Re: Problems with net/net-snmp on 5.2-RELEASE?

Thus spake Robert Watson (rwatson_at_freebsd.org) [15/01/04 19:10]:
: > Whoops.  Found the problem -- the default install of 5.2 doesn't appear
: > to mount /proc by default.  Mounted, problem (mostly) fixed.  Still have
: > some permission issues, but those I can handle. 
: 
: Hmm.  Do you have any idea why the SNMP agent needs access to procfs? 
: We've been trying to deprecate use of procfs due to long-standing security
: issues with the procfs approach (just look at the vulnerability lists for
: FreeBSD, Linux, and Solaris to see why...)  There are some services in
: procfs not found using the other interfaces, but frequently applications
: can get access to everything they need using either libkvm (which uses
: sysctl()), or using ptrace(). 

The abort happens when polling for .1.3.6.1.4.1.2021.10.1.5.1 and
.1.3.6.1.4.1.2021.10.1.5.2 -- ucdavis.laTable.laEntry.laLoadInt.1 and .2,
respectively.  I'm not sure why, exactly, as I haven't had the time to go
into in-depth debugging.  A quick attempt at running it through truss gives
me this:

    newhost# truss -o snmpd.out snmpd -DALL -Lf snmpd.debug -f
    truss: truss: cannot open /proc/curproc/mem: No such file or directory
    cannot open /proc/13877/mem: No such file or directory
    newhost# 

Pulling out process checks from snmpd.conf doesn't change its behaviour,
unsurprisingly.

Anything else you'd like me to try?

(And FWIW, no matter how I set the permissions, if snmpd isn't running as
root, it fails on opening /dev/mem.  I've currently got it set to 0660, and
the user snmpd runs as is part of the kmem group (yeah yeah, I know...).
For some reason, this Just Works on -STABLE, without the need to change
permissions or group membership.)

  - Damian