[gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[Grant]

One of my Blu-Ray rips won't play and there is a steady stream of
"Error while decoding frame!" messages in mplayer's output when I try.
 I just noticed that each time I try to play the movie, I get another
one of these in dmesg:

grsec: denied resource overstep by requesting 135168 for
RLIMIT_MEMLOCK against limit 32768 for /usr/bin/mplayer[mplayer:22122]
uid/euid:1000/1000 gid/egid:100/100, parent /bin/bash[bash:22095]
uid/euid:1000/1000 gid/egid:100/100

I tried:

paxctl -m /usr/bin/mplayer

but it doesn't seem to make any difference.  Does anyone know how to
fix this?  How can I undo what I did with the above paxctl command
since it doesn't seem to be helping?

- Grant

[gentoo-hardened] Re: denied resource overstep... for RLIMIT_MEMLOCK

[Grant]

> One of my Blu-Ray rips won't play and there is a steady stream of
> "Error while decoding frame!" messages in mplayer's output when I try.
>  I just noticed that each time I try to play the movie, I get another
> one of these in dmesg:
>
> grsec: denied resource overstep by requesting 135168 for
> RLIMIT_MEMLOCK against limit 32768 for /usr/bin/mplayer[mplayer:22122]
> uid/euid:1000/1000 gid/egid:100/100, parent /bin/bash[bash:22095]
> uid/euid:1000/1000 gid/egid:100/100
>
> I tried:
>
> paxctl -m /usr/bin/mplayer
>
> but it doesn't seem to make any difference.  Does anyone know how to
> fix this?  How can I undo what I did with the above paxctl command
> since it doesn't seem to be helping?
>
> - Grant

I should have checked this before posting but I actually get the same
grsec message when playing movies in mplayer that work perfectly fine.
 Is there any need to do anything based on the message?

I also noticed this in dmesg on a different system and I'm wondering about it:

PAX: execution attempt in:
/usr/lib64/opengl/nvidia/lib/libGLcore.so.177.82,
6b8d6f990000-6b8d6fd20000 00c1b000
PAX: terminating task: /usr/bin/Xorg(X):14958, uid/euid: 0/0, PC:
00006b8d6fc665d0, SP: 000077eb50bd1258
PAX: bytes at PC: 64 48 8b 04 25 68 ff ff ff ff a0 10 08 00 00 cc cc cc cc cc
PAX: bytes at SP-8:

- Grant

Re: [gentoo-hardened] Re: denied resource overstep... for RLIMIT_MEMLOCK

[pageexec]

On 15 Jan 2009 at 18:05, Grant wrote:

> I also noticed this in dmesg on a different system and I'm wondering about it:
> 
> PAX: execution attempt in:
> /usr/lib64/opengl/nvidia/lib/libGLcore.so.177.82,
> 6b8d6f990000-6b8d6fd20000 00c1b000
> PAX: terminating task: /usr/bin/Xorg(X):14958, uid/euid: 0/0, PC:
> 00006b8d6fc665d0, SP: 000077eb50bd1258
> PAX: bytes at PC: 64 48 8b 04 25 68 ff ff ff ff a0 10 08 00 00 cc cc cc cc cc
> PAX: bytes at SP-8:

i think you really need to read up on what PaX does... the above means
that Xorg wanted to execute runtime generated code therefore you'll need
to allow it, just like you already did for mplayer. not that it's great
for security...

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[pageexec]

On 15 Jan 2009 at 17:55, Grant wrote:

> One of my Blu-Ray rips won't play and there is a steady stream of
> "Error while decoding frame!" messages in mplayer's output when I try.
>  I just noticed that each time I try to play the movie, I get another
> one of these in dmesg:
> 
> grsec: denied resource overstep by requesting 135168 for
> RLIMIT_MEMLOCK against limit 32768 for /usr/bin/mplayer[mplayer:22122]
> uid/euid:1000/1000 gid/egid:100/100, parent /bin/bash[bash:22095]
> uid/euid:1000/1000 gid/egid:100/100

it's just a report that mplayer wanted to lock more memory than
you allowed, or rather, what the kernel allows by default. ulimit(1)
and related things are your friend.

> paxctl -m /usr/bin/mplayer
> 
> but it doesn't seem to make any difference.

actually, that one is needed for certain win32 codecs.

>  Does anyone know how to
> fix this?  How can I undo what I did with the above paxctl command
> since it doesn't seem to be helping?

man paxctl would tell you if you looked ;).

