Menu
▾
▴
devil-linux-develop
|
From: Heiko Z. <he...@zu...> - 2008-04-29 14:20:25
|
I moved this threat to the develop mailinglist. Sorry for my late and sparse answers, but I'm currently moving into my new house and I'm sick... You can turn it off globally via menuconfig (requires are mrproper) or for specific programs by adding CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to the make statement. Some programs require a little bit different approach. The CC statement I gave you here turns everything off, you may only need a subset of it. -- Regards Heiko Zuerker http://www.devil-linux.org Quoting Bruce Smith <bw...@ar...>: >> I think it's the hardened compile options for GCC. > > How can I turn them off to test this? > > Do I have to change the menuconfig options (which ones?) and start over > with a mrproper? > > Or can I just turn off stack protection (or something?) in the build > script? PHP or Apache or both? > > Let me know and I can start a fresh compile (if needed) tonight. > > - BS > > >> I can't really look into right now, I'm moving and I'm happy that I >> even can read my emails... ;-) >> >> -- >> >> Regards >> Heiko Zuerker >> http://www.devil-linux.org >> >> >> >> Quoting Bruce Smith <bw...@ar...>: >> >> > Yes, I have whatever security features are in the 'server' options. >> > >> > What should I to turn off to test this? >> > >> > Can I turn it off for just apache and/or php? (how?) >> > >> > - BS >> > >> > >> >> I noticed a smiliar behaviour with php/squirrelmail and sending >> >> emails. >> >> Do you have any of the security features on? I think it worked when I >> >> turned off the hardened compile. Unfortunately I didn't have time to >> >> look further into it. >> >> >> >> -- >> >> >> >> Regards >> >> Heiko Zuerker >> >> http://www.devil-linux.org >> >> >> >> >> >> >> >> Quoting Bruce Smith <bw...@ar...>: >> >> >> >>> Is there some trick to get file uploads to work in DL 1.3 Apache/PHP? >> >>> >> >>> I'm copying/pasting the small example code from the PHP manual and >> >>> have >> >>> spent all afternoon google'ing for a solution and trying different >> >>> values in php.ini. It doesn't even work with a very SMALL file. >> >>> >> >>> When I browse/enter a filename in the input form and press submit, >> >>> I get >> >>> nothing from the POST PHP script. Apache logs this for each attempt: >> >>> >> >>> [Wed Apr 23 16:08:01 2008] [notice] child pid 4795 exit signal >> >>> Segmentation fault (11) >> >>> [Wed Apr 23 16:12:17 2008] [notice] child pid 4777 exit signal >> >>> Segmentation fault (11) >> >>> [Wed Apr 23 16:12:17 2008] [notice] child pid 4825 exit signal >> >>> Segmentation fault (11) >> >>> [Wed Apr 23 16:12:23 2008] [notice] child pid 4778 exit signal >> >>> Segmentation fault (11) >> >>> ... >> >>> >> >>> - BS >> >>> >> >>> >> >>> >> >>> >> ------------------------------------------------------------------------- >> >>> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >> >>> Don't miss this year's exciting event. There's still time to save >> >>> $100. >> >>> Use priority code J8TL2D2. >> >>> >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >> >>> _______________________________________________ >> >>> Devil-linux-discuss mailing list >> >>> Dev...@li... >> >>> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss >> >>> >> >> >> >> >> >> >> >> ---------------------------------------------------------------- >> >> This message was sent using IMP, the Internet Messaging Program. >> >> >> >> >> >> ------------------------------------------------------------------------- >> >> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >> >> Don't miss this year's exciting event. There's still time to save >> >> $100. >> >> Use priority code J8TL2D2. >> >> >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >> >> _______________________________________________ >> >> Devil-linux-discuss mailing list >> >> Dev...@li... >> >> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss >> > >> > >> > ------------------------------------------------------------------------- >> > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >> > Don't miss this year's exciting event. There's still time to save $100. >> > Use priority code J8TL2D2. >> > >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >> > _______________________________________________ >> > Devil-linux-discuss mailing list >> > Dev...