Re: [cobalt-users] "modprobe.."

[flash22@xxxxxxx]

On Fri, 16 Feb 2001, Jonathan Nichols wrote:

> "modprobe: can't locate module binfmt-0000"
> 
> What on Earth does that mean? I know it means it can't find the 
> module called "binfmt-0000" but.. I've never heard of that module.
> 
> Anybody seen that before? I found a few things on Google, one of 
> which indicated that the machine might not reboot properly because of 
> this. "locate binfmt" shows a few things in /usr/src/linux-2.2.14C11/ 
> but none of them called binfmt-0000 :(

No, you aren't going nutz ;) there is no binfmt-0000 module, this is in
fact a side effect of a (old) kernel bug. (2.0.34 has it) 
The code that locates the
appropriate module to use to run a binary isn't checking some of the
possible errors and thinks it found the right module in a few cases where
it in fact failed , so it's passing a request to modprobe to load a
binfmt module with no name (which gets mapped to 0000)

Specificlly, running out of memory at the exact instant that you start a
program can do this, as can certain chained errors such as haveing a shell
script (which uses this code also) point to a corrupt shell.
(This error was most often seen on boot trying to load stuff before swap
was enabled)

Note also that the kernel retries load requests once, you it's possible to
get this error logged when a program actually started successfully (on the
second try) Transient out of memory issues can do this...

In certain rare cases corrupt binary files with the right magic numbers
but absurd resource requirments can do this also,(eg the binary requests
more memory that rlimit to load) last but not least, and
possibly important, some of the parameters used by the exec loader are
settable via sysctl() , there is a known exploit for sysctl, but it's hard
to actually make it work, and if someone tried it on an old machine it may
corrupt the kernel tables used to load interpreters associated with
scripts. (without doing anything much else)

Oh, yeah, one last unlikely thing, you can in fact define your own binary
formats, it is possible to define ones with no name which will cause this
error even on new kernels ...

I have no idea if that helps ;)

gsh