public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
From: Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>
To: cygwin@cygwin.com
Subject: Re: tar 1.29 hangs, when run with strace, it exits with "illegal instruction"
Date: Fri, 09 Aug 2019 20:42:00 -0000	[thread overview]
Message-ID: <632325ad-e043-1a1d-23c1-6c24d6456c5f@SystematicSw.ab.ca> (raw)
In-Reply-To: <CAFWoy7EhSPDa4_g0y2CHNQWN-5vQaXhdA4BNcy7gy1Ni=APfwQ@mail.gmail.com>

On 2019-08-09 13:13, Keith Christian wrote:
> On Wed, Aug 7, 2019 at 9:33 PM Brian Inglis wrote:
>> On 2019-08-07 12:20, Keith Christian wrote:
>>> I am able to run "tar ft somefile.tar" successfully on a Linux
>>> machine, same tar version (1.29.)
>>>
>>> This version hangs up the terminal, does not respond to Ctrl-C or
>>> Ctrl-Z, and terminates with an illegal instruction to the screen, not
>>> reflected in the strace output.
>>>
>>> File cygwin_tar_1_29_illegal_instruction.txt is attached with strace
>>> output, version, and "cygcheck tar" output.
>>
>> Works just fine for me:
>>
>> $ tar ft Downloads/nam.dist.tar
>> README
>> demo/
>> ...
>>
>> You may have some http://www.cygwin.com/acronyms/#BLODA interfering like an AV.
>> The strace shows tar fails in sysfer.dll, which is part of Symantec Endpoint
>> Protection CMC Firewall Application and Device Control, badly written from the
>> number of complaints about it, and as usual with these control and monitoring
>> products, they greatly slow down systems and interfere with work.
>> Deinstall SEP or bypass your cygwin directories.
> Cygwin is on a corporate machine so disabling anything will not be
> easy or allowed.  Can you explain "bypass cygwin directories?"
>
> Cygwin's tar worked recently so must be an "enhancement" in the
> security software or some change in tar that is frowned upon.  I see
> no evidence of Symantec Endpoint software, must be different AV
> software.

Change the AV settings to ignore the file types or directories that cause issues.

SEP includes sysfer.dll, but you may not see much evidence of the product in a
centralized corporate control and monitoring environment, designed solely to
monitor everything and prevent any threat.

The problem is SEP sysfer.dll has a bug which executes an illegal instruction,
probably by calling a method via a bad pointer, incorrectly set up or clobbered
earlier by the AV, while interfering with tar's operation.

The difference may be in what the tar file contains.
A lot of Windows products block file types rather than file contents.

Untarring, renaming (as ...#.dat), and retarring under Linux (with the old and
new names in a manifest or a script to rename back) can often bypass dumb checks.

Some of their "advanced", "smart", or "AI" products or features attempt blocks
if certain data contents are seen or calls are made as they are considered
problematic and characteristic of malware: of course, most are false positives!

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

      reply	other threads:[~2019-08-09 20:42 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-07 18:21 Keith Christian
2019-08-08  3:33 ` Brian Inglis
2019-08-09 19:13   ` Keith Christian
2019-08-09 20:42     ` Brian Inglis [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=632325ad-e043-1a1d-23c1-6c24d6456c5f@SystematicSw.ab.ca \
    --to=brian.inglis@systematicsw.ab.ca \
    --cc=cygwin@cygwin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).