Re: [gentoo-hardened] UDEREF vs. Apache MMAP

["Anthony G. Basile" <blueness@gentoo.org>]

On 01/07/2011 11:57 PM, Michael Orlitzky wrote:
> I was able to figure out my new apache problem. It seems that
> PAX_MEMORY_UDEREF and apache's EnableMMAP directive don't get along
> sometimes:
> 
>   http://httpd.apache.org/docs/2.2/mod/core.html#enablemmap
> 
> With UDEREF enabled and MMAP on, I get random inappropriate 206 response
> codes everywhere causing headers, images, and CSS files to fail to
> transfer properly.
> 
> This is sufficiently into the realm of what I consider voodoo. Is there
> anything I can do to help narrow down the problem, or should I just
> disable MMAP and be happy?

It sounds like a problem in the way apache is doing the mmap and PaX is
killing it.  The new stricter PaX rules don't allow the permission of
allocated pages to be changed, eg RW -> RX, or to be RWX.  This has come
up elsewhere, see

   http://bugs.gentoo.org/show_bug.cgi?id=329499

To verify my suspicion, an strace would be helpful.  If you don't mind,
open up a bug with your findings, give your emerge --info, the flags you
used with apache, and an strace of apache going bad.  This will be a
start for us.

-- 
Anthony G. Basile, Ph.D.
Gentoo Developer