Skip to content

util_SignalHandler could signpost use of RESOLVE_IDS_TO_NAMES=false #50

@aldennisa15

Description

@aldennisa15

I got Software interrupt forced exit: Segmentation Fault.
I got a corefile, dug out all the symbol files, fired up gdb and got a back trace...

#0  0x0000000000000421 in ?? ()
#1  0x0000000000455f03 in cFCONameTbl::Clear (this=this@entry=0x6f72c0 <cFCOName_i::msNameTbl>) at fconametbl.cpp:216
#2  0x0000000000455f9c in cFCONameTbl::~cFCONameTbl (this=0x6f72c0 <cFCOName_i::msNameTbl>, __in_chrg=<optimized out>) at fconametbl.cpp:160
#3  0x000000000058bf3d in __run_exit_handlers ()
#4  0x000000000058c10a in exit ()
#5  0x000000000044ddef in util_SignalHandler (sig=11) at tw_signal.cpp:71
#6  <signal handler called>
#7  0x00007f81105ec350 in _nss_systemd_is_blocked () from /lib/x86_64-linux-gnu/libnss_systemd.so.2
#8  0x00007f81105ed507 in _nss_systemd_getpwuid_r () from /lib/x86_64-linux-gnu/libnss_systemd.so.2
#9  0x00000000005f44b3 in getpwuid_r ()
#10 0x00000000005f4253 in getpwuid ()
#11 0x000000000049d02b in cUnixFSServices::GetUserName (this=<optimized out>, user_id=502, tstrUser=...) at unixfsservices.cpp:542
#12 0x0000000000462a29 in cFSPropDisplayer::InitForProp (this=0x3008c50, pFCO=<optimized out>, propIdx=<optimized out>) at fspropdisplayer.cpp:270
#13 0x00000000004635c5 in cFSPropDisplayer::InitForFCO (this=this@entry=0x3008c50, ifco=0x2c521d0) at fspropdisplayer.cpp:248
#14 0x000000000046d21b in cFCOReportUtil::InitPropDisplayer (gi=...) at fcoreportutil.cpp:118
#15 0x000000000046d3b5 in cFCOReportUtil::FinalizeReport (rr=...) at fcoreportutil.cpp:86
#16 0x0000000000436a51 in cTWModeIC::Execute (this=0xcb7730, pQueue=0x7ffd735bbd50) at twcmdline.cpp:1464
#17 0x000000000041a7dc in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at tripwiremain.cpp:229

... Looked at the source, Googled around and found the bit in https://github.com/Tripwire/tripwire-open-source#readme about RESOLVE_IDS_TO_NAMES=false. Setting that cured the segfault.

As there's already a signal handler, it wouldn't be too difficult to surround calls to getpwuid() etc with flag setting/clearing (e.g. boolRunningGetPWuid=true; getpwuid(); boolRunningGetPWuid=false;), then in the signal handler, if the flag is set, emit a message along the lines of Segfault in name resolution, try setting RESOLVE_IDS_TO_NAMES=false. Would be a bit more user-friendly than just Software interrupt forced exit: Segmentation Fault ;-)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions