Fedora Security :: Spurious Interrupts And Kernel Seg Faults?
Jun 22, 2009
What does this means:
[6867450.202500] hpet1: lost 1 rtc interrupts
[6867450.548506] hpet1: lost 2 rtc interrupts
May 24 20:20:01 vms2 kernel: [6886829.451310] console-kit-dae[19655]: segfault at 198 ip 00007f4c31b7fe09 sp 000000004036c090 error 4 in libglib-2.0.so.0.1800.2[7f4c31b53000+c3000]"
Is there any Kernel parameter available for interrupts handling, In the case of busy server how we can tune the kernel to handle interrupts effectively.
The following message: [ 2364.064174] hda-intel: spurious response 0x0:0x0, last cmd=0x524011 or one very similar. The "last cmd" element may vary, though not necessarily. I'm currently running Lucid - Kubuntu with 2.6.32-22-generic kernel. The CPU is an Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz, 1 Gb ram, and two hard drives an Hitachi SATA (600 GB) and a WD PATA (350 GB). I've found several threads regarding the error message and the sound system on intel based systems. I would like to know whether AMD systems face a similar issue.
In my "computer room" I have an ATT U-Verse TV decoder box and my computer connected to a Netgear Switch. The third port on the switch connects to the ATT router. I've just noticed that when I power on the U-Verse TV box I start getting a lot (200-250 KiB/s) of received packets on my Debian Lenny machine as shown in the System Monitor app. I don't show any outgoing traffic in response. That explains why the lights on the switch are blinking at the same rate for both devices. So, what, if anything, is this telling me? Is this normal, or is the ATT router spamming my Linux machine for some reason? Is this a potential problem?
Added: Or is this just telling me that the NetGear FS-105 is not actually an ethernet switch?
A few days ago I installed F12 and it was working fine very well up until today when I booted my computer from a perfect working order state yesterday to this. Well my wireless was still being sniffed and slowed down to dial up speed but what's new thats been consistant for at least 3 months I can't really do much about it since my brother doesn't like changing the password.
I recently logged onto my new fedora 12, 64-bit, system encrypted (all partitions effected by install), selinux enforced install to find myself in tty4 and some "other" users logged on to the other terminals. My folders would have lock icons on them after opening, my notication menu/toolbar crashed and hasn't returned on system reboot, some data transfers between removable storage returned input output errors while others worked fine(?). I also recieved this kernel bug output from the bug reporting tool but I have no idea what it means.
Also I was not loose with the security either I had removed unconfined login types (After setting up the system as I needed) meaning I couldn't even run root or sudo and neither could anyone else (asfar as I was aware). I pretty much increased selinux to its maximum boolean strictness and limited the _default_(Me included) account to a user from a _default_ unconfined (to actually be able to log in with the selinux boolean in place). Meaning they "the exploiters" were able to bypass selinux as a user account? How is that possible and even if you do root logon is disabled by selinux too?
At the moment I'm on a live cd trying to look for a way to custimise them as it seems it may be my only option.
Just a side note you can't just log in to tty4 by default without actively taking up spaces either by other users or your own use. Meaning since the tty login is automated 3 terminals were in use tty1, tty2 and tty3.
Which commands should I run to find out what is being done?
Edit: Just had my F12 x64 live cd taken down twice and had to hard reset as the toolbar disappeared. Took a photo of the last error message. I was just reading a pdf and using firefox at the time.
Attack Sneaks Rootkits Into Linux Kernel Quote: A researcher at Black Hat Europe this week will demonstrate a more stealthy way to hack Linux
Apr 14, 2009 | 04:21 PM By Kelly Jackson Higgins DarkReading
Kernel rootkits are tough enough to detect, but a researcher this week has demonstrated an even sneakier method of hacking Linux. The attack attack exploits an oft-forgotten function in Linux versions 2.4 and above in order to quietly insert a rootkit into the operating system kernel as a way to hide malware processes, hijack system calls, and open remote backdoors into the machine, for instance. At Black Hat Europe this week in Amsterdam, Anthony Lineberry, senior software engineer for Flexilis, will demonstrate how to hack the Linux kernel by exploiting the driver interface to physically addressable memory in Linux, called /dev/mem.
"One of bonuses of this [approach] is that most kernel module rootkits make a lot noise when they are inserting [the code]. This one is directly manipulating" the memory, so it's less noticeable, he says. The /dev/mem "device" can be opened like a file, and you can read and write to it like a text file, Lineberry says. It's normally used for debugging the kernel, for instance.
Lineberry has developed a proof-of-concept attack that reads and writes to kernel memory as well as stores code inside the kernel, and he plans to release a framework at Black Hat that lets you use /dev/mem to "implement rootkit-like behaviors," he says. The idea of abusing /dev/mem to hack the Linux kernel is not really new, he says. "People have known what you can do with these /dev/mem devices, but I have never seen any rootkits with dev/mem before," he says.
Quote: "The problem with kernel-based rootkits is that the rootkit can mitigate [detection] because it has control," he says. "It's a race in the kernel to see who's going to see who first." [URL]
I updated the kernel to 2.6.35.10-74.fc14.x86_64 and had to reinstall and rebuild the kernel module for my ATi driver as usual, so I edited the kernel arguments at the grub splash screen so that I could boot into single user mode and install the driver (i.e appending the relevant line with '1'). The interesting thing is, the system booted directly into single user mode as root when the system started up. No password was required.
Recently I noticed that on my Centos 5.4 system, yum no longer works and is giving segmentation faults. I can run "yum --help" and it works, but if I try to run something like "yum upgrade php" it will fault. I also noticed that other things are seg faulting as well, like /usr/sbin/logrotate and /usr/bin/certwatch.
I am guessing there is some sort of common library that needs fixing, but I have no idea what. I've read other posts about the yum segmentation fault and have tried various steps provided but so far no luck in getting it to work again. It used to work, and I rarely change this system so I'm not sure what could have caused it.
I was installing freebds for one of my friends and during the entire install the top never crossed 1.0. When I install linux top always shows a cpu load of more than 1.0.Also on the bsd when copying a huge file (4gb) it takes a long time but then the load never goes beyond 1.0. Linux will do it much faster but then there is a difference in the cpu load time.What I want to know is is there anyway I can interupt the processor so that the load does not go beyond 1.0.
I'm trying to understand how interrupts work. Is there a way to generate timer interrupts in C. Also can we enter into the protected mode of the CPU. Does OS (specifically, linux) place any restrictions on user programs entering protected mode. If it does not, do we just have an assembly language program which changed the mode, followed by the C code... I'm just trying to understand how things work at the lowest level. So I'm trying to write few snippets to test my understanding.
I have am using Maverick Meerkat 10.10 Kernel version: 2.6.35-22-generic I have a Razer DeathAdder gaming mouse. I am trying to compile/run this tool: Razer config tool I have jumped through several hoops:[URL]..
This install was for 10.04. This link helped with taming the mouse a little:[URL]..
I get the program to compile (after some problems the usb.h file not being where the system said it was) and I install it following these instructions in the README file that I have attached. I get a segmentation fault error when the razer daemon razerd tries to start: [Code]...
I have an annoying problem with Ubuntu 10.10 64bit. I made a clean installation of Ubuntu on my LG P310 laptop and I'm using the Nvidia proprietary driver. The problem is that I get segmentation faults from random program after a while of usage. Examples of programs are Thunderbird, Synaptic, apt-get and tap crashes in Chromium (which I would think is segmentation faults). It would seem like a underlying library is causing the faults. The problem disappear after a reboot, the faults might only occur after a wakeup from suspend, I'm not sure about that at the moment. I can't figure out what triggers these faults, and I don't know how to do error tracing in this case.
I hope this is the right place to post to because I haven't found any other related forums.I'm working on an AMD opteron running Linux 2.6.28.6 I want to preload a hardware performance counter (register) with a value to have it overflow after a number of a specific event counts. As I understand, when the counter in the register overflows, an interrupt will be generated and handled by the appropriate interrupt handler. How can my user-level application get notified whenever the interrupt occurs? I want to obtain information on the instruction that caused the overflow. Is this possible? I think this is different than responding to signals with sigaction().
So I've been researching this on my new NAS. I just tried to register the IP on the new system to have an issue pop up that says: "msk0: watchdog timeout (missed Tx interrupts) -- recovering" The error repeats then ends with no set IP. I tried the loader.conf fix but I cannot write to the system its installed on (embedded on a harddrive + data + swap) but it gives me a issue with write privileges which I thought would have been fixed by chmod +w /cf.
I have been running happily on Knoppmyth R5F27 (on Debian GNU 4.0/Etch) for a good long time. Everything has been operating well. My kids get to record their Mythbusters. Life is good. Tonight, though, I tried to make things better. And that was the mistake.
I read that we could use our PS3 to watch videos on Hulu. But, I needed a kind of proxy server or something to mask that I was using the PS3 browser. So, I thought I would install squid on the myth box.
I first tried apt-get install squid But, that didn't quite work. So, at a friend's suggestion, I ran: apt-get update Which had problems, too. Still, being a noob, I reran the apt-get install squid and a bunch of stuff came down. It has problems, too.
So, I turned back to apt-get update and realized there was a problem in sources.list. I updated it to have a more current repository and received the update. Then I realized that the apt-get for squid was pulling down resources for lenny. I struggled trying to kill the install for Squid. Failed. And then rebooted just to see if I have problems.
And I do. Mythbackend won't start. The command to do so produces a segmentation fault. Ditto for mythfrontend and mythtv-setup. I don't know what to do. Can someone help me roll this back to a stable setup of Etch? If you want to see my (very messy) attempt to install squid and update the system you can look at[URL]..
I've set up a new virtual server (ubuntu 10.04 LTS on RHEVM, "uname -a Linux print-me 2.6.32-31-server #60-Ubuntu SMP Thu Mar 17 23:33:39 UTC 2011 x86_64 GNU/Linux") 2 weeks ago just for cups and samba printing (no other filesharing). Ran tests and it looked fine, then last friday I have added 10 Ricoh printers and 3 hp printers. Looked fine, apart from an issue with one "HP Color Laserjet 2600n", but resolved this with the help of the driver found here: [URL].. Since saturday, cups crashes daily in the morning with a segmentation fault (segfault:, eg:
/var/log/kern.log:Apr 3 06:40:39 print-me kernel: [154716.314945] cupsd[20713]: segfault at 7f097c8cd5d0 ip 00007f0ab0f0fb0f sp 00007fff5282dc10 error 4 in libcups.so.2[7f0ab0efb000+47000]
I wanted to trace what happens just before this by changing the LogLevel[URL]..upsd-conf.html) but setting it to anything higher than notice makes cups segfault again, with additional message on CLI:
I'm writing a tridiagonal solver for sparse linear systems and I coded this decreasing loop:
PHP Code:
xx[NN - 1] = gamma[NN - 1]*BB[NN - 1]; ii = NN - 2; /* Compute the x values: */ while (ii >= 0) { xx[ii] = gamma[ii]*(BB[ii] + xx[ii + 1]); ii = ii - 1; }
now... if ii is declared as an unsigned integer, the code gives me a segmentation fault, but if I declare it as an int, it doesn't. Using DDD I noticed that, as an unsigned int variable, when I finally decrease it, it underflows and blows up to a huge value, ergo giving me an unaccesible direction for xx in the following iteration! I taugh me not to use unsigned int variables for dereasing loops! XD
I followed this how to to make a NFS server: [url]
So it means: exports looks like this:
Quote:
Here are some quick examples of what you could add to your /etc/exports
For Full Read Write Permissions allowing any computer from 192.168.1.1 through 192.168.1.255
It means that if sbdy arrives with a linux machine, puts the ethernet cable into the router, then logs as root on his machine, and mount the exports. He can do almost everythg, with permissions chmod'ing ...
Is that LAMP, or i am wrong for nfs kernel servers, the ultimate users/password servers against that to prevent those physical approches /logins?is there good how to ?
