[Statifier-general] Problems with statifier and the CGI version of PHP

[<sa...@us...>]

Dear Srs,

I'am try to to build a statically linked version of the CGI PHP using
statifier v1.6.12, in a CentOS 4.6 i686 and default kernel
(2.6.9-42.0.3.ELsmp).

# file php-cgi
php-cgi: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for
GNU/Linux 2.2.5, dynamically linked (uses shared libs), not stripped

# ldd php-cgi
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x00335000)
        libc-client.so.0 => /usr/lib/libc-client.so.0 (0xb7f38000)
        libexslt.so.0 => /usr/lib/libexslt.so.0 (0x00367000)
        libz.so.1 => /usr/lib/libz.so.1 (0x00323000)
        libm.so.6 => /lib/tls/libm.so.6 (0x002fe000)
        libaspell.so.15 => /usr/lib/libaspell.so.15 (0x00767000)
        libpspell.so.15 => /usr/lib/libpspell.so.15 (0xb7f36000)
        librt.so.1 => /lib/tls/librt.so.1 (0x006b2000)
        libmysqlclient.so.14 => /usr/lib/mysql/libmysqlclient.so.14
(0xb7dff000)
        libmcrypt.so.4 => /usr/lib/libmcrypt.so.4 (0xb7dce000)
        libltdl.so.3 => /usr/lib/libltdl.so.3 (0xb7dc7000)
        libdl.so.2 => /lib/libdl.so.2 (0x002f8000)
        libpam.so.0 => /lib/libpam.so.0 (0x00664000)
        libgmp.so.3 => /usr/lib/sse2/libgmp.so.3 (0x00835000)
        libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x003ff000)
        libpng12.so.0 => /usr/lib/libpng12.so.0 (0x003c1000)
        libjpeg.so.62 => /usr/lib/libjpeg.so.62 (0xb7da8000)
        libdb-4.2.so => /lib/tls/i686/libdb-4.2.so (0xb7cda000)
        libcurl.so.3 => /usr/lib/libcurl.so.3 (0x00804000)
        libbz2.so.1 => /usr/lib/libbz2.so.1 (0xb7cc8000)
        libresolv.so.2 => /lib/libresolv.so.2 (0xb7cb5000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x0039e000)
        libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0xb7ca1000)
        libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x004dc000)
        libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x004b9000)
        libcom_err.so.2 => /lib/libcom_err.so.2 (0xb7c9d000)
        libssl.so.4 => /lib/libssl.so.4 (0x00543000)
        libcrypto.so.4 => /lib/libcrypto.so.4 (0xb7bb3000)
        libidn.so.11 => /usr/lib/libidn.so.11 (0x0087f000)
        libodbc.so.1 => /usr/lib/libodbc.so.1 (0x00af9000)
        libxslt.so.1 => /usr/lib/libxslt.so.1 (0xb7b83000)
        libxml2.so.2 => /usr/lib/libxml2.so.2 (0xb7a8d000)
        libpthread.so.0 => /lib/tls/libpthread.so.0 (0x0038a000)
        libc.so.6 => /lib/tls/libc.so.6 (0x001ca000)
        /lib/ld-linux.so.2 (0x001b0000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00597000)
        libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x0058b000)
        libaudit.so.0 => /lib/libaudit.so.0 (0x00579000)

# statifier php-cgi php-cgi.statifier

# ldd php-cgi.statifier
        not a dynamic executable

# file php-cgi.statifier
php-cgi.statifier: ELF 32-bit LSB executable, Intel 80386, version 1
(SYSV), dynamically linked, not stripped

It appears that works fine.. but I get some random "Segmentation fault"

# ./php-cgi.statifier -v
Segmentation fault

That's the output of strace when running statifier'd version of the CGI and
when gives a segfault:

==========================================================================
munmap(0xb7cfd000, 4096)                = 0
getcwd("/root", 4096)                   = 6
lstat64("/root", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
lstat64("/root/php-cgi.statifier", {st_mode=S_IFREG|0755, st_size=18972672,
...}) = 0
access("/root/php-cgi.statifier", X_OK) = 0
open("./php-cgi.ini", O_RDONLY)         = -1 ENOENT (No such file or
directory)
open("/root/php-cgi.ini", O_RDONLY)     = -1 ENOENT (No such file or
directory)
open("/etc/php-cgi.ini", O_RDONLY)      = -1 ENOENT (No such file or
directory)
open("./php.ini", O_RDONLY)             = -1 ENOENT (No such file or
directory)
open("/root/php.ini", O_RDONLY)         = -1 ENOENT (No such file or
directory)
open("/etc/php.ini", O_RDONLY)          = 3
lstat64("/etc", {st_mode=S_IFDIR|0755, st_size=12288, ...}) = 0
lstat64("/etc/php.ini", {st_mode=S_IFREG|0644, st_size=38414, ...}) = 0
ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbff7b8b8) = -1 ENOTTY
(Inappropriate ioctl for device)
fstat64(3, {st_mode=S_IFREG|0644, st_size=38414, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7cfd000
read(3, "[PHP]\n\n;;;;;;;;;;;;;;;;;;;\n; Abo"..., 8192) = 8192
read(3, "oubles are serialized store seri"..., 8192) = 8192
read(3, "t = \";&\"\n\n; This directive descr"..., 8192) = 8192
read(3, "ks (persistent + non-persistent)"..., 8192) = 8192
read(3, " URLs.  If you want XHTML confor"..., 8192) = 5646
read(3, "", 4096)                       = 0
read(3, "", 8192)                       = 0
close(3)                                = 0
munmap(0xb7cfd000, 4096)                = 0
open("no", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = -1 ENOENT (No
such file or directory)
brk(0xb81b9000)                         = 0xb81b9000
brk(0xb81db000)                         = 0xb81db000
futex(0xc4ec40, FUTEX_WAKE, 2147483647) = 0
brk(0xb81fc000)                         = 0xb81fc000
brk(0xb821d000)                         = 0xb821d000
brk(0xb823e000)                         = 0xb823e000
open("/etc/nsswitch.conf", O_RDONLY)    = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=1623, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0xb7cfd000
read(3, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1623
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xb7cfd000, 4096)                = 0
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=41083, ...}) = 0
old_mmap(NULL, 41083, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7cf3000
close(3)                                = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
==========================================================================

Are those segmentation faults related with Linux kernel stack
randomization? I'm using 2.6.9 kernel version and there is no
/proc/sys/kernel/randomize_va_space, what maybe the problem?

I have found that if a disable /proc/sys/kernel/exec-shield and
/proc/sys/kernel/exec-shield-randomize and re-exec statifier the output
executable appears that is not affected by this.

It's ok? If I disable exec-shield and exec-shield-randomize before running
statifier, the problem is solved? thanks!

Regards,

--
Santi Saez
http://woop.es