Subject: bugtraq-digest V2 #35
From: [email-masked] (bugtraq-digest)
To: [email-masked]

bugtraq-digest       Thursday, December 9 1999       Volume 02 : Number 035

In this issue:

    Re: DM 3.0-15 - unable to set ulimit -c 100000 as user
    Re: DM 3.0-15 - unable to set ulimit -c 100000 as user
    Re: DM 3.0-15 - unable to set ulimit -c 100000 as user
    Re: DM 3.0-15 - unable to set ulimit -c 100000 as user
    kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    Re: kernel: Not handling ldrt/strt correctly
    DM 15 public6 (beta) bugs

See the end of this digest for information about bugtraq-digest.

----------------------------------------------------------------------

Date: Wed, 01 Dec 1999 23:23:28 -0500
From: "Andrew E. Mileski" <[email-masked]>
Subject: Re: DM 3.0-15 - unable to set ulimit -c 100000 as user

[email-masked] wrote:
> 
> - public 6
> 
> When logging in as a user I'm getting the following error
> 
> bash: ulimit: cannot modify limit: Operation not permitted

Known problem - /etc/profile does "ulimit -c 1000000" to limit core
files to a bit under 1 MB.

This seems to work fine when logged in from the console, but not
when using connecting via telnet.

ulimit is a bash built-in, so that's where the problem likely is.

Quick fix: edit the line out of /etc/profile

- --
Andrew E. Mileski - Software Engineer
REBEL.COM  http://www.rebel.com/

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Fri, 03 Dec 1999 11:31:46 -0500
From: Chris Gorman <[email-masked]>
Subject: Re: DM 3.0-15 - unable to set ulimit -c 100000 as user

"Andrew E. Mileski" wrote:
> 
> [email-masked] wrote:
> >
> > - public 6
> >
> > When logging in as a user I'm getting the following error
> >
> > bash: ulimit: cannot modify limit: Operation not permitted
> 
> Known problem - /etc/profile does "ulimit -c 1000000" to limit core
> files to a bit under 1 MB.
Agreed.  This is a good thing. 
> 
> This seems to work fine when logged in from the console, but not
> when using connecting via telnet.
> 
Also does it when logging in via ssh.  Doesn't do it for user root when
logged in via ssh.  Could it be related to pty permissions or something
like that?  
> ulimit is a bash built-in, so that's where the problem likely is.
> 
> Quick fix: edit the line out of /etc/profile
I realize this, however I'd like to keep it in there.  
> 
> --
> Andrew E. Mileski - Software Engineer
> REBEL.COM  http://www.rebel.com/
Chris Gorman

email:  [email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Fri, 03 Dec 1999 16:35:39 -0500
From: Ralph Siemsen <[email-masked]>
Subject: Re: DM 3.0-15 - unable to set ulimit -c 100000 as user

Chris Gorman wrote:

> > Known problem - /etc/profile does "ulimit -c 1000000" to limit core
> > files to a bit under 1 MB.

The problem is permissions: the default ulimit is 0, non-root users are
allowed to decrease it, but not increase it (since you might get a copy
of stuff you should not see, like kernel memory).  I'm not sure where we
need to go to change this, though in the old days the default was
unlimited unless you set one.

- -- 
Ralph Siemsen -- [email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Sat, 4 Dec 1999 20:22:57 -0600
From: Mark Granfors <[email-masked]>
Subject: Re: DM 3.0-15 - unable to set ulimit -c 100000 as user

On Fri, 03 Dec 1999, Ralph Siemsen wrote:
>Chris Gorman wrote:
>
>> > Known problem - /etc/profile does "ulimit -c 1000000" to limit core
>> > files to a bit under 1 MB.
>
>The problem is permissions: the default ulimit is 0, non-root users are
>allowed to decrease it, but not increase it (since you might get a copy
>of stuff you should not see, like kernel memory).  I'm not sure where we
>need to go to change this, though in the old days the default was
>unlimited unless you set one.
>
I had a similar problem with tcsh on an x86 box when I upgraded to Mandrake
6.0.  There the /etc/csh.cshrc file has "limit coredumpsize 1000000".  On the
'Winder we have "limit coredumpsize unlimited" and no problem.  So it seems you
can increase the limit from 0 to unlimited, but not a finite limit.

Mark Granfors ([email-masked])

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Tue, 07 Dec 1999 10:12:24 -0500
From: Mark Lord <[email-masked]>
Subject: kernel: Not handling ldrt/strt correctly

One part of my rc.firewall setup script does this:

    ipchains -F output

Which results in this message being sent to the syslog:

    kernel: Not handling ldrt/strt correctly

Should I be worried?
- -- 
Mark Lord
Real-Time Remedies Inc.
[email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Tue, 07 Dec 1999 10:37:25 -0500
From: Mark Lord <[email-masked]>
Subject: Re: kernel: Not handling ldrt/strt correctly

Mark Lord wrote:
> 
> One part of my rc.firewall setup script does this:
> 
>     ipchains -F output
> 
> Which results in this message being sent to the syslog:
> 
>     kernel: Not handling ldrt/strt correctly
> 
> Should I be worried?

More info:  I added code to dump out the eaddr and instruction, giving:

  kernel: Not handling ldrt/strt correctly
  kernel: eaddr was bffffe8d, instr was e4b41000 

The instruction appears to be user-space (kernel addr's begin with 'c'),
so it's likely from the ipchains executable.  Mmm.. I wonder if my firewall
has holes in it due to this..
                    
- -- 
Mark Lord
Real-Time Remedies Inc.
[email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Tue, 07 Dec 1999 11:20:53 -0500
From: Mark Lord <[email-masked]>
Subject: Re: kernel: Not handling ldrt/strt correctly

Mark Lord wrote:
> 
> One part of my Netwinder rc.firewall setup script does this:
> 
>     ipchains -F output
> 
> Which results in this message being sent to the syslog:
> 
>     kernel: Not handling ldrt/strt correctly

More information:  this is with Netwinder image dm-3.0-15-public6.

I added some extra output to identify the code where the problem occurs
(maybe this information oughta be there by default??):

   kernel: Not handling ldrt/strt correctly
   kernel: IC=c0097220, instr=e4b41000, eaddr=bffffe8d

This corresponds to the following code from linux/net/ipv4/ip_sockglue.c:

  int ip_setsockopt(struct sock *sk, int level, int optname, char *optval, int optlen){
        int val=0,err;
  #if defined(CONFIG_IP_FIREWALL)
        char tmp_fw[MAX(sizeof(struct ip_fwtest),sizeof(struct ip_fwnew))];
  #endif
        if(optlen>=sizeof(int)) {
                if(get_user(val, (int *) optval))    <<--- traps here
                        return -EFAULT;              

The assembly equivalent from the compiler:

        stmfd   sp!, {r4, r5, r6, r7, r8, lr}
        mov     ip, #0
        mov     r5, r0
        mov     r8, r1
        mov     r7, r2
        sub     sp, sp, #164
        ldr     r6, [sp, #188]
        mov     r4, r3
        cmp     r6, #3
        bls     .L1804
        bic     r2, sp, #0x1f00         @ get_current
        bic     r2, r2, #0x00ff
        ldr     r3, [r2, #12]
        mvn     lr, #13
        mov     r1, r3
        adds    r0, r4, #4              @ __range_ok
        sbcccs  r0, r0, r1
        movcc   r1, #0
        cmp     r1, ip
        bne     .L1806
        mov     lr, ip
        1:      ldrt    r1,[r4],#0      <<--- traps here

I've never looked at ARM assembly before, so I don't know what "ldrt"
actually does..  but in this case, we are doing a 32-bit read from
a byte aligned address.  My guess is that this isn't normally legal
on a RISC machine, but oughta be okay to emulate in software.. we don't.

I'll look at ipchains to see if it can 32-bit align the args,
but maybe we should handle this better in the kernel, too.

Russell?

Cheers
- -- 
Mark Lord
Real-Time Remedies Inc.
[email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Tue, 07 Dec 1999 11:28:55 -0500
From: Ralph Siemsen <[email-masked]>
Subject: Re: kernel: Not handling ldrt/strt correctly

Mark Lord wrote:

>     kernel: Not handling ldrt/strt correctly

This is generated by the alignment trap handler.  I've seen it too,
without any ill effects so far.  Still, it ought to be investigated
further... thanks for pointing it out.

- -- 
Ralph Siemsen -- [email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Tue, 07 Dec 1999 11:55:33 -0500
From: Mark Lord <[email-masked]>
Subject: Re: kernel: Not handling ldrt/strt correctly

This is a multi-part message in MIME format.
- --------------FCB001532597F9B0F60C3860
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Okay, found it.

The command I was issuing was:

   ipchains -F output

and the (up to) nine-byte thingie (now identified) was actually
just a pointer a substring of the command line (the "output" part?)
obtained using the getopt functions.  I guess that explains
how it can be so grossly misaligned.

Due to the bug, the "ipchains -F output" command was not being
correctly executed, so this bug is serious for firewalling.

I've patched ipchains to first copy the string to malloc'd memory
before doing the ioctl().  Seems to work now, for ipchains anyway.

But I suppose similar stuff may eventually pop up elsewhere.
Russell is now looking at a fix to the kernel trap handler for this.

A patch for ipchains is attached.
- -- 
Mark Lord
Real-Time Remedies Inc.
[email-masked]
- --------------FCB001532597F9B0F60C3860
Content-Type: text/plain; charset=us-ascii;
 name="ipchains-ldrt-fix.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="ipchains-ldrt-fix.patch"

- --- ipchains-1.3.9/libipfwc/libipfwc.c.orig	Mon Mar 22 22:41:17 1999
+++ ipchains-1.3.9/libipfwc/libipfwc.c	Tue Dec  7 11:43:06 1999
@@ -49,7 +49,18 @@
 static int
 do_setsockopt(int cmd, const void *data, int length)
 {
- -	return setsockopt(sockfd, IPPROTO_IP, cmd, (char *)data, length) != -1;
+	if (length < sizeof(int) || !(((long)data) & (sizeof(int)-1))) {
+		return setsockopt(sockfd, IPPROTO_IP, cmd, (char *)data, length) != -1;
+	} else {
+		/* ensure struct is word aligned, or else kernel complains */
+		char *localdata = malloc(length+sizeof(int));
+		int rc;
+		memcpy(localdata, data, length);
+		rc = setsockopt(sockfd, IPPROTO_IP, cmd, localdata, length);
+		memcpy(data, localdata, length);
+		free(localdata);
+		return rc != -1;
+	}
 }
 
 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */

- --------------FCB001532597F9B0F60C3860--

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: 8 Dec 1999 00:14:50 GMT
From: [email-masked] (Craig Newell)
Subject: Re: kernel: Not handling ldrt/strt correctly

Hi All,

On Tue, 07 Dec 1999 11:55:33 -0500, Mark Lord <[email-masked]> wrote:
>and the (up to) nine-byte thingie (now identified) was actually
>just a pointer a substring of the command line (the "output" part?)
>obtained using the getopt functions.  I guess that explains
>how it can be so grossly misaligned.
>
>Due to the bug, the "ipchains -F output" command was not being
>correctly executed, so this bug is serious for firewalling.
>
>I've patched ipchains to first copy the string to malloc'd memory
>before doing the ioctl().  Seems to work now, for ipchains anyway.
>
>But I suppose similar stuff may eventually pop up elsewhere.
>Russell is now looking at a fix to the kernel trap handler for this.

  Or not ... in my opinion, the bug is not the trap handler nor ipchains
but in the kernel where the pointer is cast to an (int *).  This cast 
makes the assumption that all option values larger than 4 bytes must
be word aligned, which is not true in the case of strings.  Hence, the
cast should be changed from (int *) to (unsigned int *) which will
then generate a "ldrbt" instruction.  This will not cause an alignment trap
but serve the purpose of checking access and preloading the cache page
if necessary.  I wonder how many other places in the kernel also assume
the same thing.

 Just my thoughts on the matter (not that they count),

		CraigN
- ---
      Craig Newell                email: [email-masked]
      Free Spirit                 icbm:  somewhere in NJ, USA

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Wed, 08 Dec 1999 10:56:00 -0500
From: Ralph Siemsen <[email-masked]>
Subject: Re: kernel: Not handling ldrt/strt correctly

Why would the signedness of the cast cause the compiler to generate byte
accesses rather than word?  This sounds like a side-effect to me... 
Phil, if you're listening, can you confirm/deny this behaviour?
- -- 
Ralph Siemsen -- [email-masked]

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

Date: Thu, 09 Dec 1999 21:25:52 -0500
From: "Andrew E. Mileski" <[email-masked]>
Subject: DM 15 public6 (beta) bugs

BUG: Hyphens in man pages appear as <AD>
FIX: Edit /etc/man.config and change the lines
       NROFF	/usr/bin/groff -Tlatin1 -mandoc
       NEQN 	/usr/bin/geqn -Tlatin1
     to these
       NROFF	/usr/bin/groff -Tascii -mandoc
       NEQN 	/usr/bin/geqn -Tascii

- --
Andrew E. Mileski - Software Engineer
REBEL.COM  http://www.rebel.com/

- ---
This message processed by the Netwinder.Org news2mail gateway.

- --
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq" as the body of your message.

------------------------------

End of bugtraq-digest V2 #35
****************************

--
This list is run automagically by Majordomo 1.94.4
Please send email questions to [email-masked]
To UNSUBSCRIBE: email [email-masked] with
"unsubscribe bugtraq-digest" as the body of your message.