openssh static build - mission impossible?

Mr Dash Four mr.dash.four at googlemail.com
Tue Mar 13 13:11:58 EST 2012


> Looks like time to run strace and non-daemon mode for sshd. Can you do
> those on the test environment?
OK, I managed to smuggle in strace (don't ask!) and ran it with "strace -ffvrTxo sshd /etc/rc.d/init.d/sshd start". As a result of this, I've got something very interesting - in the process that subsequently segfaults, which is span by the main sshd executable, at the end of the trace I get this little gem:

----->8-----------
     0.000732 bind(4, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 <0.000152>
     0.000915 getsockname(4, {sa_family=AF_NETLINK, pid=2576, groups=00000000}, [12]) = 0 <0.000153>
     0.002869 gettimeofday({1331602612, 171594}, NULL) = 0 <0.000153>
     0.001038 recv(4, "\x14\x00\x00\x00\x12\x00\x01\x03\xb4\xa4\x5e\x4f\x00\x00\x00\x00\x00\x00\x00\x00", 20, 0) = 20 <0.000367>
     0.001343 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\xac\x01\x00\x00\x10\x00\x02\x00\xb4\xa4\x5e\x4f\x10\x0a\x00\x00\x00\x00\x04\x03\x01\x00\x00\x00\x49\x00\x01\x00\x00\x00\x00\x00"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 3492 <0.000305>
     0.002380 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\xb8\x01\x00\x00\x10\x00\x02\x00\xb4\xa4\x5e\x4f\x10\x0a\x00\x00\x00\x00\x01\x00\x09\x00\x00\x00\x02\x10\x00\x00\x00\x00\x00\x00"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 876 <0.000213>
     0.002228 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x14\x00\x00\x00\x03\x00\x02\x00\xb4\xa4\x5e\x4f\x10\x0a\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x02\x10\x00\x00\x00\x00\x00\x00"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 <0.000183>
     0.002166 recv(4, "\x14\x00\x00\x00\x16\x00\x01\x03\xb5\xa4\x5e\x4f\x00\x00\x00\x00\x00\x00\x00\x00", 20, 0) = 20 <0.000275>
     0.001282 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x30\x00\x00\x00\x14\x00\x02\x00\xb5\xa4\x5e\x4f\x10\x0a\x00\x00\x02\x08\x80\xfe\x01\x00\x00\x00\x08\x00\x01\x00\x7f\x00\x00\x01"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 108 <0.000244>
     0.002625 recvmsg(4, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\x14\x00\x00\x00\x03\x00\x02\x00\xb5\xa4\x5e\x4f\x10\x0a\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x08\x00\x01\x00\x7f\x00\x00\x01"..., 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 <0.000183>
     0.002288 close(4)                  = 0 <0.000275>
     0.001008 getuid32()                = 0 <0.000153>
     0.000763 --- SIGSEGV (Segmentation fault) @ 0 (1237ac) ---

------8<----------

So, it seems the offending function is our old friend getuid32()! Any suggestions? I have the full trace of everything (5 child processes were span in total and the one above was created when I tried to log in).


More information about the openssh-unix-dev mailing list