Security Incidents mailing list archives

Re: solaris nscd cores


From: woods () weird com (Greg A. Woods)
Date: Sat, 1 Dec 2001 22:06:35 -0500 (EST)

[ On Saturday, December 1, 2001 at 14:57:38 (-0500), mikeDOTd wrote: ]
Subject: Re: solaris nscd cores

      I saw a number of nscd crashes thursday-friday on my sun.

      I have a full core, and initially I see this:

Core was generated by `/usr/sbin/nscd'.
Program terminated with signal 9, Killed.
#0  0xef7563d8 in ?? ()

      If I find anything else I'll post to the list.

There are a couple of things majorly wrong with this picture.  So far as
I know the only way a process will ever get "signal 9" (SIGKILL) is if
someone running with the same privileges as the process, or as the
superuser, manually sends it.  Also so far as I know you'll never get a
core dump from a SIGKILL, at least not on SunOS.

Either your debugger is lying, or something's really broken worse than
it appears (could ncsd have sent itself SIGKILL?).

-- 
                                                        Greg A. Woods

+1 416 218-0098      VE3TCP      <gwoods () acm org>     <woods () robohack ca>
Planix, Inc. <woods () planix com>;   Secrets of the Weird <woods () weird com>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: