Kernel Patch

[giolekva]

Hey,

I want to understand how to use linux kernel patch without reuse library. I want to set secure mode, time and memory limits, but every time I get following:

Code: Select all

starting ...
secure: 0
MLE: -1
TLE: -1
<program name unknown>: error while loading shared libraries: libc.so.6: cannot open shared object file: Operation not permitted
parent: finished child with status: 163584

Here's my code:
exec.c

Code: Select all

#include <sys/resource.h>
#include <sys/ptrace.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

#define RLIMIT_MCPU 15

void error(char* msg) {
	fprintf(stderr, "%s\n", msg);
	exit(1);
}

int start_secure_mode() {
	printf("starting ...\n");
	printf("secure: %d\n", ptrace(0x4281, 0, 0, 0));
	printf("MLE: %d\n", ptrace(0x4280, 0, 0, 0));
	printf("TLE: %d\n", ptrace(0x4282, 0, 0, 0));	
/*	if (ptrace(0x4280, 0, 0, 0) == 0) {
		return 1;	
	} else {
		return 0;	
	}*/
}

int main(int argc, char** argv) {
	pid_t pid;
	pid = fork();
	if (pid == 0) { // child
		struct rlimit lim;
		lim.rlim_cur = 5000;
		lim.rlim_max = 5000;
		setrlimit(RLIMIT_MCPU, &lim);

		if (!start_secure_mode()) {
			error("Couldn't start secure mode.");	
		} else {
			execv("sum.o", NULL);
		}
	} else if (pid > 0) { // parent
		int status;		
		wait(&status);
		printf("parent: finished child with status: %d\n", status);	
	} else { // error
		fprintf(stderr, "can't fork, error %d\n", errno);
		exit(EXIT_FAILURE);
	}
	return 0;
}

sum.c

Code: Select all

#include <stdio.h>
#include <stdlib.h>

#define MAX_N 100

int a[1000][1000];

int main(int argc, char** argv) {
	int i, j, sum = 0;
	for (i = 0; i < MAX_N; i++) {
		for (j = 0; j < MAX_N; j++) {
			sum += i * j;		
		}
	}
	printf("%d\n", sum);
}

What am I doing wrong?

P.S. Sorry, my Russian is even worse

[cher]

You should link sum.c statically.

gcc -static sum.c -o sum

[giolekva]

Thanks, will try it later today. But I think it will resolve only shared library (libc and others) loading problem. Will I be able to set time/memory limits after static compiling?

[giolekva]

Hey, I've executed sum.c successfully after compilation with -static option, but I still can't set time and memory limits

Any suggestions?

[cher]

Switching on the secure mode disables any further ptrace syscalls.
You should enable memory limits and security violations first, then enable the secure mode.