Bug 470219 - vpnc crashes in libgcrypt when /proc/sys/crypto/fips_enabled cannot be read (because of SELinux)
Summary: vpnc crashes in libgcrypt when /proc/sys/crypto/fips_enabled cannot be read (...
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: libgcrypt
Version: 10
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tomas Mraz
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-11-06 10:31 UTC by Matěj Cepl
Modified: 2018-04-11 15:55 UTC (History)
8 users (show)

Fixed In Version: 1.4.4-1.fc10
Clone Of:
Environment:
Last Closed: 2009-02-24 20:58:31 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Matěj Cepl 2008-11-06 10:31:35 UTC
Description of problem:
[root@hubmaier ~]# gdb vpnc
GNU gdb Fedora (6.8-24.fc10)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) run
Starting program: /usr/sbin/vpnc
FATAL: error reading `/proc/sys/crypto/fips_enabled' in libgcrypt: Permission denied

Program received signal SIGSEGV, Segmentation fault.
abort () at abort.c:124
124           ABORT_INSTRUCTION;
(gdb) l
119
120       /* Now try to abort using the system specific command.  */
121       if (stage == 6)
122         {
123           ++stage;
124           ABORT_INSTRUCTION;
125         }
126
127       /* If we can't signal ourselves and the abort instruction failed, exit.  */
128       if (stage == 7)
(gdb) thread apply all backtrace
(gdb) bt
#0  abort () at abort.c:124
#1  0x0000000000340a9b in _gcry_initialize_fips_mode (
    force=<value optimized out>) at fips.c:164
#2  0x000000000033b2a6 in global_init () at global.c:97
#3  0x000000000033c0a6 in _gcry_check_version (
    req_version=<value optimized out>) at global.c:226
#4  0x00007ff0659c1aba in main (argc=1, argv=0x7fff6d9cc078) at vpnc.c:3049
(gdb) 

Version-Release number of selected component (if applicable):
vpnc-0.5.1-6.fc10.x86_64
libgcrypt-1.4.3-2.fc10.x86_64
libgcrypt-1.4.3-2.fc10.i386
selinux-policy-targeted-3.5.13-11.fc10.noarch

How reproducible:
100%

Steps to Reproduce:
1.see above
2.
3.
  
Actual results:
crash

Expected results:
should survive inability to read from that file

Additional info:

Comment 1 Tomas Mraz 2008-11-06 10:42:39 UTC
We should probably allow libgcrypt to continue in non-fips mode when the proc file is not readable.

Comment 2 Joel Gomberg 2008-11-19 15:32:10 UTC
libgcrypt is preventing the SMB service from starting during boot.  This appears in /var/log/messages:

Nov 19 07:04:31 alcibiades smbd[3039]: Libgcrypt error: reading `/proc/sys/crypto/fips_enabled' failed: Permission denied - abort

I can start SMB manually after boot.

Comment 3 Bug Zapper 2008-11-26 04:52:29 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 10 development cycle.
Changing version to '10'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 4 Orion Poplawski 2009-01-08 16:40:12 UTC
I see the smb problem as well, but I cannot start smb manually - at least from a ssh login.  CC'ing Dan Walsh so he can chime in.

Comment 5 Fedora Update System 2009-02-05 02:10:26 UTC
libgcrypt-1.4.4-1.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update libgcrypt'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-1227

Comment 6 Orion Poplawski 2009-02-05 17:27:38 UTC
Fixes my smb startup issue.

Comment 7 Fedora Update System 2009-02-24 20:58:26 UTC
libgcrypt-1.4.4-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.