open failed: illegal insecure pathname

  • Follow


Some may recall the hassles I have with Mathematica on Solaris using 
tons of CPU time which was caused by a change in Solaris 10 which I 
understand will be patched at some point.

Casper Dik wrote a bit of library code which I preloaded to change the 
behavior of select. This I saved as select_preload.so

BUT

*Sometimes*  Mathematical will fail to load the library, coming up with 
this message in is "Error Console".

ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open 
failed: illegal insecure pathname

(Where it gets prtconf from I don't know - the word is not in the source 
, which I have put at the end of the email)

I originally had the library in /usr/local/lib, but changed it to 
/usr/lib thinking Mathematica might consider that an acceptable and not 
illegal pathname. But it still generates the message some times.

The executable is 64-bit, so I've put it in /usr/lib/sparcv9. I've not 
bothered creating a 32-bit one.

This is how I have set it up.

teal / % ls -ld /usr/lib/sparcv9/select_preload.so
-rw-r--r--   1 root     root        5848 Jun 28 21:21 
/usr/lib/sparcv9/select_preload.so

teal / % ls -ld /usr/lib/select_preload.so
/usr/lib/select_preload.so: No such file or directory



teal /export/home/drkirkby % cat select_preload.c
/*
  * Select roundup preload.  (casper.dik@you.know.where)
  * cc -G -Kpic select_preload.c -o select_preload.so
  *
  */


#include <dlfcn.h>
#include <sys/time.h>

#define FUN_PROTO(type,internal,parms) \
         type internal parms

#define DECLARE(type,name, parms) static FUN_PROTO(type,(*name), parms)
#define CAST(type, parms) (FUN_PROTO(type,(*), parms))

DECLARE(int,next_select,(int, fd_set *, fd_set *, fd_set *, struct 
timeval *));

#ifdef __GNUC__
void loadit(void) __attribute__ ((constructor));
#else
#pragma init(loadit)
#endif

void
loadit(void)
{
     extern char **environ;
     char **env;
     int offset;

     next_select = CAST(int, (int, fd_set *, fd_set *, fd_set *, struct 
timeval *
))dlsym(RTLD_NEXT, "select");
}

int select(int nfds, fd_set *restrict readfds, fd_set  *restrict  writefds,
     fd_set  *restrict errorfds, struct timeval *restrict timeout)
{

         if (timeout != NULL && timeout->tv_sec == 0 && timeout->tv_usec 
 > 0 &&
             timeout->tv_usec < 1000)
                 timeout->tv_usec = 1000;

         return (next_select(nfds, readfds, writefds, errorfds, timeout));
}

-- 
Dave K     MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year@domain. Hitting reply will work
for a couple of months only. Later set it manually.

http://witm.sourceforge.net/ (Web based Mathematica front end)
0
Reply Dave 7/19/2006 10:12:38 AM

Dave (from the UK) wrote:
> Some may recall the hassles I have with Mathematica on Solaris using
> tons of CPU time which was caused by a change in Solaris 10 which I
> understand will be patched at some point.
> 
> Casper Dik wrote a bit of library code which I preloaded to change the
> behavior of select. This I saved as select_preload.so
> 
> BUT
> 
> *Sometimes*  Mathematical will fail to load the library, coming up with
> this message in is "Error Console".
> 
> ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open
> failed: illegal insecure pathname

problem here is prtconf which is actually a setgid executable (64-bit
version):

ls -l /usr/sbin/sparcv9/prtconf

For setuid/setgid executables your preloaded code has to be read from a
trusted directory for secure ELF objects. One default trusted directory
for 64 bit is /usr/lib/secure/64. Try to load your
code from there or define your own trusted directory via
clre -64 -s

It would be much better to unset LD_PRELOAD before extern executables
get started because this code should only be used by mathematica.

Rainer


0
Reply Rainer 7/19/2006 12:54:05 PM


Rainer Beushausen wrote:
> Dave (from the UK) wrote:
>> ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open
>> failed: illegal insecure pathname
> 
> problem here is prtconf which is actually a setgid executable (64-bit
> version):
> 
> ls -l /usr/sbin/sparcv9/prtconf
> 
> For setuid/setgid executables your preloaded code has to be read from a
> trusted directory for secure ELF objects. One default trusted directory
> for 64 bit is /usr/lib/secure/64. 

It is explained in "man ld.so.1", in the "SECURITY" section.
0
Reply Oscar 7/19/2006 2:36:06 PM

Oscar del Rio wrote:
> Rainer Beushausen wrote:
> 
>> Dave (from the UK) wrote:
>>
>>> ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open
>>> failed: illegal insecure pathname

> It is explained in "man ld.so.1", in the "SECURITY" section.

Thank you for that - it is now OK.
-- 
Dave K     MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year@domain. Hitting reply will work
for a couple of months only. Later set it manually.

http://witm.sourceforge.net/ (Web based Mathematica front end)
0
Reply Dave 7/19/2006 4:06:18 PM

Rainer Beushausen wrote:
> Dave (from the UK) wrote:
> 
>>Some may recall the hassles I have with Mathematica on Solaris using
>>tons of CPU time which was caused by a change in Solaris 10 which I
>>understand will be patched at some point.
>>
>>Casper Dik wrote a bit of library code which I preloaded to change the
>>behavior of select. This I saved as select_preload.so
>>
>>BUT
>>
>>*Sometimes*  Mathematical will fail to load the library, coming up with
>>this message in is "Error Console".
>>
>>ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open
>>failed: illegal insecure pathname
> 
> 
> problem here is prtconf which is actually a setgid executable (64-bit
> version):
> 
> ls -l /usr/sbin/sparcv9/prtconf

But why is prtconf being called - I can't believe Mathematica will want 
to do that.



