual page that this affects the way
script interpreters are called. Another consequence is that when
TOMOYO tries to look up that filename it finds that it does not exist.
I verified that if /dev and /proc are mounted in the chroot your test
program works.
This isn't a high priority for us, but if you report this upstream it
might be fixed. You'll need to subscribe to the TOMOYO mailing list at
<https://lists.osdn.me/mailman/listinfo/tomoyo-users-en> and then send
your report there.
Ben.
--
Ben Hutchings
Knowledge is power. France is bacon.
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2024-09-25 23:00 +0200 |
| Message-ID | <JqHh7-eO9J-5@gated-at.bofh.it> |
| In reply to | #84094 |
Control: forwarded -1 https://osdn.net/projects/tomoyo/lists/archive/users-en/2024-September/000765.html
Hi,
On Tue, Sep 24, 2024 at 01:28:19AM +0200, Ben Hutchings wrote:
> Control: tag -1 upstream
>
> On Tue, 2024-09-17 at 01:45 +0200, Alfred Agrell wrote:
> > Package: src:linux
> > Version: 6.1.106-3
> > Severity: normal
> > X-Debbugs-Cc: blubban@gmail.com
> >
> > Dear Maintainer,
> >
> > Please run the following program (as root, so the chroot succeeds):
> >
> >
> > #define _GNU_SOURCE
> > #include <unistd.h>
> > #include <fcntl.h>
> > #include <stdio.h>
> >
> > int main(int argc, char** argv)
> > {
> > chdir("/lib/");
> > if (chroot("/lib/") != 0)
> > perror("chroot (needs root)");
> > execveat(open("./x86_64-linux-gnu/ld-linux-x86-64.so.2", O_RDONLY), "", NULL, NULL, AT_EMPTY_PATH);
> > perror("execveat");
> > }
> [...]
>
> When you pass an fd other than AT_FDCWD to execveat(), the fd and
> filename are translated internally to a filename starting with
> "/dev/fd/". It's noted in the manual page that this affects the way
> script interpreters are called. Another consequence is that when
> TOMOYO tries to look up that filename it finds that it does not exist.
> I verified that if /dev and /proc are mounted in the chroot your test
> program works.
>
> This isn't a high priority for us, but if you report this upstream it
> might be fixed. You'll need to subscribe to the TOMOYO mailing list at
> <https://lists.osdn.me/mailman/listinfo/tomoyo-users-en> and then send
> your report there.
This was reported upstream at
https://osdn.net/projects/tomoyo/lists/archive/users-en/2024-September/000765.html
Regards
Salvatore
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2024-09-25 23:00 +0200 |
| Subject | Processed: Re: Bug#1082001: linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot |
| Message-ID | <JqHh7-eO9J-3@gated-at.bofh.it> |
| In reply to | #84013 |
Processing control commands: > forwarded -1 https://osdn.net/projects/tomoyo/lists/archive/users-en/2024-September/000765.html Bug #1082001 [src:linux] linux-image-6.1.0-25-amd64: TOMOYO LSM rejects execveat(AT_EMPTY_PATH) inside chroot Set Bug forwarded-to-address to 'https://osdn.net/projects/tomoyo/lists/archive/users-en/2024-September/000765.html'. -- 1082001: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082001 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web