devel March 2007

devel@lists.centos.org

64 participants
39 discussions

Re: [CentOS-devel] may Centos be vulnerable to this bug?
by Roger Peña 02 Mar '07

02 Mar '07

--- Roger Peña <orkcu(a)yahoo.com> wrote: > > --- Johnny Hughes <mailing-lists(a)hughesjr.com> > wrote: > > > On Fri, 2007-03-02 at 09:39 -0800, Roger Peña > wrote: > > > --- Roger Peña <orkcu(a)yahoo.com> wrote: > > > > > > > As this bugtrack say "binaries from redhat" > are > > not > > > > vulnerables but what happen to recompilations? > > > > > > > > > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200219 > > > > > > > > I understand that it is the compilation > process > > what > > > > make this bug not exploitable and not the > source > > > > code > > > > so, the question is: > > > > is the httpd binary from centos exploitable? > > > > > > > > > > > > I could not find any refence in the web about > > this > > > > topic. > > > > maybe I should ask in the centos-user mailling > > list > > > > but because it is a compilation thing ..... I > > guess > > > > centos developer are the right to anwser > > > > > > > sorry, I forgot to mention that I do test the > > > following "proof of concept" test: > > > > > > > > > http://www.securityfocus.com/archive/1/archive/1/443870/100/0/threaded > > > > > > and httpd-2.0.52-28.ent.centos4 give the "302 > > Found" > > > page so at least with that test I could not > probe > > if > > > it is vulnerable or not > > > > > > > If it did do a "302 Found" ... then it is not > > vulnerable: > > > > from the article: > > > > "If your web server doesn't reply you with a '302 > > Found' page or a > > Segmentation Fault appears in your error_log, an > > apache child has > > crashed and your web server is vulnerable and > > exploitable." > > > > So a 302 found is good. > > > yes, I know it is good > > but can't see why this is a sufficient condition to > say "not vulnerable" > of course, what I can see is that if I got another > page or make a fault then I can say "it is > vulnerable" > > but, I am not saying that centos binary are > vulnerables!!! just that I can't find an explanation > to say "not vulnerable" because uptreams is not. > > also, I could not had the time yet to verify what is > the the following fix to mod_rewrite: > > * Tue Jun 20 2006 Joe Orton <jorton(a)redhat.com> > 2.0.52-26.ent > > - add mod_rewrite ldap scheme handling fix > > does anybody know if this is the source code fix to > this vulnerability (back ported)? > the date of this fix is before the date of the > redhat > bugtrack and before the CVS assignation (20060720) > so it looks not related but I could be wrong... well, it looks like a patch to the vulnerability, without see the source code yet, from the release changelog for httpd-2.0.59: Changes with Apache 2.0.59 *) SECURITY: CVE-2006-3747 (cve.mitre.org) mod_rewrite: Fix an off-by-one security problem in the ldap scheme handling. For some RewriteRules this could lead to a pointer being written out of bounds. Reported by Mark Dowd of McAfee. [Mark Cox] I guess Joe Orton from redhat release a patch a month before public disclosure of the vulnerability or just make a mistake (typo) when write the redhat httpd changelog ;-) so, right now I can "rest in peace" knowing that centos is not vulnerable because it has the fix (until somebody say the contrary :-) ) ;-) thanks anyway johnny I was in a hurry tracking down this for a client cu roger __________________________________________ RedHat Certified Engineer ( RHCE ) Cisco Certified Network Associate ( CCNA ) ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

1 0

may Centos be vulnerable to this bug?
by Roger Peña 02 Mar '07

02 Mar '07

As this bugtrack say "binaries from redhat" are not vulnerables but what happen to recompilations? https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200219 I understand that it is the compilation process what make this bug not exploitable and not the source code so, the question is: is the httpd binary from centos exploitable? I could not find any refence in the web about this topic. maybe I should ask in the centos-user mailling list but because it is a compilation thing ..... I guess centos developer are the right to anwser thanks in advance cu roger __________________________________________ RedHat Certified Engineer ( RHCE ) Cisco Certified Network Associate ( CCNA ) ____________________________________________________________________________________ Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail beta. http://new.mail.yahoo.com