I am working on development of an TOS that runs in Protected Mode. I am required to switch it from text mode to graphics mode. Everywhere I google I get only one solution set AX to 0013h and call INT 10 and easily the VGA Graphics Mode is set.
I am working in protected mode and hence cannot use INT 10. Can someone please guide me? I came across a post where it was said that this can be done by setting the VGA registers, but I could not understand much from the link provided in the post on how to implement it.
some users [ possibly ATI card owners running fglrx default ubuntu driver ] have issues having compiz enabled and trying to change the mouse pointer to a larger size. It actually doesn't get resized at all, expect when moved over Firefox and OpenOffice.I was fiddling in trying to get a workaround for this when suddenly Nautilus started to crash and respawn in an infinite loop. Everything then started to fail. gnome-terminal wouldn't open, xterm wouldn't open, menus wouldn't respond. Etc.The entire GNOME desktop was inoperable.
Logging out and choosing Fluxbox and KDE didn't help. I was sent right back to the GDM login screen. Hmm... seems not related entirely to GNOME... if it all.From a terminal, I could see constant crashes, segfaults on libc6-2.11.1..While at it, I logged on another account (my wife's) and everything was perfectly FINE, with no issues at all. Creating them another account and initializing, it also didn't happen any segfaults. However, everytime I logged in my own account, everything would happen again... nautilus respawning, no terminal, nothing, not even logout would work. Either I hit a MAJOR BUG in libc6 current ubuntu compile, or a setting file inside my home dir got really corrupted and screwed up. It was very frustrating, because this bug was a show stopper. For those who concern, my mobo is an Asus M3A78-EM running a ATI HD 3200 IGP, and I have ubuntu-default fglrx running.
I had run memtest+ overnight and no errors whatsoever. The fact that this was an "account specific" issue deems that there is no hardware fault. I had to migrate my old account to a newly created account, it was hard work because of my 100GB files. Setting ownership in each of them, etc. Everything is OK now, but I really wished to know what dimmed out my bright Lucid Lynx experience yesterday. And I just hope this doesn't happen again.
I'm getting random system hangs and display issues when using my computer with my nVidia graphics card. On a lark, i checked /proc/interrupts and noticed that the nvidia device is sharing an interrupt with one of my USB boards, as well as my integrated sound card. i managed to move my sound card by editing my alsa-base and adding:
Code: options snd-hda-intel enable_msi=1 This helps mostly, but i'm still getting intermittant issues. is there any way to shift the interrupt of my gfx card (or usb controller) to avoid this potential conflict? i know the devices should be able to co-exist, but i've seen several people having issues when an nVidia card shares interrupts.
I am trying to figure out how to mask local timer interrupts on a specific core of a multicore system from within user space. The interrupts are causing latency spikes of 3-10u that we would like to remove. We are only running 1 thread on the core h everything shielded except for these timer interrupts. This thread makes no system calls and thus is never getting context switched out. I am not looking to turn them off entirely but rather turn them off, run my code, turn them on in a continuous loop. The thread runs in user space which we are hoping to maintain. We also have no desire to modify the kernel if possible. I've read about using spinlock_irqsave() but it appears (not positive) that it must be used within kernel space.
I have a question regarding the /proc/interrupts file. Let's say for example I had a server with 2xQuad-Core processors (so we have CPU0 to CPU7 ), and with 5 network interfaces. SMP affinity to all 5 interfaces was set to "ff", so all interfaces have done interrupts on all the processors. he network interfaces interrupts counters should look like this:
Now let's say I've set the affinity to each of the network interfaces, so that it balances one per processor, so we have 5 processors working only for the network interfaces each processor with it's own eth. Now let's assume that the network interfaces generate very few interrupts, and that they show up every 5-6 seconds, so watching cat /proc/interrupts doesn't exactly underline the modifications unless you look with a ruler. Is there a way to reset the counters on /proc/interrupts so that they all start at 0, without rebooting the system?
I have installed the fedora 14, but there is no kernel source tree.I read the doc "building a custom kernel".But I don't want to rebuild a new kernel.I just want to install the source tree of current kernel.Could someone tell me the way?