Help: DNS Resolver and Root Shell

[Hui Li]

On Wed, 2013-10-23 at 17:51 +0200, Denys Vlasenko wrote:
> execve("/bin/ping", ["ping", "www.google.com"], [/* 9 vars */]) = 0
> ...
> ...
> open("/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3^M
> read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\220\31\0\0004\0\0\0<\263\0\0\2\0\0\0054\0
> \0\10\0(\0\36\0\33\0\6\0\0\0004\0\0\0004\0\0\0004\0\0\0\0\1\
> close(3)
> 
> This looks wrong: the library wasn't successfully loaded.
> Successfful load would look like this:
> 
> open("/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
> read(4, "\177ELF\2\1\1\0\0\0\0...
> fstat(4, {st_mode=S_IFREG|0755, st_size=62376, ...}) = 0
> mmap(NULL, 2148488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4,
> 0) = 0x7fc51fbb0000
> mprotect(0x7fc51fbbc000, 2093056, PROT_NONE) = 0
> mmap(0x7fc51fdbb000, 8192, PROT_READ|PROT_WRITE,
> MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xb000) = 0x7fc51fdbb000
> close(4)
> 
> 
> and in your case, dynamic loader just dropped the file
> and tried to find libnss_files.so.2 elsewhere:
> 
> open("/usr/lib/tls/v6l/vfp/libnss_files.so.2", O_RDONLY|O_CLOEXEC) =
> -1 ENOENT (No such file or directory)
> stat64("/usr/lib/tls/v6l/vfp", 0xbe9efd48) = -1 ENOENT (No such file
> or directory)
> open("/usr/lib/tls/v6l/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1
> ENOENT (No such file or directory)
> stat64("/usr/lib/tls/v6l", 0xbe9efd48)  = -1 ENOENT (No such file or directory)
> open("/usr/lib/tls/vfp/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1
> ENOENT (No such file or directory)
> stat64("/usr/lib/tls/vfp", 0xbe9efd48)  = -1 ENOENT (No such file or directory)
> 
> Looks like you copied wrong files to your /lib64
> (for example, x86 instead of ARM ones).
I don't think so. I didn't use x86 libs.

[huli at dhcp-193-161 lib]$ pwd
/opt/arm/arm-rpi-linux-gnueabi/arm-rpi-linux-gnueabi/sysroot/lib
[huli at dhcp-193-161 lib]$ file libnss_files-2.17.so
libnss_files-2.17.so: ELF 32-bit LSB shared object, ARM, version 1
(SYSV), dynamically linked (uses shared libs), for GNU/Linux 3.10.2, not
stripped

This is the busybox version: [huli at dhcp-193-161 bin]$ file busybox 
busybox: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically
linked (uses shared libs), for GNU/Linux 2.6.32, stripped

Is this would be an issue?

Thanks.