@li... >> > https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss >> > >> >> >> >> ---------------------------------------------------------------- >> This message was sent using IMP, the Internet Messaging Program. >> >> >> ------------------------------------------------------------------------- >> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference >> Don't miss this year's exciting event. There's still time to save $100. >> Use priority code J8TL2D2. >> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone >> _______________________________________________ >> Devil-linux-discuss mailing list >> Dev...@li... >> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss > > > ------------------------------------------------------------------------- > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > Don't miss this year's exciting event. There's still time to save $100. > Use priority code J8TL2D2. > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > _______________________________________________ > Devil-linux-discuss mailing list > Dev...@li... > https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss > ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. |
|
From: Bruce S. <bw...@ar...> - 2008-04-29 18:59:07
|
> Sorry for my late and sparse answers, but I'm currently moving into my > new house and I'm sick... No problem, I hope you feel better soon! > You can turn it off globally via menuconfig (requires are mrproper) or > for specific programs by adding > CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to > the make statement. OK, I added that CC to the make in both httpd and php build scripts. 'make clean makefile', and now ... Apache/PHP file uploads work! :-) > The CC statement I gave you here turns everything off, you may only > need a subset of it. Now comes the long process of trial & error to see which option causes the problem ... :-( I'm guessing that only PHP needs the CC option(s), since I'm using PHP to do the file uploads, so I'll try removing the CC from httpd first. Assuming that works, any idea what option(s) are most likely to solve the problem on PHP, so I can try them first? - BS |
|
From: Heiko Z. <he...@zu...> - 2008-04-29 19:02:37
|
Quoting Bruce Smith <bw...@ar...>: >> Sorry for my late and sparse answers, but I'm currently moving into my >> new house and I'm sick... > > No problem, I hope you feel better soon! > >> You can turn it off globally via menuconfig (requires are mrproper) or >> for specific programs by adding >> CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to >> the make statement. > > OK, I added that CC to the make in both httpd and php build scripts. > > 'make clean makefile', and now ... Apache/PHP file uploads work! :-) > >> The CC statement I gave you here turns everything off, you may only >> need a subset of it. > > Now comes the long process of trial & error to see which option causes > the problem ... :-( > > I'm guessing that only PHP needs the CC option(s), since I'm using PHP > to do the file uploads, so I'll try removing the CC from httpd first. > > Assuming that works, any idea what option(s) are most likely to solve > the problem on PHP, so I can try them first? Try the fortify source first, then I'd play with the pie stuff (now I'm getting hungry). -- Regards Heiko Zuerker http://www.devil-linux.org ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. |
|
From: Bruce S. <bw...@ar...> - 2008-04-30 14:40:52
|
> >> You can turn it off globally via menuconfig (requires are mrproper) or > >> for specific programs by adding > >> CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to > >> the make statement. > > Assuming that works, any idea what option(s) are most likely to solve > > the problem on PHP, so I can try them first? > > Try the fortify source first, then I'd play with the pie stuff OK, I tried just -U_FORTIFY_SOURCE first. No good. Then I added -nopie and compiled php again. No good. Then I added -fno-stack-protector. And it worked (with all three). Then I removed the first two options and compiled with ONLY -fno-stack-protector. And ... it still works. Should I check it in with only -fno-stack-protector ? Or is there any other options that should go with it? > (now I'm getting hungry). <homer simpson voice> Ummmmm, pie ... </duh!> :-) But the "pie stuff" didn't work, so NO PIE FOR YOU! ;-) </variation on Seinfeld soup episode> Hey, you started it! :-) - BS |
