Debian Bug report logs - #391353
aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Fri, 06 Oct 2006 08:58:16 +0200

Package: aide
Version: 0.11a-4
Severity: serious

I upgraded my personal server to etch and choosed to use a Xen enabled
kernel since we're going to have Xen support in etch (and also because
we're using this for the new alioth.debian.org so I wanted to have a
testbed for me).

This morning my server was almost unreachable and while looking through
the logs I discovered those messages:
Oct  6 05:17:34 arrakeen kernel: printk: 246 messages suppressed.
Oct  6 05:17:34 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
Oct  6 05:17:40 arrakeen kernel: printk: 291 messages suppressed.
Oct  6 05:17:40 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335

Those messages appear when you use the standard libc6 instead of libc6-xen
on a Xen enabled kernel. However I have libc6-xen installed.... but aide
is using its own statically linked libc6 which thus generates this
message.

Those messages means that the kernel worked around the bad libc6 but it's
extremely ineffective in doing so, so much that it effectively DOSsed my
server during the 3 hours when aide was running.

I see two solutions:
- either you link again libc6 dynamically
- either you provide two versions of the binary and you use alternatives
  (or you modify the cron script to detect /proc/xen and to start the
  right binary)

However it looks like there's no "libc6-xen-dev" to link statically a
xen-enabled libc6... 

So for etch, the right thing to do might be to provide additionnaly
a binary dynamically linked and to use the dynamic one if you detect
/proc/xen.

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-1-xen-686
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)

Message #10 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [Pkg-aide-maintainers] Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Fri, 6 Oct 2006 11:26:45 +0200

tags #391353 help
# help needed to link aide statically against non-tls glibc or dietlibc
thanks

On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> I upgraded my personal server to etch and choosed to use a Xen enabled
> kernel since we're going to have Xen support in etch (and also because
> we're using this for the new alioth.debian.org so I wanted to have a
> testbed for me).
> 
> This morning my server was almost unreachable and while looking through
> the logs I discovered those messages:
> Oct  6 05:17:34 arrakeen kernel: printk: 246 messages suppressed.
> Oct  6 05:17:34 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> Oct  6 05:17:40 arrakeen kernel: printk: 291 messages suppressed.
> Oct  6 05:17:40 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> 
> Those messages appear when you use the standard libc6 instead of libc6-xen
> on a Xen enabled kernel.

That is a kernel bug, these messages should have a rate limit to not
take the server down. I'm cloning the bug to the kernel because of
that.

>  However I have libc6-xen installed.... but aide is using its own
>  statically linked libc6 which thus generates this message.

Yes, that's a feature, see README.Debian.gz, section "statically
linked".

> Those messages means that the kernel worked around the bad libc6 but it's
> extremely ineffective in doing so, so much that it effectively DOSsed my
> server during the 3 hours when aide was running.

Kernel bug.

> I see two solutions:
> - either you link again libc6 dynamically

That's going to render aide useless, see README.Debian.gz.

> - either you provide two versions of the binary and you use alternatives
>   (or you modify the cron script to detect /proc/xen and to start the
>   right binary)

Send a patch, please.

A third solution would be to link aide either against dietlibc or the
non-tls version of glibc. I do not have a clue how to do this.

> However it looks like there's no "libc6-xen-dev" to link statically a
> xen-enabled libc6...

That would be a libc6 bug.

> So for etch, the right thing to do might be to provide additionnaly
> a binary dynamically linked and to use the dynamic one if you detect
> /proc/xen.

I beg to differ. I'll probably make aide bail out if /proc/xen is
detected.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #15 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org

Cc: glibc@packages.debian.org

Subject: please provide package to allow static link agains libc6-xen

Date: Fri, 6 Oct 2006 11:29:19 +0200

clone #391353 -1
retitle -1 please provide package to allow static link agains libc6-xen
reassign -1 glibc
submitter -1 Marc Haber <mh+debian-packages@zugschlus.de>
block #391353 with -1
thanks

On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
[snip bug report about statically linked aide binary DoSsing xen guest]
> However it looks like there's no "libc6-xen-dev" to link statically a
> xen-enabled libc6... 

Please allow static linking of xen-enabled libc6.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #20 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org

Cc: linux-image-2.6.18-1-xen-686@packages.debian.org

Subject: Re: [Pkg-aide-maintainers] Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Fri, 6 Oct 2006 11:39:19 +0200

clone #391353 -1
retitle -1 Should not DoS system if statically linked binary is run
reassign -1 linux-image-2.6.18-1-xen-686
submitter -1 Marc Haber <mh+debian-packages@zugschlus.de>
block #391353 with -1
thanks


On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> I upgraded my personal server to etch and choosed to use a Xen enabled
> kernel since we're going to have Xen support in etch (and also because
> we're using this for the new alioth.debian.org so I wanted to have a
> testbed for me).
> 
> This morning my server was almost unreachable and while looking through
> the logs I discovered those messages:
> Oct  6 05:17:34 arrakeen kernel: printk: 246 messages suppressed.
> Oct  6 05:17:34 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> Oct  6 05:17:40 arrakeen kernel: printk: 291 messages suppressed.
> Oct  6 05:17:40 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> 
> Those messages appear when you use the standard libc6 instead of libc6-xen
> on a Xen enabled kernel. However I have libc6-xen installed.... but aide
> is using its own statically linked libc6 which thus generates this
> message.
> 
> Those messages means that the kernel worked around the bad libc6 but it's
> extremely ineffective in doing so, so much that it effectively DOSsed my
> server during the 3 hours when aide was running.

I consider this a kernel bug. The kernel should not DoS the system in
case a binary statically linked against a normal glibc is run.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #35 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

Cc: 391353@bugs.debian.org

Subject: Re: [Pkg-aide-maintainers] Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Fri, 6 Oct 2006 12:06:05 +0200

On Fri, 06 Oct 2006, Marc Haber wrote:
> > I see two solutions:
> > - either you link again libc6 dynamically
> 
> That's going to render aide useless, see README.Debian.gz.

Useless is a bit strong... I understand the need to be paranoid and
that's why I'm ok with the default of using a statically linked version.

> > So for etch, the right thing to do might be to provide additionnaly
> > a binary dynamically linked and to use the dynamic one if you detect
> > /proc/xen.
> 
> I beg to differ. I'll probably make aide bail out if /proc/xen is
> detected.

This is the minimum, yes. However I would highly prefer having the
possibility to run a less secure aide rather than not running it at all.

> > - either you provide two versions of the binary and you use alternatives
> >   (or you modify the cron script to detect /proc/xen and to start the
> >   right binary)
> 
> Send a patch, please.

What patch would you accept? You seem to not want my proposal of providing
both a dynamicly linked version and a statically linked version...

> A third solution would be to link aide either against dietlibc or the
> non-tls version of glibc. I do not have a clue how to do this.

Neither do I.

> > However it looks like there's no "libc6-xen-dev" to link statically a
> > xen-enabled libc6...
> 
> That would be a libc6 bug.

Aurelien Jarno told it's very difficult to provide this. There's very
little chance that you get that for etch.

Cheers,
-- 
Raphaël Hertzog

Premier livre français sur Debian GNU/Linux :
http://www.ouaza.com/livre/admin-debian/

Message #40 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org

Subject: Re: Bug#391353: [Pkg-aide-maintainers] Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Fri, 6 Oct 2006 14:01:57 +0200

On Fri, Oct 06, 2006 at 12:06:05PM +0200, Raphael Hertzog wrote:
> On Fri, 06 Oct 2006, Marc Haber wrote:
> > > So for etch, the right thing to do might be to provide additionnaly
> > > a binary dynamically linked and to use the dynamic one if you detect
> > > /proc/xen.
> > 
> > I beg to differ. I'll probably make aide bail out if /proc/xen is
> > detected.
> 
> This is the minimum, yes. However I would highly prefer having the
> possibility to run a less secure aide rather than not running it at all.

I feel like a dynamically linked aide is going to provide a false
sense of security.

> > > - either you provide two versions of the binary and you use alternatives
> > >   (or you modify the cron script to detect /proc/xen and to start the
> > >   right binary)
> > 
> > Send a patch, please.
> 
> What patch would you accept? You seem to not want my proposal of providing
> both a dynamicly linked version and a statically linked version...

I don't like the idea but I'd accept such a patch with an
appropriately worded description for the dynamically linked version.
I'd like two .debs to be built though, no idea if ftpmaster would
accept that. Maybe there would be need for an aide-base package.

> > > However it looks like there's no "libc6-xen-dev" to link statically a
> > > xen-enabled libc6...
> > 
> > That would be a libc6 bug.
> 
> Aurelien Jarno told it's very difficult to provide this. There's very
> little chance that you get that for etch.

I don't expect that for etch, we're freezing in like four days.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #51 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org, 391353-submitter@bugs.debian.org

Cc: Marc Haber <mh+debian-packages@zugschlus.de>

Subject: Re: Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Sun, 8 Apr 2007 14:49:02 +0200

On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> Those messages appear when you use the standard libc6 instead of libc6-xen
> on a Xen enabled kernel. However I have libc6-xen installed.... but aide
> is using its own statically linked libc6 which thus generates this
> message.

Can you try linking aide statically against libc6-xen which should be
possible since glibc 2.5-0exp3? If you are successful, I'll add an
aide-xen package.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #59 received at 391353-quiet@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: Marc Haber <mh+debian-packages@zugschlus.de>, 391353-quiet@bugs.debian.org

Subject: Re: Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Mon, 30 Apr 2007 22:05:15 +0200

Hi,

On Sun, 08 Apr 2007, Marc Haber wrote:
> On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> > Those messages appear when you use the standard libc6 instead of libc6-xen
> > on a Xen enabled kernel. However I have libc6-xen installed.... but aide
> > is using its own statically linked libc6 which thus generates this
> > message.
> 
> Can you try linking aide statically against libc6-xen which should be
> possible since glibc 2.5-0exp3? If you are successful, I'll add an
> aide-xen package.

I modified debian/rules to call configure with
« --with-extra-libs="-L/usr/lib/xen/" » and it apparently built a
different binary. However I don't have a Xen-enabled i386 machine where I
can afford to test it currently.

Cheers,
-- 
Raphaël Hertzog

Premier livre français sur Debian GNU/Linux :
http://www.ouaza.com/livre/admin-debian/

Message #64 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Raphael Hertzog <hertzog@debian.org>, 391353@bugs.debian.org, 391353-submitter@bugs.debian.org

Subject: Re: Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Thu, 24 May 2007 15:44:16 +0200

On Mon, Apr 30, 2007 at 10:05:15PM +0200, Raphael Hertzog wrote:
> On Sun, 08 Apr 2007, Marc Haber wrote:
> > On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> > > Those messages appear when you use the standard libc6 instead of libc6-xen
> > > on a Xen enabled kernel. However I have libc6-xen installed.... but aide
> > > is using its own statically linked libc6 which thus generates this
> > > message.
> > 
> > Can you try linking aide statically against libc6-xen which should be
> > possible since glibc 2.5-0exp3? If you are successful, I'll add an
> > aide-xen package.
> 
> I modified debian/rules to call configure with
> « --with-extra-libs="-L/usr/lib/xen/" » and it apparently built a
> different binary. However I don't have a Xen-enabled i386 machine where I
> can afford to test it currently.

Thanks for finding out anyway. I have split up the package to provide
different binaries and have uploaded to experimental. It'll have to
pass NEW and ftpmaster scrutiny, so don't expect it to show up any
time soon.

I'd appreciate if people with xen hosts could check the new aide-xen
and/or aide-dynamic packages.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 3221 2323190

Message #72 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: control@bugs.debian.org

Cc: 391353@bugs.debian.org, 391372@bugs.debian.org

Subject: unblock 391353 with 391372

Date: Mon, 25 Feb 2008 14:44:17 +0100

# Automatically generated email from bts, devscripts version 2.10.16
# 391372 fixed
unblock 391353 with 391372

Message #79 received at 391353@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: 391353@bugs.debian.org, 391353-submitter@bugs.debian.org

Cc: Raphael Hertzog <hertzog@debian.org>

Subject: Re: Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Mon, 25 Feb 2008 15:03:46 +0100

package aide
user aide@packages.debian.org
usertags #391353 close-20080430
thanks

On Thu, May 24, 2007 at 03:44:16PM +0200, Marc Haber wrote:
> Thanks for finding out anyway. I have split up the package to provide
> different binaries and have uploaded to experimental. It'll have to
> pass NEW and ftpmaster scrutiny, so don't expect it to show up any
> time soon.
> 
> I'd appreciate if people with xen hosts could check the new aide-xen
> and/or aide-dynamic packages.

I plan to close this bug by the end of april 2008 if nobody objects.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Message #87 received at 391353-done@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Marc Haber <mh+debian-packages@zugschlus.de>, 391353-done@bugs.debian.org, 391353-submitter@bugs.debian.org

Cc: Raphael Hertzog <hertzog@debian.org>

Subject: Re: Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

Date: Sun, 30 Aug 2009 14:45:14 +0200

Version: 0.13.1-8

On Mon, Feb 25, 2008 at 03:03:46PM +0100, Marc Haber wrote:
> I plan to close this bug by the end of april 2008 if nobody objects.

Doing so now.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835

Send a report that this bug log contains spam.