[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: svn_config_ensure resulting in segfault with unknown user

From: <kfogel_at_collab.net>
Date: 2004-11-02 02:16:37 CET

"Alex J. Avriette" <useperl@aol.net> writes:
> I was invoking subversion from a CGI running as userid 999. However, at
> some point after the webserver had started, user 999 was deleted. When
> trying to figure out why subversion wouldn't run ("svn help"
> didn't run), I eventually just had the webserver print the output of
> ltrace, and saw that subversion was segfaulting in svn_config_ensure
> (libsvn_subr/config_file.c). I think this is due to the unknown user
> problem.
>
> Restarting the webserver, with its new user, fixed the issue.
>
> I didn't see any method for me to directly open a ticket for this on
> the tigris.org website, so I've sent a message here as suggested.

Can you show us the ltrace output?

I tried to reproduce this, with mixed results. The web server did
become unable to execute my little cgi-bin/ script, as soon as I
removed the line from /etc/passwd for the user httpd was running as.

Here's the cgi-bin/run-svn script:

   #!/bin/sh

   echo "Content-type: text/plain"
   echo ""
   echo ""
   /usr/bin/ltrace /usr/local/bin/svn help 2>&1

Here's the line I added/removed from /etc/passwd:

   fake:!:1004:100::/home/kfogel:/bin/bash

(Note how I gave it my own home dir.)

Here's the output of hitting http://localhost/cgi-bin/run-svn, after I
removed the 'fake' user that httpd is running as:

   svn_subr_version(0x40017014, 1, 1, 0x401d85a8, 0x401d85a8) \
     = 0x4009c900
   svn_client_version(0x805eb38, 0x4009c900, 1, 0x401d85a8, 0x401d85a8) \
     = 0x4003d0e0
   svn_wc_version(0x805eb38, 0x4003d0e0, 1, 0x401d85a8, 0x401d85a8) \
     = 0x40069668
   svn_ra_version(0x805eb38, 0x40069668, 1, 0x401d85a8, 0x401d85a8) \
     = 0x4006c6c0
   svn_delta_version(0x805eb38, 0x4006c6c0, 1, 0x401d85a8, 0x401d85a8) \
     = 0x40075920
   --- SIGSEGV (Segmentation fault) ---
   +++ killed by SIGSEGV +++

But then I tried to reproduce another way. I made a setuid copy of
'svn', owned by 'fake', then tried running 'svn help' with the fake
user existing and then not existing:

   # cd /usr/local/bin
   # cp svn tmp-svn
   # chmod +s tmp-svn
   # chown fake.users tmp-svn
   # ls -l tmp-svn
   -rwxr-xr-x 1 fake users 1554663 Nov 1 20:57 tmp-svn
   # ./tmp-svn help
   [Successful, normal output.]
   [Now, I remove the 'fake' user and try again.]
   # ls -l tmp-svn
   -rwxr-xr-x 1 1004 users 1554663 Nov 1 20:57 tmp-svn
   # ./tmp-svn help
   [Successful, normal output again!]
   #

Hmmm. It was successful both times.

So, are you sure it was SVN dying and not the web server itself?

-Karl

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Nov 2 04:10:20 2004

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.