|
|
...making Linux just a little more fun! The Answer Gang
![]() By Jim Dennis, Karl-Heinz Herrmann, Breen, Chris, and... (meet the Gang) ... the Editors of Linux Gazette... and You!
Contents:
|
|
...............
............... |
Note that the line after the mkrootdev business is setting a "dummy" "real-root-dev" so just replacing "0x100" by "0x810" or some such is not likely to work.
By the way, I always thought that the way to invoke pivot_root was
cd new_root pivot_root . old_root exec chroot next_command But RedHat's script seems to bypass the "change directory" step...
Hope this helps
[Ben] That smells like it is talking about some sort of RAM based file system (CRAMFS perhaps?) which is certainly unlikely to be an ext3 filesystem.
In other words your problem may not be with the SCSI disk and its ext3 file system at all! I don't know RH's boot procedure but some of these distro boot images have some intermediate "RAM disk" in addition to the initrd and do two pivot_roots!
If you want to stick with the distro's boot procedure, your best bet is to examine this procedure in detail.
0. Check the boot command line.
1. Open up the initrd image and look at linuxrc.
Having looked at 0 and 1 for a number of distro's I have come to the conclusion that either the guys who produce these distro boot images do too many drugs or they are taking care of some really unusual eventualities or both![]()
I seem to remember that it's either CRAMFS or something like that; I'm sure Heather knows more about it than I do. It's a "pull yourself up by your bootstraps" kind of thing: you boot a RAM-based ext2 mini-"partition" (which mounts as "/"), which then loads the appropriate ext3 modules, mounts your actual partition, and "pivots" "/" to it.
The usual reason is to avoid having to recompile the kernel - it makes more sense for RH, etc. to make ext3, jfs, jffs, reiserfs, etc. modules and let you choose which one you want to use, but the price is having to mess with the "initrd"/"pivot_root" stuff. I just compile ext3 right in, and never have to mess with it. SCSI, of course, is a different sort of animal altogether.
[Faber] Well, you can have alook at this one.
The relevant parts are:
echo Creating root device mkrootdev /dev/root echo 0x0100 > /proc/sys/kernel/real-root-dev echo Mounting root filesystem mount -o defaults --ro -t ext3 /dev/root /sysroot
I don't see anything there that would screw up because of a SCSI disk, but then again, I don't know what /proc/sys/kernel/real-root-dev is for, so I'm off to find out...
[Ben] Anybody have an idea how 0x0100 would relate to device numbers, or whatever else "/proc/sys/kernel/real-root-dev" is supposed to hold? I suspect that the above is the RAMdisk, though, and that whatever is defined as the device for "pivot_root" to "pivot" to is what matters.
[JimD]
/proc/sys/kernel/real-root-dev is documented in .../src/linux/Documentation/initrd.txt
Quoting therefrom:
|
............... It works by mounting the "real" root device (i.e. the one set with rdev in the kernel image or with root=... at the boot command line) as the root file system when linuxrc exits. The initrd file system is then unmounted, or, if it is still busy, moved to a directory /initrd, if such a directory exists on the new root file system. In order to use this mechanism, you do not have to specify the boot command options root, init, or rw. (If specified, they will affect the real root file system, not the initrd environment.) If /proc is mounted, the "real" root device can be changed from within linuxrc by writing the number of the new root FS device to the special file /proc/sys/kernel/real-root-dev, e.g.
Note that the mechanism is incompatible with NFS and similar file systems. This old, deprecated mechanism is commonly called "change_root", while the new, supported mechanism is called "pivot_root". ............... |
As Ben suggests this look like /dev/ram0 (The ramdisk) which seems wrong. I'd look back through the /linuxrc to figure out what logic it's using to arrive at this point. I'm guessing that it's not loading or detecting the intended rootfs (hardware) and this value is the result of a default that wasn't over-written by any more appropriate case.
