{"action":"created","issue":{"url":"https://api.github.com/repos/mcafee/mysql-audit/issues/150","repository_url":"https://api.github.com/repos/mcafee/mysql-audit","labels_url":"https://api.github.com/repos/mcafee/mysql-audit/issues/150/labels{/name}","comments_url":"https://api.github.com/repos/mcafee/mysql-audit/issues/150/comments","events_url":"https://api.github.com/repos/mcafee/mysql-audit/issues/150/events","html_url":"https://github.com/mcafee/mysql-audit/issues/150","id":191515583,"number":150,"title":"Plugin loads but aborts with \"unable to mmap memory size: 4096, errno: 12\"","user":{"login":"RickPizzi","id":3847526,"avatar_url":"https://avatars.githubusercontent.com/u/3847526?v=3","gravatar_id":"","url":"https://api.github.com/users/RickPizzi","html_url":"https://github.com/RickPizzi","followers_url":"https://api.github.com/users/RickPizzi/followers","following_url":"https://api.github.com/users/RickPizzi/following{/other_user}","gists_url":"https://api.github.com/users/RickPizzi/gists{/gist_id}","starred_url":"https://api.github.com/users/RickPizzi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RickPizzi/subscriptions","organizations_url":"https://api.github.com/users/RickPizzi/orgs","repos_url":"https://api.github.com/users/RickPizzi/repos","events_url":"https://api.github.com/users/RickPizzi/events{/privacy}","received_events_url":"https://api.github.com/users/RickPizzi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-11-24T13:04:29Z","updated_at":"2016-11-24T15:06:37Z","closed_at":null,"body":"I have been trying to upgrade our plugin from 1.0.9 to 1.1.0 because of that bug that we raised and which is fixed in this version. Unfortunately, the 1.1.0 aborts right after loading with the above error.  Previous version works just fine.  This does not happen on all servers though....\r\n\r\n```\r\nServer version:\t\t5.6.29-76.2-log Percona Server (GPL), Release 76.2, Revision ddf26fe\r\n\r\nplugin-load=AUDIT=libaudit_plugin.so\r\naudit_offsets=7704, 7760, 4392, 5032, 88, 2720, 96, 0, 32, 104, 152, 7880\r\naudit_json_file=ON\r\naudit_json_log_file=/db/log/audit.log\r\naudit_record_objs=\"<redacted>\"\r\naudit_record_cmds=\"select\"\r\naudit_force_record_logins=ON\r\naudit_whitelist_users=\"<redacted>,{}\"\r\n```\r\n\r\nMachine where this does not work (phisycal)\r\n\r\nCentOS 6.7\r\nLinux redacted 2.6.32-573.18.1.el6.x86_64 #1 SMP Tue Feb 9 22:46:17 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\nMachine where the plugin runs fine (virtual, AWS):\r\n\r\nCentOS 6-7\r\nLinux redacted 2.6.32-573.8.1.el6.centos.plus.x86_64 #1 SMP Tue Nov 10 18:20:27 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux\r\n\r\n\r\nPlease let me know if more information is needed.\r\n\r\nThanks\r\n\r\nRick"},"comment":{"url":"https://api.github.com/repos/mcafee/mysql-audit/issues/comments/262796281","html_url":"https://github.com/mcafee/mysql-audit/issues/150#issuecomment-262796281","issue_url":"https://api.github.com/repos/mcafee/mysql-audit/issues/150","id":262796281,"user":{"login":"aharonrobbins","id":10813117,"avatar_url":"https://avatars.githubusercontent.com/u/10813117?v=3","gravatar_id":"","url":"https://api.github.com/users/aharonrobbins","html_url":"https://github.com/aharonrobbins","followers_url":"https://api.github.com/users/aharonrobbins/followers","following_url":"https://api.github.com/users/aharonrobbins/following{/other_user}","gists_url":"https://api.github.com/users/aharonrobbins/gists{/gist_id}","starred_url":"https://api.github.com/users/aharonrobbins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aharonrobbins/subscriptions","organizations_url":"https://api.github.com/users/aharonrobbins/orgs","repos_url":"https://api.github.com/users/aharonrobbins/repos","events_url":"https://api.github.com/users/aharonrobbins/events{/privacy}","received_events_url":"https://api.github.com/users/aharonrobbins/received_events","type":"User","site_admin":false},"created_at":"2016-11-24T15:06:37Z","updated_at":"2016-11-24T15:06:37Z","body":"You’re compiling from git?\r\n\r\n\r\nAharon Robbins\r\nSoftware Engineer\r\nDatabase Security\r\nIntel Security\r\n\r\n\r\n2 HaNagar Street\r\nKfar Saba 44425\r\nISRAEL\r\n\r\nDirect: +972 2 589 2545\r\nMobile: +972 54 788 6586\r\nWeb: www.mcafee.com<http://www.intelsecurity.com/>\r\n\r\nThe information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.