Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Whitelist_mode return Fatal trap 9 #39

Open
zloirus opened this issue May 15, 2018 · 1 comment
Open

Whitelist_mode return Fatal trap 9 #39

zloirus opened this issue May 15, 2018 · 1 comment
Assignees

Comments

@zloirus
Copy link

zloirus commented May 15, 2018

Good day.
After loading secadm.rules with whitelist_mode, any try of calling command witch enabled in secadm.rulesl return. But if I try run something witch is not in whitelist everything is fine, secadm just deny the command and server keep working.
I tried install secadm from sourcecode and from pkg, and tested it in several PC's evrywhere result is the same.
EROR:
Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer = 0x20:0xffffffff93f218f7
stack pointer = 0x28:0xfffffe001a23af20
frame pointer = 0x28:0xfffffe001a23b490
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 38332 (csh)
[ thread pid 38332 tid 100829 ]
Stopped at secadm_vnode_check_exec+0x2c7: movq ll+0x7(%rax),%rsi

My secadm.rules

_secadm {
        integriforce {
                path: "/bin/ls",
                hash: "ebcba2ce62c25e44afa6b27dd208f8f709737ac5",
                type: "sha1",
                mode: "hard"
        },
        integriforce {
                path: "/bin/csh",
                hash: "900e7726a1fd47368f78454e0e7bf709866446e6",
                type: "sha1",
                mode: "hard"
        },
        whitelist_mode: true
}

uname -a
FreeBSD test 12.0-CURRENT FreeBSD 12.0-CURRENT #0 [DEVEL:HardenedBSD-CURRENT-amd64:1184]: Mon Apr 30 16:41:48 UTC 2018 [email protected]:/usr/obj/usr/src/amd64.amd64/sys/HARDENEDBSD amd64

But if I try run something witch is not in whitelist everything is fine, secadm just deny the command and server keep working

@lattera
Copy link
Member

lattera commented Sep 21, 2018

FreeBSD revamped how locking in the kernel works under-the-hood. secadm currently abuses some of the old behaviors, which don't work well with the revamped locking code. I'm (slowly) working on a more simplistic rewrite of secadm that addresses this issue.

@lattera lattera self-assigned this Sep 21, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants