Bug 775 - Faulting application name: unbound-anchor.exe
Faulting application name: unbound-anchor.exe
Status: RESOLVED FIXED
Product: unbound
Classification: Unclassified
Component: server
1.5.9
x86_64 Windows
: P5 critical
Assigned To: unbound team
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-06-10 00:31 CEST by drahnier
Modified: 2016-06-14 14:18 CEST (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description drahnier 2016-06-10 00:31:24 CEST
Log Name:      Application
Source:        Application Error
Date:          06/10/16 05:12:13
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DD-608G12
Description:
Faulting application name: unbound-anchor.exe, version: 1.5.9.0, time stamp: 0x00000000
Faulting module name: unbound-anchor.exe, version: 1.5.9.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000ecf8
Faulting process id: 0xd20
Faulting application start time: 0x01d1c29bf8a94a43
Faulting application path: C:\Program Files\Unbound\unbound-anchor.exe
Faulting module path: C:\Program Files\Unbound\unbound-anchor.exe
Report Id: 18d2ab06-fbec-4223-b013-8895e02e4f46
Faulting package full name: 
Faulting package-relative application ID: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-06-09T22:12:13.755835900Z" />
    <EventRecordID>9042</EventRecordID>
    <Channel>Application</Channel>
    <Computer>DD-608G12</Computer>
    <Security />
  </System>
  <EventData>
    <Data>unbound-anchor.exe</Data>
    <Data>1.5.9.0</Data>
    <Data>00000000</Data>
    <Data>unbound-anchor.exe</Data>
    <Data>1.5.9.0</Data>
    <Data>00000000</Data>
    <Data>c0000005</Data>
    <Data>0000ecf8</Data>
    <Data>d20</Data>
    <Data>01d1c29bf8a94a43</Data>
    <Data>C:\Program Files\Unbound\unbound-anchor.exe</Data>
    <Data>C:\Program Files\Unbound\unbound-anchor.exe</Data>
    <Data>18d2ab06-fbec-4223-b013-8895e02e4f46</Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>
Comment 1 Wouter Wijngaards 2016-06-10 01:26:22 CEST
Hi Drahnier,

I am not sure what causes the failure.  Any chance of running it in a debugger (gdb.exe, msvc debugger) for a stack backtrace?

1.5.8 did not have this failure, so it must have been a change in the 1.5.9 changelist.  But I am not sure which one.

Best regards, Wouter
Comment 2 Wouter Wijngaards 2016-06-14 09:35:58 CEST
Hi Drahnier,

These binaries, I think, contain fixes to the problem:
http://www.nlnetlabs.nl/~wouter/unbound_setup_1.5.10rc63.exe
http://www.nlnetlabs.nl/~wouter/unbound-1.5.10rc63.zip

Does this work for you?

Best regards, Wouter
Comment 3 drahnier 2016-06-14 13:59:02 CEST
(In reply to Wouter Wijngaards from comment #2)
> Hi Drahnier,
> 
> These binaries, I think, contain fixes to the problem:
> http://www.nlnetlabs.nl/~wouter/unbound_setup_1.5.10rc63.exe
> http://www.nlnetlabs.nl/~wouter/unbound-1.5.10rc63.zip
> 
> Does this work for you?
> 
> Best regards, Wouter


Did a "unbound_setup_1.5.10rc63.exe" on top of current install (version 1.5.9), followed by a reboot. 

Everything seems to be working nicely: Unbound service is running with "network service" credentials, and so far no application errors for "unbound-anchor.exe" have been logged.

Is unbound running with "network service" credential intended behavior? Or is this a "carry-over" effect from my running a "icacls "C:\Program Files\unbound" /grant "NT Authority\NetworkService:(CI)(OI)M" in an attempt to run version 1.5.9 to with "network service" credentials sucesfully?
Comment 4 Wouter Wijngaards 2016-06-14 14:02:22 CEST
Hi Drahnier,

It is running with localsystem privileges in that install.  Good that this bug is fixed.

Not sure how to set up a correct operating environment for the networkuser level from the setup.exe.

Best regards, Wouter
Comment 5 drahnier 2016-06-14 14:18:21 CEST
(In reply to Wouter Wijngaards from comment #4)
> Hi Drahnier,
> 
> It is running with localsystem privileges in that install.  Good that this
> bug is fixed.
> 
> Not sure how to set up a correct operating environment for the networkuser
> level from the setup.exe.
> 
> Best regards, Wouter

So, this is essentially a move backwards: Version 1.5.9 attempted to introduce running unbound as a network service; that failed; version 1.5.10 will revert to running unbound as a localsystem service. 

Wouldn't it be worth to add a release note that unbound can be run as a network service after applying an appropriate permission-fixing icacls command. Wouldn't be running unbound as a network service potentially more save (as less privileges are associated with network service than with localsystem)?