Bug 1787686
| Summary: | [abrt] rng-tools: g_get_user_database_entry(): rngd killed by SIGSEGV | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matt Fagnani <matt.fagnani> | ||||||||||||||||||||||||||||
| Component: | glib2 | Assignee: | Matthias Clasen <mclasen> | ||||||||||||||||||||||||||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||||||||||||||||
| Severity: | unspecified | Docs Contact: | |||||||||||||||||||||||||||||
| Priority: | unspecified | ||||||||||||||||||||||||||||||
| Version: | rawhide | CC: | awilliam, caillon+fedoraproject, chrisf826, gnome-sig, jaromir.capik, jgarzik, jjelen, john.j5live, lewk, mcatanzaro+wrong-account-do-not-cc, mclasen, nhorman, ozeszty+rhbz, rhughes, robatino, rstrode, sandmann, stealthcipher, tiagomatos | ||||||||||||||||||||||||||||
| Target Milestone: | --- | ||||||||||||||||||||||||||||||
| Target Release: | --- | ||||||||||||||||||||||||||||||
| Hardware: | x86_64 | ||||||||||||||||||||||||||||||
| OS: | Unspecified | ||||||||||||||||||||||||||||||
| URL: | https://retrace.fedoraproject.org/faf/reports/bthash/f3b8ab72c108a96a8808a06c7fb822d608833b34 | ||||||||||||||||||||||||||||||
| Whiteboard: | abrt_hash:f7134c6feee83b01ff40423ff45cff7946135ca0; | ||||||||||||||||||||||||||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||||||||||||||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||||||||||||||||
| Last Closed: | 2020-02-03 14:38:57 UTC | Type: | --- | ||||||||||||||||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||||||||||||||||
| Embargoed: | |||||||||||||||||||||||||||||||
| Bug Depends On: | |||||||||||||||||||||||||||||||
| Bug Blocks: | 1705305 | ||||||||||||||||||||||||||||||
| Attachments: |
|
||||||||||||||||||||||||||||||
|
Description
Matt Fagnani
2020-01-04 06:03:13 UTC
Created attachment 1649571 [details]
File: backtrace
Created attachment 1649572 [details]
File: core_backtrace
Created attachment 1649573 [details]
File: cpuinfo
Created attachment 1649574 [details]
File: dso_list
Created attachment 1649575 [details]
File: environ
Created attachment 1649576 [details]
File: exploitable
Created attachment 1649577 [details]
File: limits
Created attachment 1649578 [details]
File: maps
Created attachment 1649579 [details]
File: mountinfo
Created attachment 1649580 [details]
File: open_fds
Created attachment 1649581 [details]
File: proc_pid_status
Created attachment 1649582 [details]
File: var_log_messages
I think this is something of a duplicate error to the other two bugs you've filed regarding the selinux deinals. To address the dlopen issue, that appears to be something of a red herring. Starting at Frame 27, the rngd pcks11 entropy source attempts to init the pkcs11 library, which in frame 26 and 25 calls dlopen on /usr/lib64/opensc-pkcs11.so. frames 24 and 23 encounter an error in that operation, which we can dig into if you like, but I think thats moot, because it appears to be non-fatal, noting that in frames 22-17 the operation is retried, ending at frame 15, in which the constructor for the opensc library is called (module_init), meaning that the dlopen operation succeded, found the library and initialized it (or started trying to). The discrepancy appears to be that, opensc has had a major overhaul between version 19.06 and version 20 in rawhide. Whereas previously opensc only use internal infrastructure to initalize, in version 20 it appears to have adopted use of the glib library to alot of its work, which does alot of extra things under the cover, including opening /var/lib/sss and /etc/passwd. It would appear that those operations are denied by the rawhide selinux policy for the rngd application tag. That shouldn't cause an crash in g_get_user_database_entry, but I'm guessing that glib has a bug in which g_get_user_database_entry's call to get_pwnamr (or one of its cousins), doesn't expect a certain return from the call, and attempts to deference memory that isn't there. I think that the solution here is twofold: 1) The selinux policy should probably be updated to allow context system_u:system_r:rngd_t:s0 to access files of type sss_var_t and system_u:object_r:passwd_file_t so that the avc deinals are not produced (which will avoid the crash) 2) glib needs to be updated to be able to handle those AVC deinals, and whatever information they return from get_pwnam and friends If you can upload the core file from rngd here, I can take a closer look and pass this over to the glib maintainer for further correction. In the interim, I think you probably have three workarounds at your disposal: a) you can downgrade the opensc library as you've done, to avoid the implicit use of glibc in that library, avoiding the issue. Irritating, but possible b) you can disable selinux, which will avoid the AVC denial, and prevent whatever error glib is encountering. Less secure, but also possible c) you can copy /usr/lib/systemd/system/rngd.service to /etc/systemd/system/rngd.service and edit the file in etc such that the ExecStart line to include this option: -x pkcs11 doing so will disable the pkcs11 entropy source, and prevent the opensc module from getting loaded, in turn preventing the crash above. This is likely your best interim solution, as it allows you to keep selinux active and your system more secure. This also however, assumes that you don't have a pcks11 entropy source available, but most people dont (they're smart card readers that produce a small amount of entropy that can be collected). Please upload the core file, and I can route this to the appropriate maintainer for rectification. Created attachment 1649821 [details] rngd segmentation fault core dump file lz4 compressed Neil, I'm attaching the rngd core dump file lz4 compressed from the segmentation fault I reported. I found the core dump file using coredumpctl info. I agree that the rngd denials are the reason for the segmentation faults. I have seen and reported about 12 additional rngd denials at https://bugzilla.redhat.com/show_bug.cgi?id=1787661#c3 rngd hasn't crashed since the first 5 of the 14 unique denials were allowed using a local policy module I described there. The rngd segmentation fault trace frames involving /usr/lib64/opensc-pkcs11.so allowed me to identify opensc-0.20.0-1.fc32.x86_64 as being involved in the denials and crashes at least. I can provide more information as needed. Thanks. *** Bug 1787766 has been marked as a duplicate of this bug. *** option c worked for me (disable pkcs11) as per #c13 Same issue on F31 with opensc-0.20.0-1.1.fc31, reverting the update helped with rngd's AVC denials and this segmentation fault. In the new update of OpenSC with rebase, I re-enabled the desktop notification support. It seems that either OpenSC or glib does not handle the restricted environments very well. I will try to investigate what is going on there and disable the notification support (at least in Fedora 31 for now). Checking the trace and the source code, this is really an issue of glib2 package in Fedora. The frame 2 points here in the source code: https://gitlab.gnome.org/GNOME/glib/blob/master/glib/gutils.c#L692 And this expression miss any null check when trying to access first element in the pw_name of the pw structure in the expression pw->pw_name[0] = g_ascii_toupper (pw->pw_name[0]); I will change this bug to glib2 and try to write some patch or at least issue there. Here is a fix for glib including reproducer for those interested in learning more: https://gitlab.gnome.org/GNOME/glib/merge_requests/1309 *** Bug 1788229 has been marked as a duplicate of this bug. *** See https://bugzilla.redhat.com/show_bug.cgi?id=1788229 for blocker rationale - essentially, this prevents rngd starting up on boot, and we require default services to start successfully. Filed https://bugzilla.redhat.com/show_bug.cgi?id=1789902 for the selinux-policy part of this. *** Bug 1789157 has been marked as a duplicate of this bug. *** for the record, I reverted the OpenSC change and dependency on gio (as the notification support is still quite premature) so this should not happen anymore with rawhide. But it does not change that this bug in gio2 should be fixed. Not sure about the selinux ones though. This fix should have reached rawhide already (GLib 2.63.4). Thanks Jakub! |