|
From: Heiko Z. <he...@zu...> - 2008-04-30 20:51:23
|
Quoting Bruce Smith <bw...@ar...>: >> >> You can turn it off globally via menuconfig (requires are mrproper) or >> >> for specific programs by adding >> >> CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to >> >> the make statement. >> > Assuming that works, any idea what option(s) are most likely to solve >> > the problem on PHP, so I can try them first? >> >> Try the fortify source first, then I'd play with the pie stuff > > OK, I tried just -U_FORTIFY_SOURCE first. No good. > Then I added -nopie and compiled php again. No good. > Then I added -fno-stack-protector. And it worked (with all three). > > Then I removed the first two options and compiled with ONLY > -fno-stack-protector. And ... it still works. > > Should I check it in with only -fno-stack-protector ? > Or is there any other options that should go with it? No, I would just stick with that. >> (now I'm getting hungry). > > <homer simpson voice> > Ummmmm, pie ... > </duh!> :-) > > But the "pie stuff" didn't work, so NO PIE FOR YOU! ;-) > </variation on Seinfeld soup episode> Oh man.... > Hey, you started it! :-) Yeah I have a tendency of doing things like that. Heiko ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. |
|
From: Heiko Z. <he...@zu...> - 2008-05-01 13:31:42
|
Quoting Heiko Zuerker <he...@zu...>: > > Quoting Bruce Smith <bw...@ar...>: > >>> >> You can turn it off globally via menuconfig (requires are mrproper) or >>> >> for specific programs by adding >>> >> CC="gcc -fPIC -fno-stack-protector -U_FORTIFY_SOURCE -nonow -nopie" to >>> >> the make statement. >>> > Assuming that works, any idea what option(s) are most likely to solve >>> > the problem on PHP, so I can try them first? >>> >>> Try the fortify source first, then I'd play with the pie stuff >> >> OK, I tried just -U_FORTIFY_SOURCE first. No good. >> Then I added -nopie and compiled php again. No good. >> Then I added -fno-stack-protector. And it worked (with all three). >> >> Then I removed the first two options and compiled with ONLY >> -fno-stack-protector. And ... it still works. >> >> Should I check it in with only -fno-stack-protector ? >> Or is there any other options that should go with it? > > > No, I would just stick with that. When are you planning to check in the changes, since I would like to start a compile. -- Regards Heiko Zuerker http://www.devil-linux.org ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. |
|
From: Bruce S. <bw...@ar...> - 2008-05-01 13:46:26
|
> >> Should I check it in with only -fno-stack-protector ?
> >> Or is there any other options that should go with it?
> >
> > No, I would just stick with that.
>
> When are you planning to check in the changes, since I would like to
> start a compile.
How about yesterday afternoon? Is that soon enough? ;-)
root@lx1:/data/build# less scripts/php
#!/bin/bash
# $Source: /cvsroot/devil-linux/build/scripts/php,v $
# $Revision: 1.18 $
# $Date: 2008/04/30 15:45:57 $
...
make CC="gcc -fno-stack-protector" $PMAKE all || exit 1
...
root@lx1:/data/build# cvs_sf diff scripts/php
root@lx1:/data/build#
root@lx1:/data/build# less CHANGES
...
- fixed php file upload bug (bs)
...
root@lx1:/data/build# cvs_sf diff CHANGES
root@lx1:/data/build#
- BS
|
|
From: Heiko Z. <he...@zu...> - 2008-05-01 14:02:36
|
Quoting Bruce Smith <bw...@ar...>: >> >> Should I check it in with only -fno-stack-protector ? >> >> Or is there any other options that should go with it? >> > >> > No, I would just stick with that. >> >> When are you planning to check in the changes, since I would like to >> start a compile. > > How about yesterday afternoon? Is that soon enough? ;-) > > > root@lx1:/data/build# less scripts/php > #!/bin/bash > # $Source: /cvsroot/devil-linux/build/scripts/php,v $ > # $Revision: 1.18 $ > # $Date: 2008/04/30 15:45:57 $ > ... > make CC="gcc -fno-stack-protector" $PMAKE all || exit 1 > ... > > root@lx1:/data/build# cvs_sf diff scripts/php > root@lx1:/data/build# > > > root@lx1:/data/build# less CHANGES > ... > - fixed php file upload bug (bs) > ... > > root@lx1:/data/build# cvs_sf diff CHANGES > root@lx1:/data/build# > Darn.... ;-) -- Regards Heiko Zuerker http://www.devil-linux.org ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. |
