Re: [Integrit-devel] FreeBSD readdir_r problem

[Andreas S. <an...@ph...>]

On Thu, Dec 07, 2000 at 08:10:26PM -0500, Ed L Cashin wrote:
> Andreas, 
> 
> With the current version of integrit, have you been able to replicate
> segfaults in readdir_r when running integrit on the root of your
> FreeBSD system?

Yes, it still segfaults.
However, it compiles out of the box now :-)

I did a bit of debugging, but no real results.
I use the included usr.conf file, i.e. it starts for
me with /usr/bin.
It dies on file number 246 (starting to count with 1)
in /usr/bin, no matter which file this is.
I moved the files around, so that the order it reads
it in changes - same result.

When I copy all the files to a temporary directory
it works. It checks all 413 copied files from /usr/bin

Also, I'm not sure if this is user root related or
not, because when I test it as a regular user it dies
before because it wants to read non-readable files
(some SUID files). And I don't want to move those around ...
So I can't really test.

Does this help you ?
(gdb) print entry
$1 = {d_fileno = 8011, d_reclen = 12, d_type = 8 '\b', d_namlen = 2 '\002', 
  d_name = "mt\000Ëh\"\000\000\020\000\b\004ncal\000Ø\233Èh\"\000\000\f\000\b\003cal\000L\037\000\000\020\000\b\anetstat\000M\037\000\000\020\000\b\006newkey\000ÈN\037\000\000\020\000\b\anfsstat\000O\037\000\000\020\000\b\004nice\000Ø\233ÈP\037\000\000\020\000\b\005nohup\000\233ÈQ\037\000\000\024\000\b\tobjformat\000;ÉQ\037\000\000\024\000\b\taddr2line\000\037ÀQ\037\000\000\f\000\b\002ar\000ÉQ\037\000\000\f\000\b\002as\000ÉQ\037\000\000\020\000\b\ac++filt\000Q\037\000\000\f\000\b\003"...}
(gdb) print result
$2 = (struct dirent *) 0xbfbfc4f4

I'm not really good in C. Especially when it comes to
such constructs :-)

Andreas

-- 
Department of Physics & Astronomy  and  Center for Simulational Physics
University of Georgia                          Phone ++1 (706) 542 5043
Athens, GA 30602-2451                            Fax ++1 (706) 542 2492
USA                               http://dilbert.physast.uga.edu/~andy/

NEW ! WWW page for phoenix :

                   http://phoenix.physast.uga.edu