2 3

CentOS 5 Beta/QA Application
by Mark A. Bober 02 Mar '07

02 Mar '07

Here at the WashU Engineering school we run CentOS in both workstation and server roles; over 75 machines and more tied behind clusters. We have a good set of architectures to test on if needed; the usual x86/x86-64 plus Alpha and PPC, in a mixed environment authenticating to LDAP/Kerberos off of Active Directory. Plus, my boss just got a new workstation, so I figured I'd show him a good time. :) Mark Bober CTS

2 1

Back-port md raid1/10 BIO_RW_SYNC patch for DRBD
by Ross S. W. Walker 02 Mar '07

02 Mar '07

Attention CentOS Developers, Here is a back-port of Lars Ellenberg's md raid1/10 patch from 2.6.19+ to 2.6.9. It seems the md raid1 and raid10 drivers were stripping the BIO_RW_SYNC flags on requests which caused a severe performance penalty for DRBD when writing it's meta-data to these volumes. The patch is attached as well as inlined: ---------- BEGIN ---------- Subject: md: pass down BIO_RW_SYNC in raid{1,10} From: Lars Ellenberg <[EMAIL PROTECTED]> md raidX make_request functions strip off the BIO_RW_SYNC flag, thus introducing additional latency. Fixing this in raid1 and raid10 seems to be straightforward enough. For our particular usage case in DRBD, passing this flag improved some initialization time from ~5 minutes to ~5 seconds. --- raid1.c | 11 ++++++++--- raid10.c | 11 ++++++++--- 2 files changed, 16 insertions(+), 6 deletions(-) diff -puN drivers/md/raid1.c~md-pass-down-bio_rw_sync-in-raid1 drivers/md/raid1.c --- a/drivers/md/raid1.c~md-pass-down-bio_rw_sync-in-raid110 2007-02-24 01:51:20.000000000 -0500 +++ b/drivers/md/raid1.c 2007-02-24 01:50:38.000000000 -0500 @@ -521,6 +521,7 @@ static int make_request(request_queue_t struct bio *read_bio; int i, disks; mdk_rdev_t *rdev; + const int do_sync = bio_sync(bio); if (unlikely(bio_barrier(bio))) { bio_endio(bio, bio->bi_size, -EOPNOTSUPP); @@ -582,7 +583,7 @@ static int make_request(request_queue_t read_bio->bi_sector = r1_bio->sector + mirror->rdev->data_offset; read_bio->bi_bdev = mirror->rdev->bdev; read_bio->bi_end_io = raid1_end_read_request; - read_bio->bi_rw = READ; + read_bio->bi_rw = READ | do_sync; read_bio->bi_private = r1_bio; generic_make_request(read_bio); @@ -625,7 +626,7 @@ static int make_request(request_queue_t mbio->bi_sector = r1_bio->sector + conf->mirrors[i].rdev->data_offset; mbio->bi_bdev = conf->mirrors[i].rdev->bdev; mbio->bi_end_io = raid1_end_write_request; - mbio->bi_rw = WRITE; + mbio->bi_rw = WRITE | do_sync; mbio->bi_private = r1_bio; atomic_inc(&r1_bio->remaining); @@ -637,6 +638,9 @@ static int make_request(request_queue_t raid_end_bio_io(r1_bio); } + if (do_sync) + md_wakeup_thread(mddev->thread); + return 0; } @@ -960,6 +964,7 @@ static void raid1d(mddev_t *mddev) (unsigned long long)r1_bio->sector); raid_end_bio_io(r1_bio); } else { + const int do_sync = bio_sync(r1_bio->master_bio); r1_bio->bios[r1_bio->read_disk] = NULL; r1_bio->read_disk = disk; bio_put(bio); @@ -974,7 +979,7 @@ static void raid1d(mddev_t *mddev) bio->bi_sector = r1_bio->sector + rdev->data_offset; bio->bi_bdev = rdev->bdev; bio->bi_end_io = raid1_end_read_request; - bio->bi_rw = READ; + bio->bi_rw = READ | do_sync; bio->bi_private = r1_bio; unplug = 1; generic_make_request(bio); --- a/drivers/md/raid10.c~md-pass-down-bio_rw_sync-in-raid110 2007-02-24 01:51:20.000000000 -0500 +++ b/drivers/md/raid10.c 2007-02-24 01:50:38.000000000 -0500 @@ -663,6 +663,7 @@ static int make_request(request_queue_t struct bio *read_bio; int i; int chunk_sects = conf->chunk_mask + 1; + const int do_sync = bio_sync(bio); if (unlikely(bio_barrier(bio))) { bio_endio(bio, bio->bi_size, -EOPNOTSUPP); @@ -747,7 +748,7 @@ static int make_request(request_queue_t mirror->rdev->data_offset; read_bio->bi_bdev = mirror->rdev->bdev; read_bio->bi_end_io = raid10_end_read_request; - read_bio->bi_rw = READ; + read_bio->bi_rw = READ | do_sync; read_bio->bi_private = r10_bio; generic_make_request(read_bio); @@ -789,7 +790,7 @@ static int make_request(request_queue_t conf->mirrors[d].rdev->data_offset; mbio->bi_bdev = conf->mirrors[d].rdev->bdev; mbio->bi_end_io = raid10_end_write_request; - mbio->bi_rw = WRITE; + mbio->bi_rw = WRITE | do_sync; mbio->bi_private = r10_bio; atomic_inc(&r10_bio->remaining); @@ -801,6 +802,9 @@ static int make_request(request_queue_t raid_end_bio_io(r10_bio); } + if (do_sync) + md_wakeup_thread(mddev->thread); + return 0; } @@ -1247,6 +1251,7 @@ static void raid10d(mddev_t *mddev) (unsigned long long)r10_bio->sector); raid_end_bio_io(r10_bio); } else { + const int do_sync = bio_sync(r10_bio->master_bio); rdev = conf->mirrors[mirror].rdev; if (printk_ratelimit()) printk(KERN_ERR "raid10: %s: redirecting sector %llu to" @@ -1258,7 +1263,7 @@ static void raid10d(mddev_t *mddev) bio->bi_sector = r10_bio->devs[r10_bio->read_slot].addr + rdev->data_offset; bio->bi_bdev = rdev->bdev; - bio->bi_rw = READ; + bio->bi_rw = READ | do_sync; bio->bi_private = r10_bio; bio->bi_end_io = raid10_end_read_request; unplug = 1; ----------- END ----------- Ross S. W. Walker Information Systems Manager Medallion Financial, Corp. 437 Madison Avenue 38th Floor New York, NY 10022 Tel: (212) 328-2165 Fax: (212) 328-2125 WWW: http://www.medallion.com <http://www.medallion.com> ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

