<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Michael,<br>
<br>
Thank you for the clarification. Now, not as disturbing that I was
unable to attain the <br>
impossible :-)<br>
<br>
Cordially,<br>
<br>
Courtney<br>
<br>
<br>
<br>
<br>
On 02/07/12 18:48, Michael H. Warfield wrote:
<blockquote cite="mid:1328658530.3725.9.camel@canyon.wittsend.com"
type="cite">
<pre wrap="">On Tue, 2012-02-07 at 11:46 -0500, Courtney Thomas wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Jim,
As always.... thanks for your reply.
You were correct that kvm was apparently attempting to write to /proc~.
The puzzle for me is that... there is no /proc/~/mem to which to write,
but... apparently this is not permissible by design, as I'm not allowed
to change /proc's 555 permissions.
Can /proc's permissions be changed from 555 to, say, 755, and if so how;
for when I attempt this I get the error that "this is not supported" ? I
must say, though, that /proc is the only subdir in it's dir whose
permissions are not set 755.
</pre>
</blockquote>
<pre wrap="">
It will not help. /proc/.../mem is special and there was recently a
security advisory on how it was handled in 2.6.29 and above (2.6.26 if
you are on RedHat 6.2 / CentOS 6.2 / SL 6.2). Permission to write
to /proc/.../mem was only recently enabled at all and then restricted to
some very specific circumstances (self and certain tracing / debugging
functions). Unfortunately, the handling of those circumstances proved
to be flawed resulting in an escalation of privilege by a local user on
the system, which Linus then quickly fixed.
<a class="moz-txt-link-freetext" href="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc">http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc</a>
<a class="moz-txt-link-freetext" href="http://www.computerworld.com/s/article/9223675/Linux_vendors_rush_to_patch_privilege_escalation_flaw_after_root_exploits_emerge">http://www.computerworld.com/s/article/9223675/Linux_vendors_rush_to_patch_privilege_escalation_flaw_after_root_exploits_emerge</a>
<a class="moz-txt-link-freetext" href="https://rhn.redhat.com/errata/RHSA-2012-0052.html">https://rhn.redhat.com/errata/RHSA-2012-0052.html</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/security/data/cve/CVE-2012-0056.html">https://www.redhat.com/security/data/cve/CVE-2012-0056.html</a>
In kernel space, we do not honor permissions, we enforce them. If the
code path says "if foo then return error = EPERM" your screwed no matter
what you set the permissions to.
If you want to read a really detailed analysis of what it takes to
exploit this and just how convoluted these exploits can be you can check
out this blog posting here (includes a link to proof of concept exploit
code)...
<a class="moz-txt-link-freetext" href="http://blog.zx2c4.com/749">http://blog.zx2c4.com/749</a>
</pre>
<blockquote type="cite">
<pre wrap="">More mystifyingly... there are other entries that ARE written to in
/proc's subdirs. Huh ? I assumed, apparently wrongly, that if a dir's
permissions disallowed writing, then it's subdirs would also not allow
writing.
I am also disallowed from changing proc's 'chown'.
Finally, when I - cat /proc/version - I get that Linux is version
2.6.16. Does this tell you anything ?
Bedazzled and befuddled, as usual :-)
Courtney
On 02/06/12 19:27, Jim Kinney wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
The first looks like kvm thinks it should be doing something. If you
aren't running a kvm based server, disable kvm.
The sendmail issue os literally the daemon can't write the file.
Either disk full or permission error. For unknown reasons sometimes
the var/mail becomes not gtoup writeable. A perm change fixed it and
it didn't reappear.
On Feb 6, 2012 1:13 PM, "Courtney Thomas"
<<a class="moz-txt-link-abbreviated" href="mailto:courtneycthomas@bellsouth.net">courtneycthomas@bellsouth.net</a> <a class="moz-txt-link-rfc2396E" href="mailto:courtneycthomas@bellsouth.net"><mailto:courtneycthomas@bellsouth.net></a>>
wrote:
What is the significance of this error which is regularly appearing in
/var/log/messages along with.....
kvm_getenvv
failed ?
This is apparently aroused by gnome's "console-kit-daemon"
______________________________________________________________________________________________
I'm also getting what I assume is a sendmail complaint as follows:
sm-mta cannot write .q###############: permission denied.
How can I resolve this as well, pleasely,
C.Thomas
_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a> <a class="moz-txt-link-rfc2396E" href="mailto:Ale@ale.org"><mailto:Ale@ale.org></a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Ale mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Ale@ale.org">Ale@ale.org</a>
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a class="moz-txt-link-freetext" href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</pre>
</blockquote>
<br>
</body>
</html>