\r\n\r\n\r\nFrom: Rick Pizzi [mailto:notifications@github.com]\r\nSent: Thursday, November 24, 2016 17:04\r\nTo: mcafee/mysql-audit <mysql-audit@noreply.github.com>\r\nCc: Robbins, Aharon <aharon.robbins@intel.com>; Comment <comment@noreply.github.com>\r\nSubject: Re: [mcafee/mysql-audit] Plugin loads but aborts with \"unable to mmap memory size: 4096, errno: 12\" (#150)\r\n\r\nI compiled the plugin but at runtime it refuses to load with following error:\r\n\r\nERROR 1126 (HY000): Can't open shared library '/usr/lib64/mysql/plugin/libaudit_plugin.so' (errno: 13 /usr/lib64/mysql/plugin/libaudit_plugin.so: undefined symbol: thd_alloc_service)\r\n\r\nError #13 is EPERM… that is very strange….. this symbol should be in MySQL I believe? I compiled against MySQL 5.6.33 …\r\n\r\nRick\r\n—\r\nRiccardo Pizzi\r\npizzi@leopardus.com<mailto:pizzi@leopardus.com>\r\nhttp://www.vecchiflipper.it\r\nhttp://www.pinballowners.com/webmaster\r\n\r\nOn 24 Nov 2016, at 15:54, aharonrobbins <notifications@github.com<mailto:notifications@github.com>> wrote:\r\n\r\n> I would add some kind of log to double check that MAP_32BIT is being used. And like I suggested, try not setting the use_static_memory to false.\r\n>\r\n> I don’t know why mmap is failing when run from inside MySQL. I am somewhat stumped. I want to consult with the original author of the plugin to see if he has any ideas, but that will be next week.\r\n>\r\n> Thanks,\r\n>\r\n> Aharon\r\n>\r\n>\r\n> Aharon Robbins\r\n> Software Engineer\r\n> Database Security\r\n> Intel Security\r\n>\r\n>\r\n> 2 HaNagar Street\r\n> Kfar Saba 44425\r\n> ISRAEL\r\n>\r\n> Direct: +972 2 589 2545\r\n> Mobile: +972 54 788 6586\r\n> Web: www.mcafee.com<http://www.intelsecurity.com/<http://www.mcafee.com%3chttp:/www.intelsecurity.com/>>\r\n>\r\n> The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any review, dissemination, distribution or copying is strictly prohibited. If you have received this email message in error, please notify the sender by reply email and delete the message and any attachments.\r\n>\r\n>\r\n> From: Rick Pizzi [mailto:notifications@github.com]\r\n> Sent: Thursday, November 24, 2016 16:50\r\n> To: mcafee/mysql-audit <mysql-audit@noreply.github.com<mailto:mysql-audit@noreply.github.com>>\r\n> Cc: Robbins, Aharon <aharon.robbins@intel.com<mailto:aharon.robbins@intel.com>>; Comment <comment@noreply.github.com<mailto:comment@noreply.github.com>>\r\n> Subject: Re: [mcafee/mysql-audit] Plugin loads but aborts with \"unable to mmap memory size: 4096, errno: 12\" (#150)\r\n>\r\n>\r\n> I have tried to run the snippet alone:\r\n>\r\n> #include <stdio.h>\r\n>\r\n> #include <unistd.h>\r\n>\r\n> #include <sys/mman.h>\r\n>\r\n>\r\n>\r\n> int main()\r\n>\r\n> {\r\n>\r\n> int mmap_flags = MAP_PRIVATE|MAP_ANONYMOUS;\r\n>\r\n> const unsigned long page_size = sysconf(_SC_PAGESIZE);\r\n>\r\n>\r\n>\r\n> if (mmap(NULL, page_size, PROT_READ|PROT_EXEC, mmap_flags, -1, 0) == NULL)\r\n>\r\n> perror(\"mmap\");\r\n>\r\n> }\r\n>\r\n> This one works fine.\r\n> So, why is it failing in the plugin?\r\n>\r\n> Please note, we are loading the plugin at runtime (we cannot stop this server). May the problem be related?\r\n>\r\n> Also, I had to replace your call to GETPAGESIZE() with the sysconf equivalent, but don't think that this changes anything, pagesize is 4k and it is reported by the abort error message...\r\n>\r\n> —\r\n> You are receiving this because you commented.\r\n> Reply to this email directly, view it on GitHub<https://github.com/mcafee/mysql-audit/issues/150#issuecomment-262793016>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vdUzHLlooEQhW7BpklD66ThpRFkfks5rBaQigaJpZM4K7oY4>.\r\n> —\r\n> You are receiving this because you authored the thread.\r\n> Reply to this email directly, view it on GitHub, or mute the thread.\r\n>\r\n\r\n\r\n\r\n—\r\nYou are receiving this because you commented.\r\nReply to this email directly, view it on GitHub<https://github.com/mcafee/mysql-audit/issues/150#issuecomment-262795752>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKT-vfLKbdOGZGqWKtB2mbByGLOKnMw9ks5rBadsgaJpZM4K7oY4>.\r\n"}}
{"actor":{"display_login":"aharonrobbins"}}