grsecurity forums

Hi,

since upgrading to 2.4.25 (from 2.4.19 with an old grsec version) the OpenGroupware daemon keeps getting killed by PAX. ("execution attempt in anonymous mapping")

What feature would I need to disable to get OGo running, if it is not a bug in OGo? Our clients are somewhat, hm, not amused

Thank you!


kernel: PAX: From xxxx: execution attempt in: <anonymous mapping>, 5fd02000-5fd0c000 ffff8000
kernel: PAX: From xxxx: terminating task: /usr/lib/opengroupware.org/WOApps/OpenGroupware.woa/ix86/linux-gnu/gnu-fd-nil/OpenGroupware(OpenGroupware):12238, uid/euid: 56641/56641, PC: 5fd06a1c, SP: 5fd068ec
kernel: PAX: bytes at PC: b9 bc 6b d0 5f e9 d2 05 1d c6 d0 5f d3 32 67 26 6c 6a d0 5f
kernel: grsec: From xxxx: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (OpenGroupware:12238) UID(56641) EUID(56641), parent (init:1) UID(0) EUID(0)


kernel: PAX: From xxxx: execution attempt in: <anonymous mapping>, 5d703000-5d70c000 ffff9000
kernel: PAX: From xxxx: terminating task: /usr/lib/opengroupware.org/WOApps/OpenGroupware.woa/ix86/linux-gnu/gnu-fd-nil/OpenGroupware(OpenGroupware):28401, uid/euid: 56641/56641, PC: 5d706fa4, SP: 5d706f10
kernel: PAX: bytes at PC: b9 6c 70 70 5d e9 4e fc d0 c9 b1 27 48 ce c5 27 74 6f 70 5d
kernel: grsec: From xxxx: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (OpenGroupware:28401) UID(56641) EUID(56641), parent (init:1) UID(0) EUID(0)

is at http://bugzilla.opengroupware.org/bugzi ... cgi?id=686

Enforcer wrote:What feature would I need to disable to get OGo running, if it is not a bug in OGo? Our clients are somewhat, hm, not amused

this is a gcc nested function in OGo (somewhere its address is taken and then called through a function pointer, this is what got killed as it involves code execution from the stack), assuming you're using the old EI_PAX marking, you have to chpax -E /usr/lib/opengroupware.org/WOApps/OpenGroupware.woa/ix86/linux-gnu/gnu-fd-nil/OpenGroupware and it should work (you must enable EMUTRAMP in the kernel .config of course). the best fix would be to find and eliminate the nested function, it's not portable C anyway.

PaX Team wrote:you have to chpax -E /usr/lib/opengroupware.org/WOApps/OpenGroupware.woa/ix86/linux-gnu/gnu-fd-nil/OpenGroupware

Thanks for your help!

Would I have to do this every time on reboot or is it saved in the executable somewhere?

It modfies the executable, so you don't need to do it after a reboot