Faber cheerfully reported back.... -- Thomas Adam
Here's what I think is happening:
(the relevant parts of initrd/linuxrc)
echo Creating root device mkrootdev /dev/root echo 0x0100 > /proc/sys/kernel/real-root-dev echo Mounting root filesystem mount -o defaults --ro -t ext3 /dev/root /sysroot pivot_root /sysroot /sysroot/initrd umount /proc/initrd
create the root device attach the (ram0) ram disk to it mount the ram disk to /sysroot change the system root from the initrd to the ram0 disk umount initrd
Now, that jives with the initrd on my local )non-scsi) box. The question is: is this correct behaviour for a scsi box? If so, why is the failure occuring at mounting the ramdisk? The mount error, IIRC, is "no such device".
I was never able to fix my client's system to boot off of the SCSI drive
no matter how I mucked with initrd. It was a lot of fun however and I
learned more about initrd than is probably necessary.
In the end, we reinstalled RH9 from scratch. We took advantage of the new install to reconfigure some partitions and stuff, so all was not a total waste.
Interesting side note(s): the RH installer would not let us use LILO and the SCSI MBR. I could use the MBR of hda or sda1, but not the way I wanted it. So I went with GRUB.
After playing with GRUB, I must say I like it, but it has one really weird feature. All of the documentation says that GRUB refers to the first IDE drive as (hd0,0) and the fist SCSI drive as (sd0,0). Not on this system! It took me two hours (for shame!) to figure out that the SCSI drive is (hd0,0) and the first IDE drive is (hd1,0). If anyone knows why, I'd love to hear it.
Now all I have to do is recreate two years worth of customizations on
this box. Good thing I have a very understanding client.
howto
From Guy Milliron
Answered By: Benjamin A. Okopnik, Jim Dennis
I've googled for an answer to my question, just it's too obscure for me to figure out I guess...
I'm attempting to install a new software on my RHL box. Anyhow, it's calling a program called fping (Which is pretty interesting itself, a round-robin style ping http://www.fping.com ). It says it needs to run as root (which I won't allow the calling program to run as, or needs to be "setuid".
As Ricki Ricardo would say "Splain Lucy Splain!"
[Ben] For that, see "perldoc splain" for more info.
Although it's not quite smart enough to help you this time...
ben@Fenrir:~$ ls -l `which ping` -rwsr-xr-x 1 root root 15244 2001-11-18 17:29 /bin/ping
[Ben] "ping" has always been SUID; it needs to be in order to use ICMP - which is what "ping" does. It's a weird security model ("ICMP can be dangerous, so we'll lock it away under root privilege... but then we'll make the ICMP generator SUID so everybody can use it.") Some old, hoary, scarred and scared sysadmins remove the SUID bit from "ping" so you have to "su" in order to use it... but note that the users will complain. My guess is, user complaints are the reason that the situation exists. Of course, they could have made "ping" use TCP instead of ICMP, but then we'd be violating <Tevye the Milkman mode>TRADITION!</TtMm>.
There actually are some valid reasons for sticking with ICMP, but they're not unique to it, and are mostly doable with TCP. TCP "ping", IMO, would be a Good Thing and support a better security model.
# Net::Ping uses TCP by default perl -MNet::Ping -wle'print"Host is ",Net::Ping->new()->ping(shift)?"up":"down"' localhost
<shrug>
[Jim] "setuid" is a special bit in the UNIX permissions. You can make your program SUID with a command like (as root):
chown root.bin `which fping` && chmod u+s `which fping`
... assuming fping in own your PATH.
You can be a little safer using commands like:
chmod root.$TRUSTEDGROUP `which fping`; chmod 4550 `which fping`
... where you create a group (such as 'staff' or 'trusted') which which will be allowed to execute this program. Then you associate this program with that group and mark it so that the owner and members of the associated group are permitted to read and execute the SUID program.
Thus if there is an exploitable bug in the program (a way to "trick" it into doing things it's not intended to do with it's root privileges) then only the owner (who's already root) and the members of the trusted group can attempt to exploit the vulnerability.
This is very basic UNIX systems administration practice that should be taught to ALL UNIX and Linux system administration professions in their first term. There is not difference between UNIX and Linux in this regard.
Note that SUID and SGID only applies to binaries --- NOT to scripts. Perl has a special helper application (sperl) which allows it to handle SUID (and SGID?) Perl scripts. It would be wise to associate sperl with a trusted group and make it non-world executable (as my second command example shows). You can make as many trusted groups as you like.
Note that SUID and SGID are the most basic forms of privilege delegation in UNIX and Linux. They allow you to write a program which acts as an agent, allowing one group of users to access some resource in a controlled and limited way (through the agent). If the program (and the libraries against which it is linked) are bug free (or "sufficiently robust") then this is a safe means of giving everyone or specific groups access to some protected resource. In the case of fping that resource is a lower level form of access to one or more of your networking interfaces. In other cases a program might be SGID "games" to allow it to update a file of high scores.
Because the likelihood of vulnerability rises dramatically as the size and complexity of a program increases, it is considered best practice to make SUID and SGID programs as small as possible --- often splitting the "agent" portion of the code into a small helper application that is called by the larger application.
A general purpose "SUID" wrapper program is called sudo. It allows you to maintain a list (even a network wide list) of users (and hostnames) and a precise list of programs, options that each user or group are permitted to run and precisely who these programs will effective run as. (There are several similar programs like super, caliph, and runas). sudo is the most commonly used choice among professional sysadmins. You control its configuration via /etc/sudoers (using the visudo wrapper to edit that; and to check your syntax as you save and exit).
Naturally I would suggest you make a sudoers group, associate sudo with that, and mark its mode to 4550 (SUID and non-world-executable) as I explained before. This will help limit the number of users that could exploit any bug found in sudo itself. Luckily sudo is one of the more widely audited bits of code on the Internet. Unfortunately it's also sufficiently well known and widespread that any cracker that does find a bug in it; or manages to pass out a trojaned copy of it, will gain LOTs of access using it (though they need to get to a local shell account first).
So it is with all SUID and SGID programs. If the agent is "vulnerable" it can become a confused deputy and give unfettered access to all resources owned by a given user or associated with a given group. (Obviously unfettered access to the root UID is also complete control of a normal UNIX or Linux system).
You can search your entire system for SUID and SGID files with a command like:
find / -type f -perm +6000 -ls
... this will find all SUID and SGID files. The SUID bit is meaningless on directories (at least under Linux and most forms of UNIX --- so far) and the SGID bit has some special semantics on Linux and BSD systems (which I've explained in other articles):
http://linuxgazette.net/issue64/lg_tips64.html#tips/18
The SUID/SGID files are also meaningless on device nodes, FIFOs (named pipes) and unix domain sockets; as well as "regular" non-executable files and most scripts (text executables). All of the permissions bits are generally ignored on symlinks.
Wireless networking
From Ben Okopnik
Answered By: Benjamin Okopnik, Jason Creighton, Thomas Adam
Hi, all -
I've finally had a chance to test out the wireless Ethernet on my laptop - in fact, I'm sitting at the local airport right next to their Air Port (that's a joke, dammit. You're s'posed to laugh.) The problem is, the speeds that I'm getting in Linux and Wind0ws are wildly disparate, with Linux being on the losing end. Of course, I have no way to measure the exact speed in Wind0ws (other than maybe downloading a large file and doing a little math), but the connection properties say "11Mbps" and "Quality: excellent", and the Web pages snap onto the screen like I've never seen before. Linux... [sigh] I've seen it get as high as 29kB/S during an "apt-get" operation, and Web pages crawl.
