[uml-devel] FAQ: 2.6.9 - why "make linux ARCH=um" fails?

[uml-devel] FAQ: 2.6.9 - why "make linux ARCH=um" fails?

[BlaisorBlade]

Q: Why does "make linux ARCH=um" fail?
R: Just use "make vmlinux ARCH=um", which creates the "vmlinux" binary, which 
is what you must use.

Or even simply do "make ARCH=um", which is the same as:
make vmlinux modules ARCH=um

* Q: Why did you do this change?
R: This is the result of a change which allows /proc/kallsyms to work, 
allowing UML to print stack traces on panic.

* Q: Why did not you added a notice about "make linux ARCH=um"?
R: I did that, only it was merged after 2.6.9.

* Q: What did you do?
R: within next version, each time you do "make linux ARCH=um", a hardlink is 
created from linux to vmlinux. I.e. they are two copies of the same file, 
sharing the content. If you do a "make vmlinux ARCH=um", instead of leaving a 
stale linux file with the old content, or relinking it, we simply remove the 
vmlinux file. It is assumed that if you do "make vmlinux ARCH=um", you 
already know of this change.

* Q: Why didn't you do simply "mv vmlinux linux"?
R: because that way another "make linux" would relink again the files.

Bye
-- 
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

[uml-devel] mm->dumpable issue (was: Re: /proc/mm patches)

[Blaisorblade]

[-- Attachment #1: Type: text/plain, Size: 810 bytes --]

On Wednesday 03 November 2004 00:00, Michael Richardson wrote:
> Is there a final patch that you think might work, and deal with the
> mm->dumpable flag issue?

> I was all set to test the previous patch, but then you said not to...
On top of -V7 you can apply the attached patch. I'm almost sure it works. The 
problem is that I have not the certainty that it is not exploitable, i.e. it 
can be used to gain access to root privileges. I am almost sure it is not... 
but please *avoid* using a setuid UML binary with this patch (it is not a 
good idea, anyway, but it is even worse with this patch. I believe that to 
exploit it, if at all possible, having a setuid binary which is coded to use 
SKAS (either UML or a malicious program).

-- 
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729

[-- Attachment #2: fix-dumpable-handling.patch --]
[-- Type: text/x-diff, Size: 2018 bytes --]


From: Paolo 'Blaisorblade' Giarrusso <blaisorblade_spam@yahoo.it>, Henrik Nordstrom <uml@hno.marasystems.com>, Michael Richardson <mcr@sandelman.ottawa.on.ca>

When a child mm is created by opening /proc/mm, without this patch its
mm->dumpable flag is left set to 0, even when there is no reason to do so.

This way, for instance, if <pid> is the pid of a userspace thread,
/proc/<pid> is only readable by root (which was the original reason letting
this be diagnosed by Michael Richardson).

Paolo and Henrik discussed about this in detail, finally Paolo wrote the patch
and sent it for comment.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade_spam@yahoo.it>
---

 vanilla-linux-2.6.9-paolo/arch/i386/kernel/ptrace.c |    8 ++++++++
 vanilla-linux-2.6.9-paolo/mm/proc_mm.c              |    2 ++
 2 files changed, 10 insertions(+)

diff -puN mm/proc_mm.c~fix-dumpable-handling mm/proc_mm.c
--- vanilla-linux-2.6.9/mm/proc_mm.c~fix-dumpable-handling	2004-10-26 00:54:35.478864480 +0200
+++ vanilla-linux-2.6.9-paolo/mm/proc_mm.c	2004-10-26 00:54:35.482863872 +0200
@@ -126,6 +126,8 @@ static int open_proc_mm(struct inode *in
 
 	init_new_empty_context(mm);
 	arch_pick_mmap_layout(mm);
+	mm->dumpable = current->mm->dumpable;
+	wmb();
 
 	spin_lock(&mmlist_lock);
 	list_add(&mm->mmlist, &current->mm->mmlist);
diff -puN arch/i386/kernel/ptrace.c~fix-dumpable-handling arch/i386/kernel/ptrace.c
--- vanilla-linux-2.6.9/arch/i386/kernel/ptrace.c~fix-dumpable-handling	2004-10-26 00:54:35.480864176 +0200
+++ vanilla-linux-2.6.9-paolo/arch/i386/kernel/ptrace.c	2004-10-26 00:54:35.483863720 +0200
@@ -568,6 +568,14 @@ asmlinkage int sys_ptrace(long request, 
 			break;
 		}
 
+		/* Let's be safe. If we are ptraced from a non-dumpable process,
+		 * let's not be dumpable. Don't try to be smart and turn
+		 * current->dumpable to 1: it may be unsafe.*/
+		if (!current->dumpable) {
+			new->dumpable = 0;
+			wmb();
+		}
+
 		atomic_inc(&new->mm_users);
 		child->mm = new;
 		child->active_mm = new;
_

Re: [uml-devel] mm->dumpable issue (was: Re: /proc/mm patches)

[Michael Richardson]

-----BEGIN PGP SIGNED MESSAGE-----


Paolo, I applied the fix-dumpable-handling patch to 2.4.27, specifically
the patch to proc_mm.c. The ptrace.c patch didn't apply to 2.4.27,
probably due to 2.4/2.6 differences, but I realized that this just
fixed ptrace to be safe.

%ps ax | grep linux
  778 pts/1    S+     0:02 /0i/sandboxes/pool/aggr/east/linux 
  780 pts/1    T+     0:00 [linux]
  785 pts/1    S+     0:00 /0i/sandboxes/pool/aggr/east/linux 
  786 pts/1    S+     0:00 /0i/sandboxes/pool/aggr/east/linux 
  787 pts/1    S+     0:00 /0i/sandboxes/pool/aggr/east/linux 

gimli-[/0i/sandboxes/aggr] mcr 1011 %ls -l /proc/{778,780,785,786,787}/environ
- -r--------  1 mcr mcr 0 Nov 20 14:57 /proc/778/environ
- -r--------  1 mcr mcr 0 Nov 20 14:57 /proc/780/environ
- -r--------  1 mcr mcr 0 Nov 20 14:57 /proc/785/environ
- -r--------  1 mcr mcr 0 Nov 20 14:57 /proc/786/environ
- -r--------  1 mcr mcr 0 Nov 20 14:57 /proc/787/environ

So, I think that this worked to fix the ownership.
Whether or not it is safe, I can't say. But, at least, you know that
it has a positive effect.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr@xelerance.com      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBQZ+hxYqHRg3pndX9AQE8dgP+MIs/BN8EB2z8G5pp7uDFUQE+4lk9jksa
CraMfxGjvr9qnSJnu3R28qQj2b9CXVP5TV24ia1MBFSUMxID2nQYf74YvlYzNUgP
LRctK2TXdfb36TR3zRYy3TuNn1Z45XkmzardrxRC/L82xjhlX9mxrm+YmOXm/7sH
4ojRK2rdbbo=
=CGVF
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel