Re: [gentoo-hardened] what RLIMIT_STACK mean?

["Javier Martínez" <tazok.id0@gmail.com>]

I think it's not a good idea to do what you have done, people answers
questions if they know the answer and they want to do it (and have
time to do so). Please think that you didn't pay anybody to demand
nothing.

I don't use grsecurity but it seems that cat needs to growth their
stack over the hard limit imposed (look for "ulimit -a") and it's not
permitted (to avoid DOS maybe), look for some grsec resource that
impose limits to your stack and others (as open files, cpu time...),
if it's related to grsec (as it seems to be) you will need to make
this limit bigger.



2008/9/29 Alex Efros <powerman@powerman.asdfgroup.com>:
> Hi!
>
> On Sat, Sep 27, 2008 at 03:42:33PM +0300, Alex Efros wrote:
>> Can you please explain to me what these records in my logs mean?
>>
>>     2008-09-27_11:35:55.93144 kern.alert: grsec: From 78.53.3.223: denied
>>     resource overstep by requesting 180883456 for RLIMIT_STACK against limit
>>     8388608 for /bin/cat[cat:10111] uid/euid:81/81 gid/egid:81/81, parent
>>     /usr/sbin/apache2[apache2:21930] uid/euid:81/81 gid/egid:81/81
>>
>>     2008-09-27_12:08:17.12634 kern.alert: grsec: denied resource overstep by
>>     requesting 187367424 for RLIMIT_STACK against limit 8388608 for
>>     /var/qmail/bin/qmail-local[qmail-local:22538] uid/euid:1000/1000
>>     gid/egid:100/100, parent /var/qmail/bin/qmail-local[qmail-local:22535]
>>     uid/euid:1000/1000 gid/egid:100/100
>
> Is my question too complex and nobody know the answer (or even guesses),
> or it's too stupid and everybody wait until I try google (I've tried it
> already, without success)?
>
> Is last days I also notice new alert type in log:
>
>        2008-09-29_15:14:14.47478 kern.alert: grsec: From 78.129.196.12: denied
>        resource overstep by requesting 227184640 for RLIMIT_AS against
>        limit 16000000 for /var/qmail/bin/qmail-smtpd[qmail-smtpd:6545]
>        uid/euid:201/201 gid/egid:200/200, parent
>        /usr/bin/tcpserver[tcpserver:17002] uid/euid:201/201
>        gid/egid:200/200
>
> This type of alerts arise after I added simple perl script, between
> tcpserver and qmail-smtpd, which do greylisting. And, again, these alerts
> doesn't affect server - I mean, everything works fine, no mail lost, etc.
>
> --
>                        WBR, Alex.
>
>