3 18

Nagios + selinux
by Christoph Maser 02 Mar '07

02 Mar '07

Hi lists it seems the rpmforge nagios package does not work out of the box if selinux is turned on. A log from someone complaining about it (the nagios cgis) not working: --- [Thu Mar 01 15:58:30 2007] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) [Thu Mar 01 15:58:30 2007] [notice] Digest: generating secret for digest authentication ... [Thu Mar 01 15:58:30 2007] [notice] Digest: done [Thu Mar 01 15:58:30 2007] [notice] LDAP: Built with OpenLDAP LDAP SDK [Thu Mar 01 15:58:30 2007] [notice] LDAP: SSL support unavailable [Thu Mar 01 15:58:30 2007] [notice] mod_python: Creating 4 session mutexes based on 256 max processes and 0 max threads. [Thu Mar 01 15:58:30 2007] [notice] Apache/2.0.52 (CentOS) configured -- resuming normal operations [Thu Mar 01 15:58:38 2007] [error] [client 127.0.0.1] (13)Permission denied: exec of '/usr/lib/nagios/cgi/status.cgi' failed, referer: http://127.0.0.1/nagios/side.html [Thu Mar 01 15:58:38 2007] [error] [client 127.0.0.1] Premature end of script headers: status.cgi, referer: http://127.0.0.1/nagios/side.html [Thu Mar 01 15:58:39 2007] [error] [client 127.0.0.1] (13)Permission denied: exec of '/usr/lib/nagios/cgi/tac.cgi' failed, referer: http://127.0.0.1/nagios/side.html --- I would like to make proper rules for this rpm but i have absolutely no clue about selinux and policies. Any hints what to read, where to start? Chris -- financial.com AG Tel. +49 (0) 89 / 31 85 28 - 44 Maria-Probst-Strasse 19 Fax. +49 (0) 89 / 31 85 28 - 28 D-80939 München http://www.financial.com/

6 6

CentOS 5 Beta Initial Test Release
by Hans-Joachim Hetscher 01 Mar '07

01 Mar '07

Hi, as requested by the qa-list moderator, I'd like to introduce myself: I'm working with LINUX since 1993 (I've still a almost complete floppy collection of the SLS distribution). I've done some patches for the DAMA AX25 part of the kernel. Actually, I support about 8 CentOS 4.4 and 1 Centos 3 servers. 2 of them act as a HA cluster (heartbeat + drbd) for samba. There are 2 brandnew servers waiting for CentOS5 for server consoldiation (cluster + xen). So I'd like to join the qa team, helping getting the most famous distribution. Hans-Joachim

1 0

Possible additional distribution vectors
by Daniel Clark 01 Mar '07

01 Mar '07

I was having a conversation with z00dax on IRC, and the suggestion was made that I post about this to the mailing list: CoBlitz is a nifty free distribution service for large files over http, that utilizes PlanetLab's network of hundreds of machines to provide bittorrent (or better)-like speeds while offering many of the advantages of bittorrent (less stress on mirror sites). The website is: http://codeen.cs.princeton.edu/coblitz/ To use it: ..."You add the prefix http://coblitz.codeen.org:3125/ to the URL you want to serve, and CoBlitz does the rest"... I'm sure you could do something like use tcpwrappers to limit the machines that can get to the mirror URL to the PlanetLab network. There was a good article on CoBlitz in the August 2006 edition of ;Login: - http://www.usenix.org/publications/login/2006-08/pdfs/park.pdf - however you need to be a Usenix/Sage member to read it (t becomes free August 2007). Another idea was to use a binary diff program like bsdiff - http://www.daemonology.net/bsdiff - to distribute patches to a base beta CD (that suggestion was less popular with z00dax - "thats why god made mirrors" :-) Oh, and someone might want to update the html files at http://dev.centos.org/mirrorscripts ; they reference torrents for really old beta versions. Eagerly awaiting CentOS 5 public betas, -- Daniel Clark # http://dclark.us # http://opensysadmin.com

3 2

Joining the team
by Fernando Brunelli 01 Mar '07

01 Mar '07

Hi, Just subscribed to the centos-devel list and I'd like to join devel and qa teams. I have been linux sysadmin since redhat 6, and currently running a dozen of CentOS 4 servers. I have RHCE and LPI certification, and a lot of packaging expertise. You don't know me (yet), but just give me a chance to collaborate. Thanks, Fernando Brunelli

1 0

evil centosplus dependency circle
by Michael Gabriel 01 Mar '07

01 Mar '07

trying a yum update on mysql, postgres or php forces the others to install. is that really wanted ??

7 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

devel March 2007