mongodb crashing...denied RWX mmap

[gillecaluim]

Updated my Arch Linux x86_64 server and now mongodb is crashing
System:
linux-grsec 1:4.7.4.r201609152234
mongodb 3.2.10
jdk8-openjdk 8.u112

Dec 05 16:20:05 server kernel: grsec: denied RWX mmap of <anonymous mapping> by /usr/bin/mongod[mongod:27399] uid/euid:113/113 gid/egid:113/113, parent /usr/lib/jvm/java-8-openjdk/jre/bin/java[java:22311] uid/euid:113/113 gid/egid:113/113
Dec 05 16:20:05 server systemd-coredump[27400]: Process 27381 (mongod) of user 113 dumped core.
-- Subject: Process 27381 (mongod) dumped core
-- Process 27381 (mongod) crashed and dumped core.

what do I need to do to fix this? Thanks

[gillecaluim]

I've tried paxctl -m for both the mongodb and java binaries but still getting the same result

Dec 07 15:38:00 server kernel: grsec: denied RWX mmap of <anonymous mapping> by /usr/bin/mongod[mongod:7842] uid/euid:113/113 gid/egid:113/113, parent /usr/lib/jvm/java-8-openjdk/jre/bin/java[java:4185] uid/euid:113/113 gid/egid:113/113
Dec 07 15:38:01 server systemd-coredump[7843]: Process 7808 (mongod) of user 113 dumped core.
-- Subject: Process 7808 (mongod) dumped core
-- Process 7808 (mongod) crashed and dumped core.

[spender]

Does your kernel have CONFIG_PAX_PT_PAX_FLAGS enabled? If MPROTECT is actually disabled on /usr/bin/mongod (and /usr/bin/mongod is an ELF binary and not a script running some other binary), then it is impossible to get the kernel logs you've pasted. So there's some other reason you'll have to investigate as to why MPROTECT is not being disabled on it.

-Brad

[gillecaluim]

I was using the community linux-grsec package, which as it turned out hadn't enabled CONFIG_PAX_PT_PAX_FLAGS. I rebuilt the package with the current version with this option enabled. Voila, everything working now, Thanks

[spender]

In the future you might have an easier time just using the paxctld package and sticking to using that, as some problems can arise if you mix extended attributes (which paxctld uses) with the PT_PAX markings. paxctld will auto-update the flags on a binary when it's updated, so there's less maintenance needed.

-Brad