Date: Sat, 20 Jun 2020 22:38:43 +0200 From: Jacek <wampir990@...il.com> To: lkrg-users@...ts.openwall.com Subject: Re: Yes, Yes, Yes,p_lkrg has detected dangerous exploits. ;) Hi Alexander I cannot reproduce the error at the moment, because after it appeared on Linux-5.7.4,I updated the lkrg via git pull source, I built the module again, and these errors do not occur anymore. On the other hand, I was glad that for the first time I saw the activity of the p_lkrg module, which I failed earlier despite testing over 30 different exploits. If someday there are errors in the lkrg action, I will write about them, for now I thank you for your help and angelic patience. ;) Cheers W dniu 20.06.2020 o 16:42, Solar Designer pisze: > Hi Jacek, > > On Sat, Jun 20, 2020 at 03:56:22PM +0200, Jacek wrote: >> Finally p_lkrg revealed its activities, I found the following messages >> in dmesg: >> >> Jun 19 11:57:22 domek kernel: [46870.845646] [p_lkrg] <Exploit >> Detection> ON process[3619 | thunderbird] has corrupted 'off' flag! >> Jun 19 11:57:22 domek kernel: [46870.847161] [p_lkrg] <Exploit >> Detection> Trying to kill process[AudioIPC Server | 3619]! >> Jun 19 11:57:23 domek kernel: [46872.579300] [p_lkrg] <Exploit >> Detection> ON process[400 | firefox] has corrupted 'off' flag! >> Jun 19 11:57:23 domek kernel: [46872.580099] [p_lkrg] <Exploit >> Detection> Trying to kill process[Cache2 I/O | 400]! > Ouch. Are you able to reproduce this? > > Please set log_level=4 (via sysctl or module parameter), so that we have > more detailed messages next time this occurs. (That log level is not > suitable for production use. Please only use it while we debug this.) > > It could also make sense to try reverting the below commit (which might > or might not be relevant), but we'd be more interested in having the > issue reproduced with intact LKRG and verbose logging first, as above. > > commit 8c1a55f7e0105656802d290fc7240c894eb904e0 > Author: Adam_pi3 <pi3@....com.pl> > Date: Wed May 13 17:38:19 2020 -0400 > > Improve performance for flag validation > > Thanks, > > Alexander Content of type "text/html" skipped Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.