Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" #150
Comments
|
Hi.
Thanks for the report.
What is the result of compiling and running this program on each of the two machines? Thanks!
#include <stdio.h>
#include <unistd.h>
int main()
{
printf("_SC_PAGE_SIZE = %ld\n", sysconf(_SC_PAGE_SIZE));
return 0;
}
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 15:05
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Subject: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I have been trying to upgrade our plugin from 1.0.9 to 1.0.10 because of that bug that we raised and which is fixed in this version. Unfortunately, the 1.0.10 aborts right after loading with the above error. Previous version works just fine. This does not happen on all servers though....
Server version: 5.6.29-76.2-log Percona Server (GPL), Release 76.2, Revision ddf26fe
plugin-load=AUDIT=libaudit_plugin.so
audit_offsets=7704, 7760, 4392, 5032, 88, 2720, 96, 0, 32, 104, 152, 7880
audit_json_file=ON
audit_json_log_file=/db/log/audit.log
audit_record_objs="<redacted>"
audit_record_cmds="select"
audit_force_record_logins=ON
audit_whitelist_users="<redacted>,{}"
Machine where this does not work (phisycal)
CentOS 6.7
Linux redacted 2.6.32-573.18.1.el6.x86_64 #1<#1> SMP Tue Feb 9 22:46:17 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Machine where the plugin runs fine (virtual, AWS):
CentOS 6-7
Linux redacted 2.6.32-573.8.1.el6.centos.plus.x86_64 #1<#1> SMP Tue Nov 10 18:20:27 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Please let me know if more information is needed.
Thanks
Rick
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub<#150>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vVPF6OBqkNgv-rrEIh1d5PDcodtmks5rBYtegaJpZM4K7oY4>.
|
|
Oddly, the result is the same on both:
|
|
Can you see if there is a setting (maybe SELinux related) on the failing server that prevents doing an mmap in the lower 32 bits of address space? Below is the relevant bits of code:
bool use_static_memory = (page_size <= std_page_size);
int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
#ifdef __x86_64__
size_t func_in_mysqld = (size_t)log_slow_statement;
size_t func_in_plugin = (size_t)trampoline_dummy_func_for_mem;
if (func_in_mysqld < INT_MAX && func_in_plugin > INT_MAX)
{
// See comment about IndirectJump in hot_patch.cc.
mmap_flags |= MAP_32BIT;
use_static_memory = false;
}
#endif
if (use_static_memory)
{
// use static executable memory we alocated via trampoline_dummy_func_for_mem
DATATYPE_ADDRESS addrs = (DATATYPE_ADDRESS)trampoline_dummy_func_for_mem + (page_size - 1);
trampoline_mem = (void*)(addrs & ~(page_size - 1));
sql_print_information(
"%s mem func addr: %p mem start addr: %p page size: %ld",
log_prefix, trampoline_dummy_func_for_mem, trampoline_mem, page_size);
}
else // big pages for some reason. allocate mem using mmap
{
trampoline_mem = mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0);
if (MAP_FAILED == trampoline_mem)
{
sql_print_error("%s unable to mmap memory size: %lu, errno: %d. Aborting.",
log_prefix, page_size, errno);
DBUG_RETURN(1);
}
else
{
sql_print_information(
"%s mem via mmap: %p page size: %ld", log_prefix, trampoline_mem, page_size);
}
}
It would seem that mmap is failing due to 32 bits flag, but that’s something of a guess.
Thanks,
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 15:33
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Oddly, the result is the same on both:
_SC_PAGE_SIZE = 4096
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfOqjoXE78q54FvcWYs4QGoGBNdOks5rBZIBgaJpZM4K7oY4>.
|
|
selinux is disabled... |
|
Since the plugin works on the AWS machine, something is different on the physical one, and we need to try to figure that out.
As a bit of a shot in the dark, for the mysql user, what is the result of running ‘ulimit –a’ on both systems?
We will try to do some research. In the meantime, please see if you can determine any major differences between the configurations of the two systems.
If you don’t mind recompiling the plugin, you can try commenting out the highlighted line of code and see if that works. (But it’s a guess – do that in a non-production environment please!)
#ifdef __x86_64__
size_t func_in_mysqld = (size_t)log_slow_statement;
size_t func_in_plugin = (size_t)trampoline_dummy_func_for_mem;
if (func_in_mysqld < INT_MAX && func_in_plugin > INT_MAX)
{
// See comment about IndirectJump in hot_patch.cc.
mmap_flags |= MAP_32BIT;
use_static_memory = false;
}
#endif
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 15:59
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
selinux is disabled...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUSnol_gI5N5miM1Xpmd_17JWKOSks5rBZgbgaJpZM4K7oY4>.
|
|
Actually, I am compiling MySQL in order to compile the plugin as we speak :-)
Just curious, was this code present in the 1.0.8 release?
Thanks
Rick
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 15:15, aharonrobbins ***@***.***> wrote:
Since the plugin works on the AWS machine, something is different on the physical one, and we need to try to figure that out.
As a bit of a shot in the dark, for the mysql user, what is the result of running ‘ulimit –a’ on both systems?
We will try to do some research. In the meantime, please see if you can determine any major differences between the configurations of the two systems.
If you don’t mind recompiling the plugin, you can try commenting out the highlighted line of code and see if that works. (But it’s a guess – do that in a non-production environment please!)
#ifdef __x86_64__
size_t func_in_mysqld = (size_t)log_slow_statement;
size_t func_in_plugin = (size_t)trampoline_dummy_func_for_mem;
if (func_in_mysqld < INT_MAX && func_in_plugin > INT_MAX)
{
// See comment about IndirectJump in hot_patch.cc.
mmap_flags |= MAP_32BIT;
use_static_memory = false;
}
#endif
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 15:59
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
selinux is disabled...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUSnol_gI5N5miM1Xpmd_17JWKOSks5rBZgbgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
It’s part of a different set of changes that came in between 1.0.9 and 1.0.10 if I recall correctly.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 16:18
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Actually, I am compiling MySQL in order to compile the plugin as we speak :-)
Just curious, was this code present in the 1.0.8 release?
Thanks
Rick
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:15, aharonrobbins ***@***.******@***.***>> wrote:
Since the plugin works on the AWS machine, something is different on the physical one, and we need to try to figure that out.
As a bit of a shot in the dark, for the mysql user, what is the result of running ‘ulimit –a’ on both systems?
We will try to do some research. In the meantime, please see if you can determine any major differences between the configurations of the two systems.
If you don’t mind recompiling the plugin, you can try commenting out the highlighted line of code and see if that works. (But it’s a guess – do that in a non-production environment please!)
#ifdef __x86_64__
size_t func_in_mysqld = (size_t)log_slow_statement;
size_t func_in_plugin = (size_t)trampoline_dummy_func_for_mem;
if (func_in_mysqld < INT_MAX && func_in_plugin > INT_MAX)
{
// See comment about IndirectJump in hot_patch.cc.
mmap_flags |= MAP_32BIT;
use_static_memory = false;
}
#endif
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 15:59
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
selinux is disabled...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUSnol_gI5N5miM1Xpmd_17JWKOSks5rBZgbgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUC0KnvSmOetfMyYhs5QyTuxgANTks5rBZyjgaJpZM4K7oY4>.
|
|
I have tried to run the snippet alone: This one works fine. Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related? Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message... |
|
I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 16:50
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I have tried to run the snippet alone:
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main()
{
int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
const unsigned long page_size = sysconf(_SC_PAGESIZE);
if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
perror("mmap");
}
This one works fine.
So, why is it failing in the plugin?
Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
|
|
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 15:54, aharonrobbins ***@***.***> wrote:
I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 16:50
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I have tried to run the snippet alone:
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main()
{
int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
const unsigned long page_size = sysconf(_SC_PAGESIZE);
if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
perror("mmap");
}
This one works fine.
So, why is it failing in the plugin?
Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
You’re compiling from git?
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 17:04
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.***>> wrote:
I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 16:50
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I have tried to run the snippet alone:
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main()
{
int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
const unsigned long page_size = sysconf(_SC_PAGESIZE);
if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
perror("mmap");
}
This one works fine.
So, why is it failing in the plugin?
Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
|
|
That’s weird. It appears in src/MySQLPlugin.map. Try removing it from there and recompiling. I don’t know why that appears there.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 17:04
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.***>> wrote:
I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 16:50
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I have tried to run the snippet alone:
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main()
{
int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
const unsigned long page_size = sysconf(_SC_PAGESIZE);
if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
perror("mmap");
}
This one works fine.
So, why is it failing in the plugin?
Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
|
|
I downloaded latest tarball from git.
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 16:06, aharonrobbins ***@***.***> wrote:
You’re compiling from git?
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:04
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
***@***.******@***.***>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.***>> wrote:
> I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
>
> I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
>
> Thanks,
>
> Aharon
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 16:50
> To: mcafee/mysql-audit ***@***.******@***.***>>
> Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
>
> I have tried to run the snippet alone:
>
> #include <stdio.h>
>
> #include <unistd.h>
>
> #include <sys/mman.h>
>
>
>
> int main()
>
> {
>
> int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
>
> const unsigned long page_size = sysconf(_SC_PAGESIZE);
>
>
>
> if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
>
> perror("mmap");
>
> }
>
> This one works fine.
> So, why is it failing in the plugin?
>
> Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
>
> Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
Sorry I downloaded tarball from git for 1.1.0, not latest.
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 16:06, aharonrobbins ***@***.***> wrote:
You’re compiling from git?
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:04
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
***@***.******@***.***>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.***>> wrote:
> I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
>
> I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
>
> Thanks,
>
> Aharon
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 16:50
> To: mcafee/mysql-audit ***@***.******@***.***>>
> Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
>
> I have tried to run the snippet alone:
>
> #include <stdio.h>
>
> #include <unistd.h>
>
> #include <sys/mman.h>
>
>
>
> int main()
>
> {
>
> int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
>
> const unsigned long page_size = sysconf(_SC_PAGESIZE);
>
>
>
> if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
>
> perror("mmap");
>
> }
>
> This one works fine.
> So, why is it failing in the plugin?
>
> Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
>
> Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
1.1.0 is the most recent. So you should be good.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 17:17
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Sorry I downloaded tarball from git for 1.1.0, not latest.
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.***>> wrote:
You’re compiling from git?
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:04
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I compiled the plugin but at runtime it refuses to load with following error:
ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
Rick
—
Riccardo Pizzi
***@***.******@***.******@***.******@***.***>>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
> I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
>
> I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
>
> Thanks,
>
> Aharon
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 16:50
> To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
>
> I have tried to run the snippet alone:
>
> #include <stdio.h>
>
> #include <unistd.h>
>
> #include <sys/mman.h>
>
>
>
> int main()
>
> {
>
> int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
>
> const unsigned long page_size = sysconf(_SC_PAGESIZE);
>
>
>
> if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
>
> perror("mmap");
>
> }
>
> This one works fine.
> So, why is it failing in the plugin?
>
> Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
>
> Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
|
|
Recompiling with that function removed from the map still yields same error.
I can see this difference in symbols between original binary from your repository and mine:
/usr/lib64/mysql/plugin/libaudit_plugin.so-1.1.0:000000000026bb18 D thd_alloc_service
/usr/lib64/mysql/plugin/libaudit_plugin.so: U thd_alloc_service
Mine is 2nd line…
Rick
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 16:22, aharonrobbins ***@***.***> wrote:
1.1.0 is the most recent. So you should be good.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:17
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Sorry I downloaded tarball from git for 1.1.0, not latest.
—
Riccardo Pizzi
***@***.******@***.***>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.***>> wrote:
> You’re compiling from git?
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 17:04
> To: mcafee/mysql-audit ***@***.******@***.***>>
> Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
> I compiled the plugin but at runtime it refuses to load with following error:
>
> ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
>
> Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
>
> Rick
> —
> Riccardo Pizzi
> ***@***.******@***.******@***.******@***.***>>
> http://www.vecchiflipper.it
> http://www.pinballowners.com/webmaster
>
> On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
>
> > I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
> >
> > I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
> >
> > Thanks,
> >
> > Aharon
> >
> >
> > Aharon Robbins
> > Software Engineer
> > Database Security
> > Intel Security
> >
> >
> > 2 HaNagar Street
> > Kfar Saba 44425
> > ISRAEL
> >
> > Direct: +972 2 589 2545
> > Mobile: +972 54 788 6586
> > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
> >
> > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> >
> >
> > From: Rick Pizzi ***@***.***
> > Sent: Thursday, November 24, 2016 16:50
> > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> >
> >
> > I have tried to run the snippet alone:
> >
> > #include <stdio.h>
> >
> > #include <unistd.h>
> >
> > #include <sys/mman.h>
> >
> >
> >
> > int main()
> >
> > {
> >
> > int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
> >
> > const unsigned long page_size = sysconf(_SC_PAGESIZE);
> >
> >
> >
> > if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
> >
> > perror("mmap");
> >
> > }
> >
> > This one works fine.
> > So, why is it failing in the plugin?
> >
> > Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
> >
> > Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
> >
> > —
> > You are receiving this because you commented.
> > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> > —
> > You are receiving this because you authored the thread.
> > Reply to this email directly, view it on GitHub, or mute the thread.
> >
>
>
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
FWIW, we compile the plugin against 5.6.10. I don’t understand why you’re getting those results.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 17:26
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Recompiling with that function removed from the map still yields same error.
I can see this difference in symbols between original binary from your repository and mine:
/usr/lib64/mysql/plugin/libaudit_plugin.so-1.1.0:000000000026bb18 D thd_alloc_service
/usr/lib64/mysql/plugin/libaudit_plugin.so: U thd_alloc_service
Mine is 2nd line…
Rick
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:22, aharonrobbins ***@***.******@***.***>> wrote:
1.1.0 is the most recent. So you should be good.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:17
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Sorry I downloaded tarball from git for 1.1.0, not latest.
—
Riccardo Pizzi
***@***.******@***.******@***.******@***.***>>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
> You’re compiling from git?
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 17:04
> To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
> I compiled the plugin but at runtime it refuses to load with following error:
>
> ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
>
> Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
>
> Rick
> —
> Riccardo Pizzi
> ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>
> http://www.vecchiflipper.it
> http://www.pinballowners.com/webmaster
>
> On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>> wrote:
>
> > I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
> >
> > I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
> >
> > Thanks,
> >
> > Aharon
> >
> >
> > Aharon Robbins
> > Software Engineer
> > Database Security
> > Intel Security
> >
> >
> > 2 HaNagar Street
> > Kfar Saba 44425
> > ISRAEL
> >
> > Direct: +972 2 589 2545
> > Mobile: +972 54 788 6586
> > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>>
> >
> > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> >
> >
> > From: Rick Pizzi ***@***.***
> > Sent: Thursday, November 24, 2016 16:50
> > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>; Comment ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> >
> >
> > I have tried to run the snippet alone:
> >
> > #include <stdio.h>
> >
> > #include <unistd.h>
> >
> > #include <sys/mman.h>
> >
> >
> >
> > int main()
> >
> > {
> >
> > int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
> >
> > const unsigned long page_size = sysconf(_SC_PAGESIZE);
> >
> >
> >
> > if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
> >
> > perror("mmap");
> >
> > }
> >
> > This one works fine.
> > So, why is it failing in the plugin?
> >
> > Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
> >
> > Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
> >
> > —
> > You are receiving this because you commented.
> > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> > —
> > You are receiving this because you authored the thread.
> > Reply to this email directly, view it on GitHub, or mute the thread.
> >
>
>
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUbSy3sVF5A_ufG72oRMkv7c-hx1ks5rBayEgaJpZM4K7oY4>.
|
|
5.6.10 is rather old.
can you try compiling against 5.6.33?
Thanks
Rick
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 16:29, aharonrobbins ***@***.***> wrote:
FWIW, we compile the plugin against 5.6.10. I don’t understand why you’re getting those results.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:26
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Recompiling with that function removed from the map still yields same error.
I can see this difference in symbols between original binary from your repository and mine:
/usr/lib64/mysql/plugin/libaudit_plugin.so-1.1.0:000000000026bb18 D thd_alloc_service
/usr/lib64/mysql/plugin/libaudit_plugin.so: U thd_alloc_service
Mine is 2nd line…
Rick
—
Riccardo Pizzi
***@***.******@***.***>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:22, aharonrobbins ***@***.******@***.***>> wrote:
> 1.1.0 is the most recent. So you should be good.
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 17:17
> To: mcafee/mysql-audit ***@***.******@***.***>>
> Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
> Sorry I downloaded tarball from git for 1.1.0, not latest.
> —
> Riccardo Pizzi
> ***@***.******@***.******@***.******@***.***>>
> http://www.vecchiflipper.it
> http://www.pinballowners.com/webmaster
>
> On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
>
> > You’re compiling from git?
> >
> >
> > Aharon Robbins
> > Software Engineer
> > Database Security
> > Intel Security
> >
> >
> > 2 HaNagar Street
> > Kfar Saba 44425
> > ISRAEL
> >
> > Direct: +972 2 589 2545
> > Mobile: +972 54 788 6586
> > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
> >
> > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> >
> >
> > From: Rick Pizzi ***@***.***
> > Sent: Thursday, November 24, 2016 17:04
> > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> >
> > I compiled the plugin but at runtime it refuses to load with following error:
> >
> > ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
> >
> > Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
> >
> > Rick
> > —
> > Riccardo Pizzi
> > ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>
> > http://www.vecchiflipper.it
> > http://www.pinballowners.com/webmaster
> >
> > On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>> wrote:
> >
> > > I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
> > >
> > > I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
> > >
> > > Thanks,
> > >
> > > Aharon
> > >
> > >
> > > Aharon Robbins
> > > Software Engineer
> > > Database Security
> > > Intel Security
> > >
> > >
> > > 2 HaNagar Street
> > > Kfar Saba 44425
> > > ISRAEL
> > >
> > > Direct: +972 2 589 2545
> > > Mobile: +972 54 788 6586
> > > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>>
> > >
> > > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> > >
> > >
> > > From: Rick Pizzi ***@***.***
> > > Sent: Thursday, November 24, 2016 16:50
> > > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>; Comment ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> > >
> > >
> > > I have tried to run the snippet alone:
> > >
> > > #include <stdio.h>
> > >
> > > #include <unistd.h>
> > >
> > > #include <sys/mman.h>
> > >
> > >
> > >
> > > int main()
> > >
> > > {
> > >
> > > int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
> > >
> > > const unsigned long page_size = sysconf(_SC_PAGESIZE);
> > >
> > >
> > >
> > > if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
> > >
> > > perror("mmap");
> > >
> > > }
> > >
> > > This one works fine.
> > > So, why is it failing in the plugin?
> > >
> > > Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
> > >
> > > Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
> > >
> > > —
> > > You are receiving this because you commented.
> > > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> > > —
> > > You are receiving this because you authored the thread.
> > > Reply to this email directly, view it on GitHub, or mute the thread.
> > >
> >
> >
> >
> > —
> > You are receiving this because you commented.
> > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
> > —
> > You are receiving this because you authored the thread.
> > Reply to this email directly, view it on GitHub, or mute the thread.
> >
>
>
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUbSy3sVF5A_ufG72oRMkv7c-hx1ks5rBayEgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
I tried myself.
Compiling against 5.6.10 doesn’t change anything, same error.
Can you please give me some directions about compiling it? There is no README in the tarball so I just ran bootstrap and then configure with —with-mysql=….
Any extra option I should use ? supported GCC version? etc…
thanks
Rick
—
Riccardo Pizzi
pizzi@leopardus.com
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
…On 24 Nov 2016, at 16:29, aharonrobbins ***@***.***> wrote:
FWIW, we compile the plugin against 5.6.10. I don’t understand why you’re getting those results.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:26
To: mcafee/mysql-audit ***@***.***>
Cc: Robbins, Aharon ***@***.***>; Comment ***@***.***>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Recompiling with that function removed from the map still yields same error.
I can see this difference in symbols between original binary from your repository and mine:
/usr/lib64/mysql/plugin/libaudit_plugin.so-1.1.0:000000000026bb18 D thd_alloc_service
/usr/lib64/mysql/plugin/libaudit_plugin.so: U thd_alloc_service
Mine is 2nd line…
Rick
—
Riccardo Pizzi
***@***.******@***.***>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:22, aharonrobbins ***@***.******@***.***>> wrote:
> 1.1.0 is the most recent. So you should be good.
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 17:17
> To: mcafee/mysql-audit ***@***.******@***.***>>
> Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
> Sorry I downloaded tarball from git for 1.1.0, not latest.
> —
> Riccardo Pizzi
> ***@***.******@***.******@***.******@***.***>>
> http://www.vecchiflipper.it
> http://www.pinballowners.com/webmaster
>
> On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
>
> > You’re compiling from git?
> >
> >
> > Aharon Robbins
> > Software Engineer
> > Database Security
> > Intel Security
> >
> >
> > 2 HaNagar Street
> > Kfar Saba 44425
> > ISRAEL
> >
> > Direct: +972 2 589 2545
> > Mobile: +972 54 788 6586
> > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
> >
> > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> >
> >
> > From: Rick Pizzi ***@***.***
> > Sent: Thursday, November 24, 2016 17:04
> > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> >
> > I compiled the plugin but at runtime it refuses to load with following error:
> >
> > ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
> >
> > Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
> >
> > Rick
> > —
> > Riccardo Pizzi
> > ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>
> > http://www.vecchiflipper.it
> > http://www.pinballowners.com/webmaster
> >
> > On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>> wrote:
> >
> > > I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
> > >
> > > I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
> > >
> > > Thanks,
> > >
> > > Aharon
> > >
> > >
> > > Aharon Robbins
> > > Software Engineer
> > > Database Security
> > > Intel Security
> > >
> > >
> > > 2 HaNagar Street
> > > Kfar Saba 44425
> > > ISRAEL
> > >
> > > Direct: +972 2 589 2545
> > > Mobile: +972 54 788 6586
> > > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>>
> > >
> > > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> > >
> > >
> > > From: Rick Pizzi ***@***.***
> > > Sent: Thursday, November 24, 2016 16:50
> > > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>; Comment ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> > >
> > >
> > > I have tried to run the snippet alone:
> > >
> > > #include <stdio.h>
> > >
> > > #include <unistd.h>
> > >
> > > #include <sys/mman.h>
> > >
> > >
> > >
> > > int main()
> > >
> > > {
> > >
> > > int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
> > >
> > > const unsigned long page_size = sysconf(_SC_PAGESIZE);
> > >
> > >
> > >
> > > if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
> > >
> > > perror("mmap");
> > >
> > > }
> > >
> > > This one works fine.
> > > So, why is it failing in the plugin?
> > >
> > > Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
> > >
> > > Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
> > >
> > > —
> > > You are receiving this because you commented.
> > > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> > > —
> > > You are receiving this because you authored the thread.
> > > Reply to this email directly, view it on GitHub, or mute the thread.
> > >
> >
> >
> >
> > —
> > You are receiving this because you commented.
> > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
> > —
> > You are receiving this because you authored the thread.
> > Reply to this email directly, view it on GitHub, or mute the thread.
> >
>
>
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUbSy3sVF5A_ufG72oRMkv7c-hx1ks5rBayEgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
|
|
There is a compiling.txt file in the git repo with instructions. Please consider checking out from git:
git clone git://github.com/mcafee/mysql-audit.git
I will compile against 5.6.33. Please contact me directly for further communications: Aharon.Robbins@Intel.com<mailto:Aharon.Robbins@Intel.com> instead of through GitHub.
I continue to think it’s some sort of configuration difference with the physical machine, since the plugin works out of the box on the VM.
Thanks,
Aharon
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi [mailto:notifications@github.com]
Sent: Thursday, November 24, 2016 18:54
To: mcafee/mysql-audit <mysql-audit@noreply.github.com>
Cc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
I tried myself.
Compiling against 5.6.10 doesn’t change anything, same error.
Can you please give me some directions about compiling it? There is no README in the tarball so I just ran bootstrap and then configure with —with-mysql=….
Any extra option I should use ? supported GCC version? etc…
thanks
Rick
—
Riccardo Pizzi
pizzi@leopardus.com<mailto:pizzi@leopardus.com>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:29, aharonrobbins ***@***.******@***.***>> wrote:
FWIW, we compile the plugin against 5.6.10. I don’t understand why you’re getting those results.
Aharon Robbins
Software Engineer
Database Security
Intel Security
2 HaNagar Street
Kfar Saba 44425
ISRAEL
Direct: +972 2 589 2545
Mobile: +972 54 788 6586
Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>
The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
From: Rick Pizzi ***@***.***
Sent: Thursday, November 24, 2016 17:26
To: mcafee/mysql-audit ***@***.******@***.***>>
Cc: Robbins, Aharon ***@***.******@***.***>>; Comment ***@***.******@***.***>>
Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
Recompiling with that function removed from the map still yields same error.
I can see this difference in symbols between original binary from your repository and mine:
/usr/lib64/mysql/plugin/libaudit_plugin.so-1.1.0:000000000026bb18 D thd_alloc_service
/usr/lib64/mysql/plugin/libaudit_plugin.so: U thd_alloc_service
Mine is 2nd line…
Rick
—
Riccardo Pizzi
***@***.******@***.******@***.******@***.***>>
http://www.vecchiflipper.it
http://www.pinballowners.com/webmaster
On 24 Nov 2016, at 16:22, aharonrobbins ***@***.******@***.******@***.******@***.***>>> wrote:
> 1.1.0 is the most recent. So you should be good.
>
>
> Aharon Robbins
> Software Engineer
> Database Security
> Intel Security
>
>
> 2 HaNagar Street
> Kfar Saba 44425
> ISRAEL
>
> Direct: +972 2 589 2545
> Mobile: +972 54 788 6586
> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>
>
> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
>
>
> From: Rick Pizzi ***@***.***
> Sent: Thursday, November 24, 2016 17:17
> To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.***>>>
> Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.***>>>; Comment ***@***.******@***.******@***.******@***.***>>>
> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
>
> Sorry I downloaded tarball from git for 1.1.0, not latest.
> —
> Riccardo Pizzi
> ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>
> http://www.vecchiflipper.it
> http://www.pinballowners.com/webmaster
>
> On 24 Nov 2016, at 16:06, aharonrobbins ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>> wrote:
>
> > You’re compiling from git?
> >
> >
> > Aharon Robbins
> > Software Engineer
> > Database Security
> > Intel Security
> >
> >
> > 2 HaNagar Street
> > Kfar Saba 44425
> > ISRAEL
> >
> > Direct: +972 2 589 2545
> > Mobile: +972 54 788 6586
> > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>>
> >
> > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> >
> >
> > From: Rick Pizzi ***@***.***
> > Sent: Thursday, November 24, 2016 17:04
> > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>; Comment ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> >
> > I compiled the plugin but at runtime it refuses to load with following error:
> >
> > ERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)
> >
> > Error #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …
> >
> > Rick
> > —
> > Riccardo Pizzi
> > ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>
> > http://www.vecchiflipper.it
> > http://www.pinballowners.com/webmaster
> >
> > On 24 Nov 2016, at 15:54, aharonrobbins ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>> wrote:
> >
> > > I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.
> > >
> > > I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.
> > >
> > > Thanks,
> > >
> > > Aharon
> > >
> > >
> > > Aharon Robbins
> > > Software Engineer
> > > Database Security
> > > Intel Security
> > >
> > >
> > > 2 HaNagar Street
> > > Kfar Saba 44425
> > > ISRAEL
> > >
> > > Direct: +972 2 589 2545
> > > Mobile: +972 54 788 6586
> > > Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/%3chttp:/www.mcafee.com%3chttp:/www.intelsecurity.com/>>>>>
> > >
> > > The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.
> > >
> > >
> > > From: Rick Pizzi ***@***.***
> > > Sent: Thursday, November 24, 2016 16:50
> > > To: mcafee/mysql-audit ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>>
> > > Cc: Robbins, Aharon ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>>; Comment ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***>>>>>
> > > Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with "unable to mmap memory size: 4096, errno: 12" (#150)
> > >
> > >
> > > I have tried to run the snippet alone:
> > >
> > > #include <stdio.h>
> > >
> > > #include <unistd.h>
> > >
> > > #include <sys/mman.h>
> > >
> > >
> > >
> > > int main()
> > >
> > > {
> > >
> > > int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;
> > >
> > > const unsigned long page_size = sysconf(_SC_PAGESIZE);
> > >
> > >
> > >
> > > if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)
> > >
> > > perror("mmap");
> > >
> > > }
> > >
> > > This one works fine.
> > > So, why is it failing in the plugin?
> > >
> > > Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?
> > >
> > > Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...
> > >
> > > —
> > > You are receiving this because you commented.
> > > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.
> > > —
> > > You are receiving this because you authored the thread.
> > > Reply to this email directly, view it on GitHub, or mute the thread.
> > >
> >
> >
> >
> > —
> > You are receiving this because you commented.
> > Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.
> > —
> > You are receiving this because you authored the thread.
> > Reply to this email directly, view it on GitHub, or mute the thread.
> >
>
>
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdowR7_o7MeIgXf48hTH0KcAc2xZks5rBapqgaJpZM4K7oY4>.
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
>
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vUbSy3sVF5A_ufG72oRMkv7c-hx1ks5rBayEgaJpZM4K7oY4>.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or mute the thread.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub<#150 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfUXK1lgxW0KuvWjLcPzcYXwnAFTks5rBcE4gaJpZM4K7oY4>.
|
|
Some updates. Regarding original problem, it appears that setting use_static_memory to true allows the plugin to load and work just fine, so I just patched the code that sets that to false: |
|
We are working on this, to see if we can make things work correctly without requiring rebuilding the plugin. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have been trying to upgrade our plugin from 1.0.9 to 1.1.0 because of that bug that we raised and which is fixed in this version. Unfortunately, the 1.1.0 aborts right after loading with the above error. Previous version works just fine. This does not happen on all servers though....
Machine where this does not work (phisycal)
CentOS 6.7
Linux redacted 2.6.32-573.18.1.el6.x86_64 #1 SMP Tue Feb 9 22:46:17 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Machine where the plugin runs fine (virtual, AWS):
CentOS 6-7
Linux redacted 2.6.32-573.8.1.el6.centos.plus.x86_64 #1 SMP Tue Nov 10 18:20:27 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Please let me know if more information is needed.
Thanks
Rick
The text was updated successfully, but these errors were encountered: