On Mon, 29 Sep 2008 19:57:02 +0300 Alex Efros <[EMAIL PROTECTED]> wrote:
> > why those events occured is another question and each case needs > > its own investigation. for example overstepping the default 8MB > > stack limit by 180MB sounds like a memory corruption problem or > > something trying to pass an inordinate amount of data on the stack > > (say, in the environment). whether that was because of e.g., a bug > > in a script on your server or an exploit attempt is hard to tell > > after the fact. also the AS limit overstep is a known issue, qmail > > tries to be smart and fails to estimate its own memory needs. > > Now I've smaller example. I've executed this command 10 times: > perl -e 'exec "/bin/pwd"' > and got 5 records in logs, listed below. > Executing just: > /bin/pwd > or > bash -c 'exec /bin/pwd' > many times doesn't result in grsec alerts. > If you wanna say "it's because of perl", I'd like to remind you - > there was no perl scripts between tcpserver and qmail-smtpd before, > the command looks this way: > /usr/bin/tcpserver -p -v -R -x /etc/tcprules.d/tcp.qmail-smtp.cdb > \ -c 40 -u 201 -g 200 0.0.0.0 smtp /var/qmail/bin/qmail-smtpd > > Didn't you think it's good idea to trace this issue? It may be a bug > in grsec... anyway, usual hardened system shouldn't produce such a > warnings in logs just because somebody call exec() from perl script > or use qmail. What's the output of `strace perl -e 'exec "/bin/pwd"' 2>&1 \ |grep -i rlimit`? Also try invoking perl with `env -i` to rule out any environment issues. --atj
