#1052472 linux-image-6.5.0-1-powerpc64: Can't run program if its executable file was made immutable via chattr(1)

Package:
src:linux
Source:
src:linux
Submitter:
WHR
Date:
2024-02-27 04:00:03 UTC
Severity:
normal
Tags:
#1052472#5
Date:
2023-09-22 16:13:48 UTC
From:
To:
Taking executable file /usr/bin/ssh to demonstrate the issue:

	# which ssh
	/usr/bin/ssh
	# ssh
	usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]
	           [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]
	           [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]
	           [-i identity_file] [-J [user@]host[:port]] [-L address]
	           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
	           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]
	           [-w local_tun[:remote_tun]] destination [command]
	# chattr +i /usr/bin/ssh
	# ssh
	Segmentation fault


By trying to load the program via ld.so(1) with truss (actually strace), it
shows that a mmap(2) call used to load the data segument failed due to EPERM:

	# truss -s 128 -f /lib/powerpc64-linux-gnu/ld64.so.1 /usr/bin/ssh
	execve("/lib/powerpc64-linux-gnu/ld64.so.1", ["/lib/powerpc64-linux-gnu/ld64.so.1", "/usr/bin/ssh"], 0x7fffc0380530 /* 29 vars */) = 0
	brk(NULL)                               = 0x1000db60000
	openat(AT_FDCWD, "/usr/bin/ssh", O_RDONLY|O_CLOEXEC) = 3
	read(3, "\177ELF\2\2\1\0\0\0\0\0\0\0\0\0\0\3\0\25\0\0\0\1\0\0\0\0\0\22h\220\0\0\0\0\0\0\0@\0\0\0\0\0\22\4\330\0\0\0\1\0@\08\0\t\0@\0\35\0\34\0\0\0\6\0\0\0\4\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\1\370\0\0\0\0\0\0\1\370\0\0\0\0\0\0\0\10\0\0\0\3\0\0\0\4"..., 832) = 832
	mmap(NULL, 1259760, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fff93720000
	mprotect(0x7fff93830000, 65536, PROT_NONE) = 0
	mmap(0x7fff93840000, 131072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x110000) = -1 EPERM (Operation not permitted)
	close(3)                                = 0
	writev(2, [{iov_base="/usr/bin/ssh", iov_len=12}, {iov_base=": ", iov_len=2}, {iov_base="error while loading shared libraries", iov_len=36}, {iov_base=": ", iov_len=2}, {iov_base="/usr/bin/ssh", iov_len=12}, {iov_base=": ", iov_len=2}, {iov_base="failed to map segment from shared object", iov_len=40}, {iov_base="", iov_len=0}, {iov_base="", iov_len=0}, {iov_base="\n", iov_len=1}], 10/usr/bin/ssh: error while loading shared libraries: /usr/bin/ssh: failed to map segment from shared object
	) = 107
	exit_group(127)                         = ?
	+++ exited with 127 +++


I can also reproduce this issue on Bullseye (with Linux 5.10.0-21-amd64);
while Buster (Linux 4.19.0-23-amd64) is fine.
#1052472#10
Date:
2023-09-24 16:38:30 UTC
From:
To:
Control: reassign -1 src:zfs-linux
[...]
[...]

I can't reproduce this on an ext4 filesystem, so I think ZFS is the
problem.

ZFS has its own check that blocks a writable mmap of an immutable file,
without taking MAP_PRIVATE into account:
https://sources.debian.org/src/zfs-linux/2.1.12-2/module/os/linux/zfs/zfs_vnops_os.c/#L3908

Ben.
#1052472#19
Date:
2023-10-03 03:36:12 UTC
From:
To:
Thanks for the hint, this is indeed a ZFS bug.
Reported to upstream at https://github.com/openzfs/zfs/pull/15344/


2023-09-25 0:38 GMT+08:00, Ben Hutchings <ben@decadent.org.uk>:
#1052472#24
Date:
2024-01-04 15:46:17 UTC
From:
To:
Let's hope this would get in an official upstream release soon.

Thanks,
Shengqi Chen
#1052472#33
Date:
2024-02-27 03:57:24 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
zfs-linux, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1052472@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Shengqi Chen <harry-chen@outlook.com> (supplier of updated zfs-linux package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Feb 2024 21:28:24 +0800
Source: zfs-linux
Architecture: source
Version: 2.2.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian ZFS on Linux maintainers <pkg-zfsonlinux-devel@alioth-lists.debian.net>
Changed-By: Shengqi Chen <harry-chen@outlook.com>
Closes: 1052472 1060899
Changes:
 zfs-linux (2.2.3-1) unstable; urgency=medium
 .
   [ Aron Xu ]
   * d/control: add Shengqi Chen to Uploaders
 .
   [ Shengqi Chen ]
   * New upstream version 2.2.3
     - add compatibility with Linux 6.6 (closes: #1060899)
     - fix private mmap permission of R/O files (closes: #1052472)
     - ...and many more fixes (see upstream changelog)
   * Some packaging updates:
     - symbols: add new symbols for 2.2.3 in libzfs4 and libzpool5
     - lintian-overrides: remove obsolete rules, update rule names
     - README.debian: fix a typo
     - control: lift dh-compat to 13
     - not-installed: remove actually installed files
     - patches:
       + remove some outdated / applied patches
       + fix a typo in 2100-zfs-load-module.patch (related: #1041857)
       + enable ubuntu/zfs-mount-container-start.patch
Checksums-Sha1:
 ad5ec14adc2bb87d176083158101aa5c6aa303be 3245 zfs-linux_2.2.3-1.dsc
 9ffb52669de2a3c134b0f5ce032be2909d0e5a37 33854765 zfs-linux_2.2.3.orig.tar.gz
 1320b47c6cceae747f054dbd8428a6fafe3db98d 106888 zfs-linux_2.2.3-1.debian.tar.xz
 080666949dc730b972ffed4d8cc3ca47a6312ffe 8311 zfs-linux_2.2.3-1_source.buildinfo
Checksums-Sha256:
 51b28604b4ba30d28845e45edbc117a6f4af5eb4a8f1f633914317c770c4ca76 3245 zfs-linux_2.2.3-1.dsc
 30a512f34ec5c841b8b2b32cc9c1a03fd49391b26c9164d3fb30573fb5d81ac3 33854765 zfs-linux_2.2.3.orig.tar.gz
 212412e4a2d9719d22d7d447dc4a861d493249fbf1c5dac7edd67c42f07459a0 106888 zfs-linux_2.2.3-1.debian.tar.xz
 925f8e1f07aed30fa3c83f526b09718388ee8cc49b6ef31409e0be6ca0f95d23 8311 zfs-linux_2.2.3-1_source.buildinfo
Files:
 53314686b9de831197647a5f3c8300ae 3245 contrib/kernel optional zfs-linux_2.2.3-1.dsc
 e0f2b72ccd47a5b401cbc9f38b1d9073 33854765 contrib/kernel optional zfs-linux_2.2.3.orig.tar.gz
 c6c237bd16049241a10fe04219ca9408 106888 contrib/kernel optional zfs-linux_2.2.3-1.debian.tar.xz
 5816656647d8701b49ba38fa96c25d65 8311 contrib/kernel optional zfs-linux_2.2.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEBLHAyuu1xqoC2aJ5NP8o68vMTMgFAmXdU/gACgkQNP8o68vM
TMiaTAf5AbXpdHkKkK4eoYNPa5KVE02et+rOgefds6bIjU811k9rCQUleHUH7MDk
dU6W9mW7IiR/IFB0zuROrPeajr2LzlnzuVUiANTGaD3PwyqCCEYA5Hef00ekwMqw
5M6ePiyxnmNxAsCCQJ2Q/wQEXjdlZdyFoxDu1p2/H7iugApvOKWS7qqM+3PeSMmS
PfyZL+H9hdRpbW9E8/S9COYh9NyMr6WHW/lt3JfK/Xen79+BLv3KPTAdE6dWkQvF
A5CVw/OvS6Kw+bkQ12m4Oqb5/XKb0DicAyFStUeScK9uxbNXnqW8qzBtA5Ytdp3a
gfYHOQ7/biKBvMHNpO2emIjW0diNiA==
=7I3c
-----END PGP SIGNATURE-----