Skip to contentSkip to conversation

New: dhclient fails to run; capabilities error

Bugme-new Andrew Morton 4 participants 8 messages May 19, 2008 – May 20, 2008 1 message not in the archive

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]/

Andrew Morton

author
#1 lore raw

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 26 lines · On Mon, 19 May 2008 06:25:00 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10748

           Summary: dhclient fails to run; capabilities error
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.26-rc2
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
        AssignedTo: [email protected]
        ReportedBy: [email protected]

Latest working kernel version: 2.6.25
Earliest failing kernel version: 2.6.26-rc1
Distribution: Kubuntu Hardy
Hardware Environment: AMD
Software Environment:
Problem Description: On a default Kubuntu Hardy install, I fetched the git tree from Linus; compiled and installed the kernel. This persists even with 2.6.26-rc2+ (commit f26a3988917913b3d11b2bd741601a2c64ab9204)

Quoted 9 lines

If this isn't known, I'll bisect and report the bad commit

Steps to reproduce: 'sudo dhclient eth2' returns

drop_privileges: could not keep capabilities: Invalid argument

eth2 is an e1000e card.

whoa, weird. Could you please run `sudo strace -f dhclient eth2' and send us the last page or so of output?

#2 lore raw
Quoted 35 lines · Andrew Morton

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 30 lines · On Mon, 19 May 2008 06:25:00 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10748

           Summary: dhclient fails to run; capabilities error
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.26-rc2
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
        AssignedTo: [email protected]
        ReportedBy: [email protected]

Latest working kernel version: 2.6.25
Earliest failing kernel version: 2.6.26-rc1
Distribution: Kubuntu Hardy
Hardware Environment: AMD
Software Environment:
Problem Description: On a default Kubuntu Hardy install, I fetched the git tree from Linus; compiled and installed the kernel. This persists even with 2.6.26-rc2+ (commit f26a3988917913b3d11b2bd741601a2c64ab9204)

If this isn't known, I'll bisect and report the bad commit

Steps to reproduce: 'sudo dhclient eth2' returns

Quoted 8 lines
Quoted 5 lines

drop_privileges: could not keep capabilities: Invalid argument

eth2 is an e1000e card.

whoa, weird. Could you please run `sudo strace -f dhclient eth2' and send us the last page or so of output?

Also, please send your .config, or at least the result of grep SECURITY .config

thanks,
-serge

#3 lore raw
Quoted 42 lines · Serge E. Hallyn
Quoted 41 lines · Andrew Morton

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 35 lines · On Mon, 19 May 2008 06:25:00 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10748

           Summary: dhclient fails to run; capabilities error
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.26-rc2
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
        AssignedTo: [email protected]
        ReportedBy: [email protected]

Latest working kernel version: 2.6.25
Earliest failing kernel version: 2.6.26-rc1
Distribution: Kubuntu Hardy
Hardware Environment: AMD
Software Environment:
Problem Description: On a default Kubuntu Hardy install, I fetched the git tree from Linus; compiled and installed the kernel. This persists even with 2.6.26-rc2+ (commit f26a3988917913b3d11b2bd741601a2c64ab9204)

If this isn't known, I'll bisect and report the bad commit

Steps to reproduce: 'sudo dhclient eth2' returns

drop_privileges: could not keep capabilities: Invalid argument

eth2 is an e1000e card.

Quoted 5 lines
Quoted 2 lines

whoa, weird. Could you please run `sudo strace -f dhclient eth2' and send us the last page or so of output?

Also, please send your .config, or at least the result of grep SECURITY .config

His .config was attached to the bugzilla.
CONFIG_SECURITY=y
CONFIG_SECURITY_NETWORK=y
# CONFIG_SECURITY_NETWORK_XFRM is not set
# CONFIG_SECURITY_CAPABILITIES is not set
CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=0
# CONFIG_SECURITY_SELINUX is not set

Which means that he is using the dummy security module. And it appears that a prior commit moved KEEPCAPS handling from core prctl() to cap_task_prctl(), but didn't replicate it in the dummy_task_prctl().

The dummy module really needs to die.

Signature · 2 lines
Stephen Smalley
National Security Agency
#4 lore raw
Quoted 57 lines · Stephen Smalley
Quoted 42 lines · Serge E. Hallyn
Quoted 41 lines · Andrew Morton

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 35 lines · On Mon, 19 May 2008 06:25:00 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10748

           Summary: dhclient fails to run; capabilities error
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.26-rc2
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
        AssignedTo: [email protected]
        ReportedBy: [email protected]

Latest working kernel version: 2.6.25
Earliest failing kernel version: 2.6.26-rc1
Distribution: Kubuntu Hardy
Hardware Environment: AMD
Software Environment:
Problem Description: On a default Kubuntu Hardy install, I fetched the git tree from Linus; compiled and installed the kernel. This persists even with 2.6.26-rc2+ (commit f26a3988917913b3d11b2bd741601a2c64ab9204)

If this isn't known, I'll bisect and report the bad commit

Steps to reproduce: 'sudo dhclient eth2' returns

drop_privileges: could not keep capabilities: Invalid argument

eth2 is an e1000e card.

Quoted 5 lines
Quoted 2 lines

whoa, weird. Could you please run `sudo strace -f dhclient eth2' and send us the last page or so of output?

Also, please send your .config, or at least the result of grep SECURITY .config

His .config was attached to the bugzilla.
CONFIG_SECURITY=y
CONFIG_SECURITY_NETWORK=y
# CONFIG_SECURITY_NETWORK_XFRM is not set
# CONFIG_SECURITY_CAPABILITIES is not set
CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=0
# CONFIG_SECURITY_SELINUX is not set

Quoted 6 lines

Which means that he is using the dummy security module. And it appears that a prior commit moved KEEPCAPS handling from core prctl() to cap_task_prctl(), but didn't replicate it in the dummy_task_prctl().

The dummy module really needs to die.

Question for the bug reporter: did you really mean to build a kernel without capabilities support? Surprise! They don't really work when disabled.

Signature · 2 lines
Stephen Smalley
National Security Agency
#5 lore raw
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Stephen Smalley

Which means that he is using the dummy security module. And it appears that a prior commit moved KEEPCAPS handling from core prctl() to cap_task_prctl(), but didn't replicate it in the dummy_task_prctl().

Quoted 5 lines
Quoted 1 line

The dummy module really needs to die.

Question for the bug reporter: did you really mean to build a kernel without capabilities support? Surprise! They don't really work when disabled.

No; I was just trying out some random configs. This config worked till .25 properly though.

Signature · 2 lines
Amit Shah
http://www.amitshah.net/
#6 lore raw
Quoted 8 lines · Amit Shah
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Stephen Smalley

Which means that he is using the dummy security module. And it appears that a prior commit moved KEEPCAPS handling from core prctl() to cap_task_prctl(), but didn't replicate it in the dummy_task_prctl().

Quoted 8 lines
Quoted 5 lines
Quoted 1 line

The dummy module really needs to die.

Question for the bug reporter: did you really mean to build a kernel without capabilities support? Surprise! They don't really work when disabled.

No; I was just trying out some random configs. This config worked till .25 properly though.

The dummy module is generally in the untenable position of having to lie to userspace or break the existing capability-related system call interface. It should just go away, and make capability the default module (w/ stubs for the rest of the LSM hooks as with dummy). Then CONFIG_SECURITY=n will yield the same result as CONFIG_SECURITY=y w/o any further options.

Signature · 2 lines
Stephen Smalley
National Security Agency
#7 lore raw
Quoted 18 lines · Stephen Smalley
Quoted 8 lines · Amit Shah
Quoted 7 lines · Stephen Smalley
Quoted 5 lines · Stephen Smalley

Which means that he is using the dummy security module. And it appears that a prior commit moved KEEPCAPS handling from core prctl() to cap_task_prctl(), but didn't replicate it in the dummy_task_prctl().

Quoted 8 lines
Quoted 5 lines
Quoted 1 line

The dummy module really needs to die.

Question for the bug reporter: did you really mean to build a kernel without capabilities support? Surprise! They don't really work when disabled.

No; I was just trying out some random configs. This config worked till .25 properly though.

Quoted 6 lines

The dummy module is generally in the untenable position of having to lie to userspace or break the existing capability-related system call interface. It should just go away, and make capability the default module (w/ stubs for the rest of the LSM hooks as with dummy). Then CONFIG_SECURITY=n will yield the same result as CONFIG_SECURITY=y w/o any further options.

(cc Chris Wright and linux-security-module list)

s/same result/same user-visible behavior/

Signature · 2 lines
Stephen Smalley
National Security Agency
#8 lore raw
In reply to Andrew Morton
Quoted 3 lines · Andrew Morton

whoa, weird. Could you please run `sudo strace -f dhclient eth2' and send us the last page or so of output?

Sorry, I should've done that earlier.

9311  open("/var/lib/dhcp3/dhclient.leases", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
9311  chown("/var/lib/dhcp3/dhclient.leases", 100, 4294967295) = 0
9311  fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
9311  mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc511e8f000
9311  write(4, "lease {\n  interface \"eth0\";\n  fi"..., 531) = 531
9311  open("/var/run/dhclient.pid", O_WRONLY|O_CREAT|O_TRUNC, 0644) = 5
9311  fcntl(5, F_GETFL)                 = 0x8001 (flags O_WRONLY|O_LARGEFILE)
9311  fstat(5, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
9311  mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc511e8e000
9311  lseek(5, 0, SEEK_CUR)             = 0
9311  open("/etc/passwd", O_RDONLY|0x80000 /* O_??? */) = 6
9311  lseek(6, 0, SEEK_CUR)             = 0
9311  fstat(6, {st_mode=S_IFREG|0644, st_size=1558, ...}) = 0
9311  mmap(NULL, 1558, PROT_READ, MAP_SHARED, 6, 0) = 0x7fc511e8d000
9311  lseek(6, 1558, SEEK_SET)          = 1558
9311  munmap(0x7fc511e8d000, 1558)      = 0
9311  close(6)                          = 0
9311  socket(PF_FILE, SOCK_STREAM, 0)   = 6
9311  fcntl(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
9311  connect(6, {sa_family=AF_FILE, path="/var/run/nscd/socket"},
110) = -1 ENOENT (No such file or directory)
9311  close(6)                          = 0
9311  socket(PF_FILE, SOCK_STREAM, 0)   = 6
9311  fcntl(6, F_SETFL, O_RDWR|O_NONBLOCK) = 0
9311  connect(6, {sa_family=AF_FILE, path="/var/run/nscd/socket"},
110) = -1 ENOENT (No such file or directory)
9311  close(6)                          = 0
9311  open("/etc/group", O_RDONLY|0x80000 /* O_??? */) = 6
9311  lseek(6, 0, SEEK_CUR)             = 0
9311  fstat(6, {st_mode=S_IFREG|0644, st_size=923, ...}) = 0
9311  mmap(NULL, 923, PROT_READ, MAP_SHARED, 6, 0) = 0x7fc511e8d000
9311  lseek(6, 923, SEEK_SET)           = 923
9311  munmap(0x7fc511e8d000, 923)       = 0
9311  close(6)                          = 0
9311  prctl(0x8, 0x1, 0, 0, 0)          = -1 EINVAL (Invalid argument)
9311  dup(2)                            = 6
9311  fcntl(6, F_GETFL)                 = 0x8002 (flags O_RDWR|O_LARGEFILE)
9311  fstat(6, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 2), ...}) = 0
9311  mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc511e8d000
9311  lseek(6, 0, SEEK_CUR)             = -1 ESPIPE (Illegal seek)
9311  write(6, "drop_privileges: could not keep "..., 63) = 63
9311  close(6)                          = 0
9311  munmap(0x7fc511e8d000, 4096)      = 0
9311  exit_group(-1)                    = ?
Signature · 2 lines
Amit Shah
http://www.amitshah.net/