-- 
Dave K     MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year@domain. Hitting reply will work
for a couple of months only. Later set it manually.

http://witm.sourceforge.net/ (Web based Mathematica front end)
0
Reply Dave 7/19/2006 4:08:23 PM

"Dave (from the UK)" <see-my-signature@southminster-branch-line.org.uk> writes:

>ld.so.1: prtconf: warning: /usr/lib/sparcv9/select_preload.so: open 
>failed: illegal insecure pathname

>(Where it gets prtconf from I don't know - the word is not in the source 
>, which I have put at the end of the email)

It probably runs prtconf in a shell script.
r some suhc.

It's prtconf whoich complains; not mathenatic.

Ypou could copy th efile in /usr/lib/secure (which doesn't exist) and
then the runtime linke rwill not complain.

Casper


0
Reply Casper 7/19/2006 4:16:44 PM

Dave (from the UK) wrote:
> But why is prtconf being called - I can't believe Mathematica will want 
> to do that.

I don't have mathematica but I've seen other products (like matlab) that
run a wrapper script checking your configuration, platform, path, etc
before running the actual application.  The script might be calling prtconf.

Check if "mathematica" is a shell script and if so add your preload code
just before the real program is called.
0
Reply Oscar 7/19/2006 4:22:48 PM

Oscar del Rio wrote:
> Dave (from the UK) wrote:
> 
>> But why is prtconf being called - I can't believe Mathematica will 
>> want to do that.
> 
> 
> I don't have mathematica but I've seen other products (like matlab) that
> run a wrapper script checking your configuration, platform, path, etc
> before running the actual application.  The script might be calling 
> prtconf.
> 
> Check if "mathematica" is a shell script and if so add your preload code
> just before the real program is called.

It is a shell script, but there is no prtconf in it.

The only shell scripts are these

../Executables/Mathematica:      executable shell script
../Executables/mathematica:      executable shell script
../Executables/math:     executable shell script
../Executables/MathKernel:       executable shell script
../Executables/mcc:      executable shell script
../SystemFiles/Java/UltraSPARC/bin/ControlPanel: executable shell script
../SystemFiles/Graphics/SystemResources/psfix:   executable shell script

and I can't see prtconf called from any of them.

teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf ./Executables/*
teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf 
../SystemFiles/Java/UltraSPARC/bin/ControlPanel
teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf 
../SystemFiles/Graphics/SystemResources/psfix

It does however use prsinfo to test the number of CPUs.

     if [ "${SystemID}" = "UltraSPARC" -o "${SystemID}" = 
"Solaris-x86-64" ]; then
         if [ -z "${OMP_NUM_THREADS}" ]; then
             OMP_NUM_THREADS=`/usr/sbin/psrinfo | wc -l | tr -d ' '`;
             export OMP_NUM_THREADS;
         fi
     fi

but that is not set uid root.

teal / % ls -l /usr/sbin/psrinfo
-r-xr-xr-x   1 root     sys        10468 Jan 23  2005 /usr/sbin/psrinfo


-- 
Dave K     MCSE.

MCSE = Minefield Consultant and Solitaire Expert.

Please note my email address changes periodically to avoid spam.
It is always of the form: month-year@domain. Hitting reply will work
for a couple of months only. Later set it manually.

http://witm.sourceforge.net/ (Web based Mathematica front end)
0
Reply Dave 7/19/2006 5:04:29 PM

Dave (from the UK) wrote:
> Oscar del Rio wrote:
> 
>> Dave (from the UK) wrote:
>>
>>> But why is prtconf being called - I can't believe Mathematica will
>>> want to do that.
>>
>>
>>
>> I don't have mathematica but I've seen other products (like matlab) that
>> run a wrapper script checking your configuration, platform, path, etc
>> before running the actual application.  The script might be calling
>> prtconf.
>>
>> Check if "mathematica" is a shell script and if so add your preload code
>> just before the real program is called.
> 
> 
> It is a shell script, but there is no prtconf in it.
> 
> The only shell scripts are these
> 
> ./Executables/Mathematica:      executable shell script
> ./Executables/mathematica:      executable shell script
> ./Executables/math:     executable shell script
> ./Executables/MathKernel:       executable shell script
> ./Executables/mcc:      executable shell script
> ./SystemFiles/Java/UltraSPARC/bin/ControlPanel: executable shell script
> ./SystemFiles/Graphics/SystemResources/psfix:   executable shell script
> 
> and I can't see prtconf called from any of them.
> 
> teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf ./Executables/*
> teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf
> ./SystemFiles/Java/UltraSPARC/bin/ControlPanel
> teal /usr/local/Wolfram/Mathematica/5.2 % grep prtconf
> ./SystemFiles/Graphics/SystemResources/psfix
> 
> It does however use prsinfo to test the number of CPUs.
> 
>     if [ "${SystemID}" = "UltraSPARC" -o "${SystemID}" =
> "Solaris-x86-64" ]; then
>         if [ -z "${OMP_NUM_THREADS}" ]; then
>             OMP_NUM_THREADS=`/usr/sbin/psrinfo | wc -l | tr -d ' '`;
>             export OMP_NUM_THREADS;
>         fi
>     fi
> 
> but that is not set uid root.
> 
> teal / % ls -l /usr/sbin/psrinfo
> -r-xr-xr-x   1 root     sys        10468 Jan 23  2005 /usr/sbin/psrinfo
> 
> 

it's libsunperf.so.6 which is bundled with mathematica. No chance.

Rainer
0
Reply Rainer 7/19/2006 7:19:08 PM

8 Replies
1734 Views

(page loaded in 0.004 seconds)

Similiar Articles:







7/24/2012 1:25:08 AM


Reply: