passwordless role crashes kernel 2.6.24.3

Discuss and suggest new grsecurity features

passwordless role crashes kernel 2.6.24.3

Postby cormander » Fri Mar 14, 2008 5:18 pm

When I try to authenticate to a passwordless role:

Code: Select all
gradm -n bigo


I get this spat out on the console:

Code: Select all
BUG: unable to handle kernel NULL pointer dereference at virtual address 000000d0
printing eip: c0288427 *pdpt = 0000000002444001 *pde = 0000000000000000
Oops: 0000 [#1] SMP
Modules linked in:

Pid: 1646, comm: gradm Not tainted (2.6.24.3-grsec #2)
EIP: 0061:[<c0288427>] EFLAGS: 00010246 CPU: 0
EAX: 3d9bb1df EBX: 0ca00002 ECX: 00000000 EDX: 00000000
ESI: 000015dd EDI: 000015dd EBP: c6955f40 ESP: c6955ef4
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0069
Process gradm (pid: 1646, ti=c6954000 task=c6986d70 task.ti=c6954000)
Stack: 00000000 c7c15140 c0289234 c7c15140 c780a4b0 c780a4b0 c7c15140 c7c15140
       c780a4b0 c0289362 0ca00002 00000000 c6955f40 00000000 c6987310 c7fe5200
       c6a15240 c74abec8 c028c078 00000000 00000101 00000001 00000000 00000000
Call Trace:
 [<c0289234>] <0> [<c0289362>] <0> [<c028c078>] <0> [<c028b8d6>] <0> [<c017a5b7>] <0> [<c017ab52>] <0> [<c010808e>] <0> =======================
Code: 39 70 04 75 f1 39 58 08 75 ec 83 78 0c 00 78 e6 5b 5e c3 56 89 c6 69 c0 00 20 80 00 53 89 d3 c1 e2 09 01 d0 8d 14 33 31 d0 31 d2 <f7> b1 d0 00 00 00 8b 81 cc 00 00 00 8b 04 90 eb 03 8b 40 1c 85
EIP: [<c0288427>]  SS:ESP 0069:c6955ef4
---[ end trace 402210969fe88222 ]---


Machine freezes. I'm using:

gradm-2.1.11-200803132102

grsecurity-2.1.11-2.6.24.3-200803031942

I'm going to rebuild the kernel with the latest grsecurity patch on monday to see if I can reproduce this, but thought I'd let you know in the mean time, just in-case it isn't an issue related to the fact that I'm using a grsecurity patch that's almost two weeks old.
cormander
 
Posts: 154
Joined: Tue Jan 29, 2008 12:51 pm

Re: passwordless role crashes kernel 2.6.24.3

Postby spender » Sun Mar 16, 2008 3:10 pm

I'll look into it.

update: I'm unable to reproduce your bug. Can You provide me with your policy and a proper OOPs report? I need one with symbols showing -- you'll have to disable the "symbol hiding" feature of grsecurity.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Re: passwordless role crashes kernel 2.6.24.3

Postby cormander » Mon Mar 17, 2008 11:22 am

Funny, I tried to duplicate this problem again this morning (from a fresh policy start) and couldn't. I had to go through my session logs to find the exact policy that caused the OOPs.

Half of it is an actual problem. When you specify a role with no subjects.. you just dive right into starting to specify permissions:

Code: Select all
role nosub sTNG
role_transitions admin
        /usr    rw


When you try to authenticate to the role, you get the OOPs.

The other half of it is me being stupid... forgetting to write the subject line for a role. I guess it's true when they say discovery is often by accident, right? :)

you'll have to disable the "symbol hiding" feature of grsecurity


You're right, ksymoops is giving me "No symbols available" all over the place... /proc/kallsyms isn't there, etc. Doesn't look like there is a sysctl option to disable this.... am going to have to recompile? I'm assuming you mean disable CONFIG_GRKERNSEC_HIDESYM

If you still can't duplicate it with this information I gave you about the absense of the subject, I'll take the time to recompile without the symbol hiding.

Not so much a high priority anymore, since the oops was generated by me being stupid, and I've fixed the previous policy so this doesn't happen anymore.
cormander
 
Posts: 154
Joined: Tue Jan 29, 2008 12:51 pm

Re: passwordless role crashes kernel 2.6.24.3

Postby spender » Mon Mar 17, 2008 5:28 pm

That would explain why I couldn't reproduce the problem. I'll fix this in gradm shortly (no kernel changes are necessary); thanks for the report.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Re: passwordless role crashes kernel 2.6.24.3

Postby spender » Mon Mar 17, 2008 5:50 pm

It's been fixed in the latest gradm. I've also fixed a bug related to the 'T' role mode for special roles and the lack of default object checking for subjects in special roles.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm


Return to grsecurity development

cron