grsecurity forums

Hi all!

After installing Redhat latest glibc update(2.3.2-4.80) for RedHat linux 8.0 I'm unable to run my tomcat server in a chrooted jail. The problem is that java do not work anymore chrooted (signal 11...)
I've tried with grsec 1.9.8 and 1.9.9f (with the approrpiate versions of chpax.c)

Help me!
Thanks
lele

Do you see any chroot-related logs from grsecurity? Can you paste the configuration you have for the chroot options?

-Brad

I've "chpaxed" /chroot/tomcat/java/bin/java with options -msrp and
when I try as root (grsec-1.9.9f and chpax of 2003-04-01):
chroot /chroot/tomcat /java/bin/java
I get this on logs

kernel: grsec: From 172.16.100.14: signal 11 sent to (java:11483) UID(0) EUID(0), parent (bash:11408) UID(0) EUID(0)
kernel: grsec: From 172.16.100.14: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (java:11483) UID(0) EUID(0), parent (bash:11408) UID(0) EUID(0)

and "Segmentation fault" on my ssh console.

I'm using sysctl and now ALL things in /proc/.../grsecurity related to chroot are set to zero.

Thanks,
lele

If it may help, this is the output of:
strace -v chroot /chroot/tomcat /java/bin/java
....
_sysctl({{CTL_KERN, KERN_VERSION}, 2, 0xbfffe4cc, 35, (nil), 0}) = 0
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

lele

Can you try a clean 2.4.20 kernel? If you disabled all the chroot options via sysctl, there won't be any of grsec's chroot restrictions running. I'm not 100% convinced this is the result of grsecurity, additionally due to there being no logs from grsec. java runs fine when it's not chrooted?

-Brad

Yes!! you convinced me to try another way...
I copied ALL /lib to /chroot/tomcat/lib and now it works!!
I would like to know what is changed between the two version that now are required other libs... (I will inquire,any suggestion?)
Sorry for the waste of your time

Thanks a lot!
lele

It's always good when setting up a chroot for an app to run ldd on the app to make sure you have all the required libraries. Otherwise you'll run into the problem you had.

-Brad