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[Grant]

>> One of my Blu-Ray rips won't play and there is a steady stream of
>> "Error while decoding frame!" messages in mplayer's output when I try.
>>  I just noticed that each time I try to play the movie, I get another
>> one of these in dmesg:
>>
>> grsec: denied resource overstep by requesting 135168 for
>> RLIMIT_MEMLOCK against limit 32768 for /usr/bin/mplayer[mplayer:22122]
>> uid/euid:1000/1000 gid/egid:100/100, parent /bin/bash[bash:22095]
>> uid/euid:1000/1000 gid/egid:100/100
>
> it's just a report that mplayer wanted to lock more memory than
> you allowed, or rather, what the kernel allows by default. ulimit(1)
> and related things are your friend.
>
>> paxctl -m /usr/bin/mplayer
>>
>> but it doesn't seem to make any difference.
>
> actually, that one is needed for certain win32 codecs.

I'm on amd64 anyway and mplayer-bin doesn't seem to be maintained these days.

>>  Does anyone know how to
>> fix this?  How can I undo what I did with the above paxctl command
>> since it doesn't seem to be helping?
>
> man paxctl would tell you if you looked ;).

Thanks, it's 'paxctl -M /usr/bin/mplayer'.

- Grant

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[pageexec]

On 17 Jan 2009 at 11:06, Grant wrote:

> >>  Does anyone know how to
> >> fix this?  How can I undo what I did with the above paxctl command
> >> since it doesn't seem to be helping?
> >
> > man paxctl would tell you if you looked ;).
> 
> Thanks, it's 'paxctl -M /usr/bin/mplayer'.

you mean -m, -M would enforce MPROTECT when in softmode.

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[Manuel Leithner]

No, he's correct. He wanted to undo paxctl -m.

Regards,
Manuel Leithner

On Sat, 17 Jan 2009 23:27:51 +0100, pageexec@freemail.hu wrote:
> On 17 Jan 2009 at 11:06, Grant wrote:
> 
> > >>  Does anyone know how to
> > >> fix this?  How can I undo what I did with the above paxctl command
> > >> since it doesn't seem to be helping?
> > >
> > > man paxctl would tell you if you looked ;).
> > 
> > Thanks, it's 'paxctl -M /usr/bin/mplayer'.
> 
> you mean -m, -M would enforce MPROTECT when in softmode.
> 
> 
> 

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[pageexec]

On 18 Jan 2009 at 1:20, Manuel Leithner wrote:

> No, he's correct. He wanted to undo paxctl -m.

ah, undoing. it's still not correct for the reason i told you.
-zex is the base state, as the manpage says as well...

> 
> Regards,
> Manuel Leithner
> 
> On Sat, 17 Jan 2009 23:27:51 +0100, pageexec@freemail.hu wrote:
> > On 17 Jan 2009 at 11:06, Grant wrote:
> > 
> > > >>  Does anyone know how to
> > > >> fix this?  How can I undo what I did with the above paxctl command
> > > >> since it doesn't seem to be helping?
> > > >
> > > > man paxctl would tell you if you looked ;).
> > > 
> > > Thanks, it's 'paxctl -M /usr/bin/mplayer'.
> > 
> > you mean -m, -M would enforce MPROTECT when in softmode.
> > 
> > 
> > 
> 
> 
> 

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[Grant]

>> No, he's correct. He wanted to undo paxctl -m.
>
> ah, undoing. it's still not correct for the reason i told you.
> -zex is the base state, as the manpage says as well...

Thanks, -zex did it.  /usr/bin/mplayer no longer shows up with 'qlist
-ao | scanelf -f - -q -x'.

- Grant


>> On Sat, 17 Jan 2009 23:27:51 +0100, pageexec@freemail.hu wrote:
>> > On 17 Jan 2009 at 11:06, Grant wrote:
>> >
>> > > >>  Does anyone know how to
>> > > >> fix this?  How can I undo what I did with the above paxctl command
>> > > >> since it doesn't seem to be helping?
>> > > >
>> > > > man paxctl would tell you if you looked ;).
>> > >
>> > > Thanks, it's 'paxctl -M /usr/bin/mplayer'.
>> >
>> > you mean -m, -M would enforce MPROTECT when in softmode.

Re: [gentoo-hardened] denied resource overstep... for RLIMIT_MEMLOCK

[Gordon Malm]

undo = 'paxctl -zxe'

On Saturday, January 17, 2009 16:20:53 Manuel Leithner wrote:
> No, he's correct. He wanted to undo paxctl -m.
>
> Regards,
> Manuel Leithner
>
> On Sat, 17 Jan 2009 23:27:51 +0100, pageexec@freemail.hu wrote:
> > On 17 Jan 2009 at 11:06, Grant wrote:
> > > >>  Does anyone know how to
> > > >> fix this?  How can I undo what I did with the above paxctl command
> > > >> since it doesn't seem to be helping?
> > > >
> > > > man paxctl would tell you if you looked ;).
> > >
> > > Thanks, it's 'paxctl -M /usr/bin/mplayer'.
> >
> > you mean -m, -M would enforce MPROTECT when in softmode.