writing to /kmem vs. graphics card bios (XFree86 problem)

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

writing to /kmem vs. graphics card bios (XFree86 problem)

Postby optix » Mon Jan 20, 2003 9:54 pm

Hi all,

well, i am new to grsecurity (and not exactly a linux guru yet :wink: though i'm workin on it), but i've have done my reading, and looked through the forum so i hope my questions arent too obviouse.

i am running Debian Woody, and am trying to get XFree86 running properly, first off, with out the ACLs (though in the end that is my goal). But first things first. My current problem/question is about the CONFIG_GRKERNSEC_KMEM option. Namely when i turn this option (which is "highly recommended") on, i get the following error:
...
(II) Loading sub module "int10"
(II) LoadModule: "int10"
(II) Reloading /usr/X11R6/lib/modules/linux/libint10.a
(EE) SAVAGE(0): Cannot map SYS BIOS
(II) Loading sub module "vbe"
...
in my XFree86.0.log file, after which come more inconsistancies with a normal X starting log, resulting in a signal 11. The error goes away if i do not set the KMEM option and X starts properly.

note:
Actually there is one line that is different in the log produced w/ grsec but without KMEM compared to no grsec at all:
(II) PCI: stages = 0x03, oldVal1 = 0x80008d40, mode1Res1 = 0x80000000 <------ with grsec
(II) PCI: stages = 0x03, oldVal1 = 0x00000000, mode1Res1 = 0x80000000 <------ normal kernel
But i dont think that matters. still i include this info just incase.

so the question is: How, if at all, do i enabled this feature and still use XFree86?

thanks guys

cheers,
optix
optix
 
Posts: 3
Joined: Mon Jan 20, 2003 9:36 pm

Postby spender » Tue Jan 21, 2003 5:34 pm

You can't. Allowing BIOS writes is too dangerous in my opinion. If you want to tighten it down, use the ACL system.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

how do others do it?

Postby optix » Thu Jan 23, 2003 5:11 pm

i dont quite get it.... :o

how do others manage to run X then? does everyone who wants to use X turn that option off or is there a way to have X run with out writing to the graphics card BIOS? :-?
optix
 
Posts: 3
Joined: Mon Jan 20, 2003 9:36 pm

Postby spender » Thu Jan 23, 2003 7:36 pm

I've only heard of reports of it not working with Savage video cards.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Re: how do others do it?

Postby PaX Team » Fri Jan 24, 2003 7:32 am

optix wrote:ihow do others manage to run X then? does everyone who wants to use X turn that option off or is there a way to have X run with out writing to the graphics card BIOS? :-?
strace your X server and see what and how it wants to mmap as the BIOS range then you can add extra code to gr_handle_mem_mmap() to allow it.
PaX Team
 
Posts: 2310
Joined: Mon Mar 18, 2002 4:35 pm

Postby spender » Fri Jan 24, 2003 2:59 pm

still seems rather strange that X wants to write to the video bios. Either it's mmap'd it with PROT_WRITE or it mmap'd it without it, and then tried to write to it, or mprotect it with write.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm


Return to grsecurity support