http://bugs.winehq.org/show_bug.cgi?id=19732
Summary: Security: use CAP_SYS_RAWIO during start up to map the
memory below mmap_min_addr instead of permanently
lowering it at install time
Product: Wine
Version: 1.1.21
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
…
[View More]ReportedBy: scott(a)open-vote.org
Background:
In order to work around the mmap_min_addr setting introduced a while back that
breaks Wine, many Wine packages now install conf files to /etc/sysctl.d/ that
disable mmap_min_addr entirely. This reduces security of the system, as any
kernel null pointer dereference bug can root the machine. One such bug was
found to be open for 8 years.
This launchpad bug gives hints at what we need to do to implement this within
Wine properly.
----
>From Launchpad:
I would like to see wine and dosemu using filesystem capabilties to temporarily
grant themselves CAP_SYS_RAWIO during start up to map the memory below
mmap_min_addr, instead of requiring that the entire running system have their
mmap_min_addr lowered.
Implementing this would involve two halves: setting up the filesystem
capabilities when the package installed (postinst most likely), and dropping
the capability once the program had allocated memory.
Here is a quick example of how to mark an executable with a capability:
http://www.friedhoff.org/posixfilecaps.html#Examples%20-%20Substitution%20o…
They use numeric values, but it may be more readable to use text version:
sudo setcap cap_sys_rawio=ep low-mmap
(setcap is in libcap2-bin)
Part 2 involves dropping the capability:
http://git.0pointer.de/?p=pulseaudio.git;a=blob;f=src/daemon/caps.c;hb=86de…
the pa_drop_caps and shows how to drop capabilities, and pa_have_caps shows how
to test for a specific capability. (In the example's case, CAP_SYS_NICE.)
(sorry, lost some context for my setcap paste: "low-mmap" is the program I was
setting capabilities on. "cap_sys_rawio" is the textual version of the
capabilities.)
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=6604
--- Comment #14 from Elad Alfassa <elad(a)fedoraproject.org> 2012-03-13 06:47:51 CDT ---
(In reply to comment #13)
> There's no reason to have icons for wineboot or oleview, they aren't meant for
> users.
I agree, in this case, this bug should be closed.
In related (although of topic for this specific bugzilla) note, Andreas, please
remove the wineboot and oleview desktop files from the Fedora packages.
--
Configure bugmail: http://…
[View More]bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=6604
--- Comment #13 from Alexandre Julliard <julliard(a)winehq.org> 2012-03-13 06:06:14 CDT ---
There's no reason to have icons for wineboot or oleview, they aren't meant for
users.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=6604
Scott Ritchie <scott(a)open-vote.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Ship icons for the |Ship icons for wineboot and
|wine-tools that can be used |wine ole view that can be
|in .desktop files |used in .desktop files
--
Configure bugmail: http://bugs.winehq.…
[View More]org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=7929
--- Comment #126 from K1773R <K1773R(a)darkgamex.ch> 2012-03-12 23:38:21 CDT ---
which is the actual working patch?
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=7929
K1773R <K1773R(a)darkgamex.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |K1773R(a)darkgamex.ch
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You …
[View More]are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=2784
--- Comment #34 from Jay <jaynobyl(a)gmx.de> 2012-03-12 19:54:22 CDT ---
Nice that it's reported fixed. for the Tests in Comment #28 and #29 i used a
AMD Mobility HD 5730 with fglrx 12.1
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30145
Bug #: 30145
Summary: YY can't exe after setup
Product: Wine
Version: 1.4
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: anyeccc(a)gmail.com
Classification: Unclassified
After setup
run it
then the application crashed.
And …
[View More]the chinese always can't display
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=30140
Bug #: 30140
Summary: RAGE fails to start with Nvidia 295.20
Product: Wine
Version: 1.4
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: christian.frank(a)gmx.de
Classification: Unclassified
Hi,
after upgrading to Nvidia 295.…
[View More]20 rage does not work anymore. You can start the
game and the process sits there using 100% cpu but doing nothing.
Attached strace shows (Read 6,
as the last line.
Downgrading to an older driver fixes this issue.
Bugs: http://bugs.winehq.org/show_bug.cgi?id=29931 and
30139http://bugs.winehq.org/show_bug.cgi?id=30139
show also Problems with the new driver.
Best regards,
Christian
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]
http://bugs.winehq.org/show_bug.cgi?id=30139
Bug #: 30139
Summary: Total War: SHOGUN 2 fails to start with Nvidia 295.20
Product: Wine
Version: 1.4
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: christian.frank(a)gmx.de
Classification: Unclassified
Hi,
after upgrading …
[View More]to Nvidia 295.20 driver i noticed that Shogun 2 gets an
segmentation fault when you start the game. It starts loading the game but as
soon as the menu or video should get displayed the game segfaults.
The game loads without issues with older nvidia drivers.
Not sure if thats a driver bug itself or something which needs to be changed in
wine.
There are similiar issues with different games with this new driver:
See bug: http://bugs.winehq.org/show_bug.cgi?id=29931
For me also Rage does not work anymore with the new driver and i will file
another bug for that.
Best regards,
Christian
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
[View Less]