I'm using "ndiswrapper" (possibly part of the problem - like everything else on this damned Acer, the hardware (Intel PRO/Wireless LAN 2100) is unsupported), so my whole initialization sequence goes like this:
# ndiswrapper-specific stuff modprobe ndiswrapper loadndisdriver 8086 1043 /lib/windrivers/w70n51.sys /lib/windrivers/w70n51.inf iwconfig wlan0 mode Managed # Looking for a public access point iwconfig wlan0 essid default ifconfig wlan0 up # get an IP via DHCP pump -i wlan0
"ifconfig wlan0" says:
wlan0 Link encap:Ethernet HWaddr 00:04:23:72:F5:DC
inet addr:X.X.X.XXX Bcast:YY.Y.Y.YYY Mask:255.255.255.0
inet6 addr: fe80::204:23ff:fe72:f5dc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:55417 errors:0 dropped:0 overruns:0 frame:0
TX packets:34901 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:81279617 (77.5 MiB) TX bytes:2375903 (2.2 MiB)
Interrupt:11 Memory:d0000000-d0000fff
Even my old trick of searching for the "parm" string in the module doesn't produce anything useful:
strings ndiswrapper.ko | grep parm parm=if_name:Network interface name (default: wlan0) parm=proc_uid:The uid of the files created in /proc (default: 0). parm=proc_gid:The gid of the files created in /proc (default: 0).
Change the MTU, maybe? Invoke "iwconfig" in some different way? Or am I just stuck with it?
[Thomas] If you haven't done so already, Ben, make sure you have disabled apci from the kernel:
linux noapic
at the LILO prompt (by then you knew that)
[Jason] Doesn't "modinfo" do the same thing?
~$ modinfo sb filename: /lib/modules/2.4.20/kernel/drivers/sound/sb.o description: "Soundblaster driver" author: <none> license: "GPL" parm: io int, description "Soundblaster i/o base address (0x220,0x240,0x260,0x280)" parm: irq int, description "IRQ (5,7,9,10)" parm: dma int, description "8-bit DMA channel (0,1,3)" parm: dma16 int, description "16-bit DMA channel (5,6,7)" parm: mpu_io int, description "Mpu base address" parm: type int, description "You can set this to specific card type" parm: sm_games int, description "Enable support for Logitech soundman games" parm: esstype int, description "ESS chip type" parm: acer int, description "Set this to detect cards in some ACER notebooks" parm: isapnp int, description "When set to 0, Plug & Play support will be disabled" parm: isapnpjump int, description "Jumps to a specific slot in the driver's PnP table. Use the source, Luke." parm: multiple int, description "When set to 0, will not search for multiple cards" parm: pnplegacy int, description "When set to 1, will search for a legacy SB card along with any PnP cards." parm: reverse int, description "When set to 1, will reverse ISAPnP search order" parm: uart401 int, description "When set to 1, will attempt to detect and enable the mpu on some clones" ~$
Is ACPI such an all-around evil thing that you recommend turning it off
in all cases? It just doesn't seem relevant here, unless you have info
to the contrary.
[Heather] I caution against confusing APIC (some sort of feature which SMP processors all do, some uniprocessors happen to do, and some CPU/motherboard combinations make poor Tux give up on herring for Lent) with ACPI (which is what APM might be is you divided it into a few levels of suspend then told each device to deal with sleepiness themselves - kind of neat from an object oriented point of view, but somewhat annoying to someone who just wants to be able to close the lid safely without knowing why it works). Both have their moments... and their times to be set on fire
![]()
[Thomas] It is a complete nightmare from start to finish. It interferes with everything. Whenever you get a HW problem such as this, I would always look at seeing if turning it off solves it.
[Ben] Well! That's quite the characterization.
[Thomas] Humour me, at least. Then you can slowly remove your sunglasses and tell me to think again
![]()
[Ben] I was actually asking in a spirit of inquiry, not doubting you. It's just these sunglasses make everyone suspicious.
![]()
I'll check it out - should be back on in a few minutes.
Just tried it. The Wi-Fi and the Bluetooth lights now stay on
permanently (can't be turned off), and the speed is a bit lower if
anything (I'm copying a movie file from idgames, and it's running about
26kB/S.)

Greetings from Heather Stern