SIGSEGV for programs attempting to write files they don't have access to

[Staffan Thomén <duck%shangtai.net@localhost>]

Hey!

I just updated one of my domU:s to netbsd-9 (should be the head of netbsd-9 
branch as of Feb 14, 'Welcome to NetBSD 9.0 - the "Valentine Release"')

My dom0 is still running 8.1 and all other domUs are running fine with various 
versions/operating systems as before.

This domU is my webserver, and both bacula-fd and apache crash upon startup, 
with a segmentation fault, bacula right away and apache's workers die and it 
stops spawning them.

I tried to narrow it down and bacula-fd would not crash if I started it 
manually as root, but if I added -g bacula, it crashed with a Memory fault.

The following program will always crash if nobody doesn't have access to 
write/create the file, but the file will get written(!):

#include <stdio.h>
#include <unistd.h>

int main(int argc, char **argv) {
        FILE *fp;

        printf("Changing uid...\n");

        setuid(32767); // nobody

        printf("Writing to file...\n");

        fp = fopen("test.txt", "w");
        fwrite("hello\n", 6, 1, fp);
        fclose(fp);

        printf("All done\n");

        return 0;
}

www# ./t
Changing uid...
Writing to file...
Memory fault

(gdb) run
Starting program: /root/t
Changing uid...
Writing to file...

Program received signal SIGSEGV, Segmentation fault.
0x00006fbeb9f67255 in __sfvwrite () from /usr/lib/libc.so.12
(gdb) where
#0  0x00006fbeb9f67255 in __sfvwrite () from /usr/lib/libc.so.12
#1  0x00006fbeb9f671ef in fwrite () from /usr/lib/libc.so.12
#2  0x0000000000400b35 in main (argc=1, argv=0x7f7fff9ff758) at test.c:14

www# chown nobody test.txt
www# ./t
Changing uid...
Writing to file...
All done

What's going on here? Is it just me?

Staffan