GNU bug report logs - #16335
Segmentation fault when using cp -a with SELinux and fakeroot

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Pádraig Brady <P <at> draigBrady.com>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#16335: closed (Segmentation fault when using cp -a with
 SELinux and fakeroot)
Date: Mon, 13 Jan 2014 14:51:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Mon, 13 Jan 2014 14:50:13 +0000
with message-id <52D3FD25.3020704 <at> draigBrady.com>
and subject line Re: bug#16335: Segmentation fault when using cp -a with SELinux and fakeroot
has caused the debbugs.gnu.org bug report #16335,
regarding Segmentation fault when using cp -a with SELinux and fakeroot
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
16335: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16335
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Nicolas Iooss <nicolas.iooss <at> m4x.org>
To: bug-coreutils <at> gnu.org
Subject: Segmentation fault when using cp -a with SELinux and fakeroot
Date: Fri, 03 Jan 2014 23:08:42 +0100

[Message part 3 (text/plain, inline)]

Hello,

After upgrading to coreutils 8.22 I can no longer build packages which
uses "cp -a" to copy files due to a segmentation fault happening in
libselinux.

I've tried to reproduce this bug with few commands, in a directory which
doesn't have any default context:

    $ mkdir /tmp/foobar
    $ matchpathcon
    /tmp/foobar	<<none>>
    $ touch /tmp/foobar/a
    $ fakeroot cp -a /tmp/foobar/a /tmp/foobar/b
    $ fakeroot cp -a /tmp/foobar/a /tmp/foobar/b
    /usr/bin/fakeroot: line 181:  9207 Segmentation fault

Without fakeroot there is no segmentation fault.

Even if the message says "/usr/bin/fakeroot", a coredump has been
created for cp. I've analyzed this dump using gdb and after some
debugging, I found out that restorecon_private (from src/selinux.c) was
calling lsetfilecon with a NULL security context which was obtained by
getfscreatecon (case "local = true" in the code [1]). This causes a null
pointer dereference in libselinux and so a SIGSEGV.

I've reported this bug to libselinux maintainers [2] and got the reply
that calling lsetfilecon with a NULL security context was like calling
strlen with a NULL string and that this was a problem in caller's code [3].

Hence I propose the attached patch to fix the segmentation fault. Could
you please accept it?

When you reply, please Cc me as I'm not subscribed.

Thanks,

Nicolas Iooss

-----------

System configuration during my tests:

* distro: ArchLinux which SELinux packages
* CPU arch: x86_64
* SELinux in permissive mode
* coreutils 8.22
* libselinux 2.2.1
* fakeroot 1.20

[1]
http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=blob;f=src/selinux.c;hb=v8.22#l191
[2] http://marc.info/?l=selinux&m=138763485330568&w=2
[3] http://marc.info/?l=selinux&m=138842015508829&w=2

[0001-Fix-segmentation-fault-in-restorecon_private.patch (text/x-patch, attachment)]

[Message part 5 (message/rfc822, inline)]

From: Pádraig Brady <P <at> draigBrady.com>
To: Nicolas Iooss <nicolas.iooss <at> m4x.org>
Cc: 16335-done <at> debbugs.gnu.org
Subject: Re: bug#16335: Segmentation fault when using cp -a with SELinux and
 fakeroot
Date: Mon, 13 Jan 2014 14:50:13 +0000

[Message part 6 (text/plain, inline)]

I'm going to push the attached very soon, to address this.

thanks,
Pádraig.

[cp-selinux-segfault.patch (text/x-patch, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.