atd

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

atd

Postby wschlich » Mon Mar 18, 2002 1:36 pm

starting at-daemon using 2.4.18-1.9.4:
--8<--
Mar 18 18:23:47 prometheus atd[30853]: Can't link execution file: Permission denied
--8<--
grsecurity issue? ideas? TIA.
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

hmm

Postby spender » Mon Mar 18, 2002 4:16 pm

looks like it's related to the linking restrictions. Find the system log from grsecurity related to it and paste it here.
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby wschlich » Mon Mar 18, 2002 4:54 pm

there's none :-(
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

well

Postby spender » Mon Mar 18, 2002 4:56 pm

then i don't think it's a grsecurity issue. Try stracing the process and see what's going on.
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby wschlich » Tue Mar 19, 2002 11:05 am

well, it works with grsecurity disabled, so.. :-)

http://wolfram.schlich.org/tmp/atd.strace

I've no idea why it exits... :-/
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

Postby wschlich » Tue Mar 19, 2002 11:22 am

permissions of /usr/bin/at is now 4750, with user at being member of the corresponding group "trusted" (just added it to this one), perm of /usr/bin is 744, now it says:
--8<--
[...]
munmap(0x45ed7000, 4096) = 0
geteuid32() = 0
write(2, "Garbled time\n", 13Garbled time
) = 13
_exit(1)
--8<--
any ideas?
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

Postby wschlich » Thu Mar 28, 2002 5:39 pm

argh.... this caused the problems:

[root@prometheus:do-conf]$ ls -la /var/spool/atjobs
/var/spool/atjobs:
total 17k
drwx------ 2 at at 144 Mar 19 16:07 .
drwxr-xr-x 18 root root 395 Mar 28 09:24 ..
-rw------- 1 at at 6 Mar 18 18:28 .SEQ
-rw------- 1 at at 186 Mar 19 16:14 .bash_history
-rwx------ 1 root root 2.5k Mar 18 18:23 a0000601028093
-rwx------ 1 root root 1.9k Mar 18 18:28 a0000701028098
[root@prometheus:do-conf]$

the last two files had to be removed in order to make atd run again...

you were right again :-)
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

pfft!

Postby spender » Thu Mar 28, 2002 9:41 pm

aren't i always? ;)
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

NAK^WACK :-P

Postby wschlich » Fri Mar 29, 2002 7:33 am

no comment ;-)
wschlich
 
Posts: 17
Joined: Sun Mar 03, 2002 8:25 pm

Postby dss » Sun Jul 21, 2002 11:09 am

IMHO it *is* related to grsecurity patch. I can't run atd on any of my patched systems.
But I have no problems to run atd on unpatched ones. atd starts up on system boot,
I can add a task by using at. When execution time comes atd crashes with "Can't link execution file: Permission denied" in syslog.
As execution file is meant /var/spool/at/aXXXXX... file with the job - according to strace.
The file (created by at) has 700 permissions and is owned by job owner and his group.
I have tested it on 3 patched and 3 unpatched systems, all are Mandrake 8.2

Anyone have a solution?
dss
 
Posts: 2
Joined: Sun Jul 21, 2002 10:50 am

atd

Postby goodbyte » Sun Jul 21, 2002 12:14 pm

What are the grsecurity acl settings for /var/spool/atd? Do you allow execution?
goodbyte
 
Posts: 32
Joined: Sun May 12, 2002 4:33 am

Postby dss » Sun Jul 21, 2002 12:49 pm

I have ACL disabled at all.
dss
 
Posts: 2
Joined: Sun Jul 21, 2002 10:50 am


Return to grsecurity support