LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-27-2003, 12:52 PM   #1
karlg
LQ Newbie
 
Registered: Jun 2003
Posts: 2

Rep: Reputation: 0
stat of /dev files loads modules!


So new DoS on redhat 7.2 maybe?

when stating files in the /dev dir, it causes modprobe to load them. first started having the problem about 2 weeks ago. happens if you do a ls, find, updatedb or even "rpm -V dev" and walk the /dev dirtree. if you let the find run on the whole /dev tree, it will eventually exhaust all resorces and then daemons start to die, and eventually the box becomes unaccessable until the find is complete, and insmod/modproble is done trying to insert modules.

it was my understanding that the kernel would autoload modules ONLY on an open, not stat!

this is isolated to a single RH7.2 box. i have one more 7.2 box running with same kernel, etc, without issue. This would lead me to believe this is some kind of configuration (proc maybe?) somewhere. note a reboot does not fix the problem.

i've done as much as i can to try to verify that my box is not trojaned.... doing rpm verifies on all the files and md5sums matches my other 7.2 box.

causes these (and MANY more) in /var/log/messages:


Jun 27 10:54:30 zoso last message repeated 10 times
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module block-major-15
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module block-major-24
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module block-major-30
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module block-major-32
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module sound-slot-0
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module sound-service-0-3
Jun 27 10:54:30 zoso kernel: tty_io.c: process 1728 (find) used obsolete /dev/cua - update software to use /dev/ttyS1
Jun 27 10:54:30 zoso kernel: tty_io.c: process 1728 (find) used obsolete /dev/cua - update software to use /dev/ttyS2
Jun 27 10:54:30 zoso kernel: tty_io.c: process 1728 (find) used obsolete /dev/cua - update software to use /dev/ttyS3
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module char-major-205
Jun 27 10:54:30 zoso last message repeated 3 times
Jun 27 10:54:30 zoso modprobe: modprobe: Can't locate module char-major-44
Jun 27 10:54:31 zoso last message repeated 15 times
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module char-major-52
Jun 27 10:54:31 zoso last message repeated 3 times
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module char-major-94
Jun 27 10:54:31 zoso last message repeated 3 times
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module sound-slot-1
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module sound-service-1-3
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module char-major-55
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module char-major-64
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb0
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb1
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb10
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb11
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb12
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb13
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb14
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb15
Jun 27 10:54:31 zoso modprobe: modprobe: Can't locate module fb16
..[snip]....

running:
redhat 7.2
kernel 2.4.20-18.7
glibc-2.2.4-32

any ideas??? (other than pitching it out the window)
 
Old 06-27-2003, 06:00 PM   #2
beltorak
LQ Newbie
 
Registered: Dec 2002
Distribution: slackware 8.1
Posts: 15

Rep: Reputation: 0
If you are using the dev fs and running devfsd, try commenting out the line in '/etc/devfsd.conf' that looks like this:
Code:
LOOKUP       .*           MODLOAD
then do 'root# devfsd /dev -np'.

If that isn't it, try turning off the module autoloader completely (may require a kernal compile), learn what modules you need, and have your initscripts load them. I'm not familiar with the specifics of the red hat initscripts tho.... Personally I can't stand the module autoloader...

let us know if you find the answer.

-t.
 
Old 07-01-2003, 09:26 AM   #3
karlg
LQ Newbie
 
Registered: Jun 2003
Posts: 2

Original Poster
Rep: Reputation: 0
nope... not running devfsd... the rpm isn't even installed....


any other ideas?
 
Old 12-03-2004, 04:04 PM   #4
tonyross
LQ Newbie
 
Registered: Dec 2004
Posts: 1

Rep: Reputation: 0
I'm having the same problem. Did you ever find a solution?

Thanks,
TR
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't run LILO error : Fatal:raid_setup:stat("/dev/hdi1") robban59 Linux - Newbie 4 05-31-2005 05:44 PM
what loads the bootup modules? Ed_999 Slackware 2 12-12-2004 10:20 PM
Linux stat to Windows Stat sridurai Programming 3 09-24-2004 05:07 PM
installed dropline, root loads kde3.2, user loads drop pgrimes Linux - Software 7 06-28-2004 07:11 PM
Can't locate modules /dev/modprobe hamish Linux - Software 2 04-09-2004 03:57 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration