by

Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
    DennisMitchell
    @DennisMitchell
    I tried downloading the RPM from the CentOS repo as well, but libgcrypt.so.11 cannot be provided. The current version on Fedora 26 is /usr/lib64/libgcrypt.so.20.1.8.
    I tried removing the sanity checks, but now I get this error.
    configure: error: Can not continue without yaal hcore library.esesudo-relocs... no
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell I think i would be easier if I setup a VM and build proper packages.
    DennisMitchell
    @DennisMitchell
    RPMs for Fedora? That would be great.
    Marcin Konarski
    @AmokHuginnsson
    Regarding "yaal" error, the interpreter consists of two parts (projects) runner (project called huginn) and library (project called yaal) that provides interpreter itself. yaal must be built and installed first, than huginn. But like I said I will setup Fedora 26 VM and provide packages for it.
    DennisMitchell
    @DennisMitchell
    @AmokHuginnson I managed to install the RPMs directly (breaking dependencies), but I can't seem to figure out how to write a simple Hello World program. pow.hgn works just fine, but main(argv_) errors for a program that doesn't rely on arguments (Variable `argv_' is never used (did you mean `real'?).) and main() just segfaults.
    Marcin Konarski
    @AmokHuginnsson
    huginn --no-argv
    so argv_ is not required
    huginn -i gives interactive mode
    what precisely did you do to segv?
    Ok, I got segv reproduced :(
    DennisMitchell
    @DennisMitchell
    main() { return(0); } without --no-argv segfaults.
    Doesn't matter for TIO, but out of curiosity: how do you run Huginn programs as root?
    Marcin Konarski
    @AmokHuginnsson
    Well, you cannot.
    DennisMitchell
    @DennisMitchell
    Why?
    Marcin Konarski
    @AmokHuginnsson
    I do not trust myself enough to allow it :)
    I do not want to trash whole system because I made some stupid bug.
    DennisMitchell
    @DennisMitchell
    Understandable, but there are scenarios where this would be perfectly safe (e.g., in a sandbox).
    Marcin Konarski
    @AmokHuginnsson
    yes, unfortunately not everyone is cautious enough to sandbox untrusted programs that would be executed with administrative privileges.
    gotta fix that pesky segv
    DennisMitchell
    @DennisMitchell
    Let me know when you have a Fedora 26 RPM. Symlinking libgcrypt.so.20 to libgcrypt.so.11 works well enough for Hello World, but I doubt it's robust.
    Marcin Konarski
    @AmokHuginnsson
    I will.
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell Hello. I think I made it. I created new repo for Fedora and I put new instructions on how to use repos from my server. If you could try if it works for you that would be awesome :)
    DennisMitchell
    @DennisMitchell
    OK, I'll take a look tonight.
    DennisMitchell
    @DennisMitchell
    @AmokHuginnsson Installation worked perfectly, but I can't seem run programs within the sandbox. This is the error I'm getting:
    syscall failure - bailing out: Permission denied
    @AmokHuginnsson From my audit logs, it appears that the problem is a call to setrlimit. For security reasons, the sandbox doesn't permit modifying the resource limits.
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell By any chance, do you know which limit it is?
    and if that resource is limited already?
    DennisMitchell
    @DennisMitchell
    Don't know which limit it is, no. I only see the action, but not the details.
    My servers already use rather conservative limits for number of processes, memory usage, file size, etc.
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell Could you please tell me if you have limit set on all of those resources: data seg size, max memory size, open files, stack size, max user processes, virtual memory?
    DennisMitchell
    @DennisMitchell
    At least virtual memory isn't limited. https://tio.run/##S0oszvj/vzQnMzezREE38f9/AA
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell data seg size also, my program tries to limit itself at start on those resources if left unlimited.
    It is interesting that CentOS build could start though.
    DennisMitchell
    @DennisMitchell
    It works on Fedora as well, just not inside TIO's sandbox. Sandboxed programs are forbidden from modifying resource limits.
    Marcin Konarski
    @AmokHuginnsson
    Maybe CentOS does not support limits on some of those resources, and given setrlimit was not built-in.
    Oh, ok.
    DennisMitchell
    @DennisMitchell
    @AmokHuginnsson Is there a way to disable setting resource limits? An interpreter flag or something like that?
    Marcin Konarski
    @AmokHuginnsson
    You could put additional ulimit(s) in interpreter wrapper script.
    DennisMitchell
    @DennisMitchell
    No, those would also fail, for the same reason.
    Marcin Konarski
    @AmokHuginnsson
    Oh, right.
    :)
    Sorry.
    I will add some environment variable to disable this behavior.
    Marcin Konarski
    @AmokHuginnsson
    @DennisMitchell How did you block setrlimit? I want to test the fix on my side.
    DennisMitchell
    @DennisMitchell

    @AmokHuginnsson With SELinux. If you install the sandbox utility with

    dnf install policycoreutils-python-utils

    you can run your program with

    sandbox huginn --no-argv test.hgn

    to test it.

    Marcin Konarski
    @AmokHuginnsson
    thank you
    DennisMitchell
    @DennisMitchell
    Oddly enough, it doesn't print the error for me this way, but it doesn't do anything.
    Marcin Konarski
    @AmokHuginnsson
    sandbox ls gives me: /bin/sandbox: [Errno 22] Invalid argument
    DennisMitchell
    @DennisMitchell
    Try installing selinux-policy-sandbox and policycoreutils-sandbox as well, if they didn't get installed as dependencies.