http://bugs.winehq.org/show_bug.cgi?id=19732
Summary: Security: use CAP_SYS_RAWIO during start up to map the
memory below mmap_min_addr instead of permanently
lowering it at install time
Product: Wine
Version: 1.1.21
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: scott(a)open-vote.org
Background:
In order to work around the mmap_min_addr setting introduced a while back that
breaks Wine, many Wine packages now install conf files to /etc/sysctl.d/ that
disable mmap_min_addr entirely. This reduces security of the system, as any
kernel null pointer dereference bug can root the machine. One such bug was
found to be open for 8 years.
This launchpad bug gives hints at what we need to do to implement this within
Wine properly.
----
>From Launchpad:
I would like to see wine and dosemu using filesystem capabilties to temporarily
grant themselves CAP_SYS_RAWIO during start up to map the memory below
mmap_min_addr, instead of requiring that the entire running system have their
mmap_min_addr lowered.
Implementing this would involve two halves: setting up the filesystem
capabilities when the package installed (postinst most likely), and dropping
the capability once the program had allocated memory.
Here is a quick example of how to mark an executable with a capability:
http://www.friedhoff.org/posixfilecaps.html#Examples%20-%20Substitution%20o…
They use numeric values, but it may be more readable to use text version:
sudo setcap cap_sys_rawio=ep low-mmap
(setcap is in libcap2-bin)
Part 2 involves dropping the capability:
http://git.0pointer.de/?p=pulseaudio.git;a=blob;f=src/daemon/caps.c;hb=86de…
the pa_drop_caps and shows how to drop capabilities, and pa_have_caps shows how
to test for a specific capability. (In the example's case, CAP_SYS_NICE.)
(sorry, lost some context for my setcap paste: "low-mmap" is the program I was
setting capabilities on. "cap_sys_rawio" is the textual version of the
capabilities.)
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=6604
--- Comment #14 from Elad Alfassa <elad(a)fedoraproject.org> 2012-03-13 06:47:51 CDT ---
(In reply to comment #13)
> There's no reason to have icons for wineboot or oleview, they aren't meant for
> users.
I agree, in this case, this bug should be closed.
In related (although of topic for this specific bugzilla) note, Andreas, please
remove the wineboot and oleview desktop files from the Fedora packages.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=6604
--- Comment #13 from Alexandre Julliard <julliard(a)winehq.org> 2012-03-13 06:06:14 CDT ---
There's no reason to have icons for wineboot or oleview, they aren't meant for
users.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=6604
Scott Ritchie <scott(a)open-vote.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Ship icons for the |Ship icons for wineboot and
|wine-tools that can be used |wine ole view that can be
|in .desktop files |used in .desktop files
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=7929
--- Comment #126 from K1773R <K1773R(a)darkgamex.ch> 2012-03-12 23:38:21 CDT ---
which is the actual working patch?
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=7929
K1773R <K1773R(a)darkgamex.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |K1773R(a)darkgamex.ch
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=2784
--- Comment #34 from Jay <jaynobyl(a)gmx.de> 2012-03-12 19:54:22 CDT ---
Nice that it's reported fixed. for the Tests in Comment #28 and #29 i used a
AMD Mobility HD 5730 with fglrx 12.1
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30145
Bug #: 30145
Summary: YY can't exe after setup
Product: Wine
Version: 1.4
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: anyeccc(a)gmail.com
Classification: Unclassified
After setup
run it
then the application crashed.
And the chinese always can't display
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30140
Bug #: 30140
Summary: RAGE fails to start with Nvidia 295.20
Product: Wine
Version: 1.4
Platform: x86
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: christian.frank(a)gmx.de
Classification: Unclassified
Hi,
after upgrading to Nvidia 295.20 rage does not work anymore. You can start the
game and the process sits there using 100% cpu but doing nothing.
Attached strace shows (Read 6,
as the last line.
Downgrading to an older driver fixes this issue.
Bugs: http://bugs.winehq.org/show_bug.cgi?id=29931 and
30139http://bugs.winehq.org/show_bug.cgi?id=30139
show also Problems with the new driver.
Best regards,
Christian
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.