tar 1.29 hangs, when run with strace, it exits with "illegal instruction"

[Brian Inglis]

On 2019-08-09 13:13, Keith Christian wrote:
> On Wed, Aug 7, 2019 at 9:33 PM Brian Inglis wrote:
>> On 2019-08-07 12:20, Keith Christian wrote:
>>> I am able to run "tar ft somefile.tar" successfully on a Linux
>>> machine, same tar version (1.29.)
>>>
>>> This version hangs up the terminal, does not respond to Ctrl-C or
>>> Ctrl-Z, and terminates with an illegal instruction to the screen, not
>>> reflected in the strace output.
>>>
>>> File cygwin_tar_1_29_illegal_instruction.txt is attached with strace
>>> output, version, and "cygcheck tar" output.
>>
>> Works just fine for me:
>>
>> $ tar ft Downloads/nam.dist.tar
>> README
>> demo/
>> ...
>>
>> You may have some http://www.cygwin.com/acronyms/#BLODA interfering like an AV.
>> The strace shows tar fails in sysfer.dll, which is part of Symantec Endpoint
>> Protection CMC Firewall Application and Device Control, badly written from the
>> number of complaints about it, and as usual with these control and monitoring
>> products, they greatly slow down systems and interfere with work.
>> Deinstall SEP or bypass your cygwin directories.
> Cygwin is on a corporate machine so disabling anything will not be
> easy or allowed.  Can you explain "bypass cygwin directories?"
>
> Cygwin's tar worked recently so must be an "enhancement" in the
> security software or some change in tar that is frowned upon.  I see
> no evidence of Symantec Endpoint software, must be different AV
> software.

Change the AV settings to ignore the file types or directories that cause issues.

SEP includes sysfer.dll, but you may not see much evidence of the product in a
centralized corporate control and monitoring environment, designed solely to
monitor everything and prevent any threat.

The problem is SEP sysfer.dll has a bug which executes an illegal instruction,
probably by calling a method via a bad pointer, incorrectly set up or clobbered
earlier by the AV, while interfering with tar's operation.

The difference may be in what the tar file contains.
A lot of Windows products block file types rather than file contents.

Untarring, renaming (as ...#.dat), and retarring under Linux (with the old and
new names in a manifest or a script to rename back) can often bypass dumb checks.

Some of their "advanced", "smart", or "AI" products or features attempt blocks
if certain data contents are seen or calls are made as they are considered
problematic and characteristic of malware: of course, most are false positives!

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple