False insecure memory warnings...

[gabriel rosenkoetter]

--cmJC7u66zC7hs+87
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

After some discussion with David Shaw recently, I've broken down,
admitted that my public keyring is really just huge and than having
a cron job to maintain it is really pretty reasonable. So I've been
blowing along happily with this in cron:

0 8 * * 1-5 zsh -c 'time gpg --no --batch --check-trustdb'

(Yes, I really do want zsh's time output, thanks.)

That was well and good till several days ago, when I started getting
this:

gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: checking at depth 0 signed=3D49 ot(-/q/n/m/f/u)=3D0/0/0/0/0/1
gpg: checking at depth 1 signed=3D82 ot(-/q/n/m/f/u)=3D0/0/0/19/30/0
gpg: checking at depth 2 signed=3D286 ot(-/q/n/m/f/u)=3D1/0/0/69/5/0
gpg: checking at depth 3 signed=3D178 ot(-/q/n/m/f/u)=3D1/74/0/21/0/0
gpg: next trustdb check due at 2003-04-16
gpg --no --batch --check-trustdb  14.57s user 11.03s system 60% cpu 42.328 =
total

Only but my gpg(1) really is suid, I promise:

uriel:~% which gpg
/usr/pkg/bin/gpg
uriel:~% ls -l `!!`
ls -l `which gpg`
-r-sr-xr-x  1 root  wheel  684660 Feb 27 07:27 /usr/pkg/bin/gpg*
uriel:~% gpg --version
gpg (GnuPG) 1.2.1
Copyright (C) 2002 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA, ELG
Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH
Hash: MD5, SHA1, RIPEMD160, TIGER192
Compress: Uncompressed, ZIP, ZLIB

I believe that this warning started popping up without any change in
gpg's version. It's *possible* that it coincided with my upgrading
that system from NetBSD 1.5.3_ALPHA to 1.6.1_RC2. So perhaps
relinking gpg would be enough?

Is it *possible* to get the insecure memory warning not because your
gpg binary lacks the suid bit but because the syscall mappings for
locking memory have changed? (Seems logical, but not the kind of
interface you go changing regularly... you know, unless you're Linux;
and certainly seems like the kind of thing I'd have heard about
since I *do* follow NetBSD mailing lists somewhat regularly.)

If so, shouldn't there be a more descriptive error message? (I'd
count "ioctl <foo> failed" as more descriptive, but maybe the
average user wouldn't.)

But if that were the case, shouldn't I *always* get this warning,
rather than just out of cron? On the command line:

uriel:~% gpg --check-trustdb
gpg: checking at depth 0 signed=3D49 ot(-/q/n/m/f/u)=3D0/0/0/0/0/1
gpg: checking at depth 1 signed=3D82 ot(-/q/n/m/f/u)=3D0/0/0/19/30/0
gpg: checking at depth 2 signed=3D286 ot(-/q/n/m/f/u)=3D1/0/0/69/5/0
gpg: checking at depth 3 signed=3D178 ot(-/q/n/m/f/u)=3D1/74/0/21/0/0
gpg: next trustdb check due at 2003-04-16

So perhaps NetBSD went and broke using suid binaries out of cron?
Doesn't seem reasonable... I could understand if I were doing an
exec, since then it would be the same memory space whose privelege
was re-elevated to uid 0, but that isn't what's going on here,
unless I'm completely missing how euids and saved uids work...

Is this phenomenon something that's been reported before? Should
I go barking up the NetBSD code review tree?

--=20
gabriel rosenkoetter
gr@eclipsed.net

--cmJC7u66zC7hs+87
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (NetBSD)

iD8DBQE+jJHG9ehacAz5CRoRAqanAJ9fCYkUNIJD+tnJ9wnJWjwFf4ZY0QCgmDgD
oXLbowhxAQemRyRRtYzzhpg=
=Ya3j
-----END PGP SIGNATURE-----

--cmJC7u66zC7hs+87--