Re: ASAN and dhcpcd with privilege separation

[RVP <rvp%SDF.ORG@localhost>]

On Sun, 31 Jan 2021, Roy Marples wrote:

> Why does this not work for dhcpcd privilege separation?

I suspect this is what's happening:

$ cat t.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int 
main(int argc, char* argv[]) 
{
        char* s;
        printf("dropping privs\n");
        setgid(getgid());
        setuid(getuid());
        s = malloc(BUFSIZ);
        return 0;
}
$ cc -g -fsanitize=address -o t t.c
$ sudo sh -c 'chown root:wheel t; chmod 4555 t'
$ env ASAN_OPTIONS=log_path=/tmp/asan.log LSAN_OPTIONS=verbosity=1:log_threads=1 ./t
dropping privs
$ cat /tmp/asan.log.5586
==5586==AddressSanitizer: failed to intercept 'frexpf'
==5586==AddressSanitizer: failed to intercept 'frexpl'
==5586==AddressSanitizer: failed to intercept 'modff'
==5586==AddressSanitizer: failed to intercept 'modfl'
==5586==AddressSanitizer: failed to intercept '__xstat'
==5586==AddressSanitizer: failed to intercept '__lxstat'
==5586==AddressSanitizer: failed to intercept '__cxa_throw'
==5586==AddressSanitizer: libc interceptors initialized
|| `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
|| `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
|| `[0x00008fff7000, 0x02008fff6fff]` || ShadowGap  ||
|| `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
|| `[0x000000000000, 0x00007fff7fff]` || LowMem     ||
MemToShadow(shadow): 0x00008fff7000 0x000091ff6dff 0x004091ff6e00 0x02008fff6fff
redzone=16
max_redzone=2048
quarantine_size_mb=256M
malloc_context_size=30
SHADOW_SCALE: 3
SHADOW_GRANULARITY: 8
SHADOW_OFFSET: 0x7fff8000
==5586==Installed the sigaction for signal 11
==5586==Installed the sigaction for signal 10
==5586==Installed the sigaction for signal 8
==5586==T0: stack [0x7f7fff1e0000,0x7f7fff1e9000) size 0x9000; local=0x7f7fff1e708c
==5586==LeakSanitizer: Dynamic linker not found. TLS will not be handled correctly.
==5586==AddressSanitizer Init done
==4979==Could not attach to thread 5586 (errno 1).
==4979==Failed suspending threads.
==5586==LeakSanitizer has encountered a fatal error.
==5586==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==5586==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
$

The important lines are:
==4979==Could not attach to thread 5586 (errno 1).
==4979==Failed suspending threads.

It looks like tracing setuid programs that drop privs. don't work, or
isn't supported under NetBSD-9.1_STABLE.

> Anyone have an idea on how to resolve this?

Nope. Here, I defer to the experts.

-RVP