when come 2.6.21.1?

[linkfanel]

ld fails with the last grsecurity-2.1.10-2.6.21-200705041939.patch:

Code: Select all

  LD      vmlinux
ld: vmlinux: section `.init.text' can't be allocated in segment 0
ld: final link failed: Bad value
make[1]: *** [vmlinux] Erreur 1


This happens only with PaX enabled.

[PaX Team]

ld fails with the last grsecurity-2.1.10-2.6.21-200705041939.patch:

Code: Select all

  LD      vmlinux
ld: vmlinux: section `.init.text' can't be allocated in segment 0
ld: final link failed: Bad value
make[1]: *** [vmlinux] Erreur 1


This happens only with PaX enabled.

what's the ld version? if you're not at 2.17 already, you should try that at least.

[linkfanel]

what's the ld version? if you're not at 2.17 already, you should try that at least.

It is debian sid's ld: GNU ld (GNU Binutils for Debian) 2.17.50.20070426

[PaX Team]

It is debian sid's ld: GNU ld (GNU Binutils for Debian) 2.17.50.20070426

can you try to flip KERNEXEC in your .config and see if it works then?

[linkfanel]

Well spotted, it works fine when KERNEXEC is disabled.

[Ironwalker]

Sorry to be a nuciance,but,where exactly is the "KERNEXEC" option in config?
Which config exactly?

I searched .config for kernel (/usr/src/linux) and nothing....I searched /usr/src/grsecurity/kconfig and found a pax entry for KERNEXEC;

select PAX_KERNEXEC if (!X86_64 && !MODULES && !HOTPLUG_PCI_COMPAQ_NVRAM && !PCI_BIOS)

So am I being spectacularly naive here or is this the option in which case how do I turn it off ? Sometimes,I think so much and figure out the hard and intricate but totally miss the obvious right in front of my eyes.


By the way,previously I fixed the hostname thing and then the error saying grsec has no version numbers? Fixed this too and am installed.


The test kernel I am building gives me the error above but do not see where to change or turn off select KERNEXEC ,

Thanks in advance

[PaX Team]

Sorry to be a nuciance,but,where exactly is the "KERNEXEC" option in config?
Which config exactly?

it's under PaX options/Non-executable pages/Enforce non-executable kernel pages

select PAX_KERNEXEC if (!X86_64 && !MODULES && !HOTPLUG_PCI_COMPAQ_NVRAM && !PCI_BIOS)

So am I being spectacularly naive here or is this the option in which case how do I turn it off ? Sometimes,I think so much and figure out the hard and intricate but totally miss the obvious right in front of my eyes.

all those !options mean that you must disable them if you want to use KERNEXEC. i'm guessing that it's a 2.4 kernel so you have to disable modules and chose direct PCI access at least.

The test kernel I am building gives me the error above but do not see where to change or turn off select KERNEXEC

which error? the linker failure? i don't know what causes it yet, but i know that ld 2.17 links any kernel fine, with or without KERNEXEC. also, if you can't even select KERNEXEC in your config, how can it cause any problem?

[linkfanel]

For your information, I rebuild my binutils, roughly reverting this, and now it links and runs fine.

[Ironwalker]

Thanks guys,all good.

[Ironwalker]

Thanks guys,all good.

[specs]

Sorry to bother, but...
I got an "section `.init.text' can't be allocated in segment 0" error during compilation. As mentioned in the thread I turned of KERNEEXEC and ran "make oldconfig". The resulting config was something like:
#
# PaX
#
CONFIG_PAX=y

#
# PaX Control
#
CONFIG_PAX_SOFTMODE=y
# CONFIG_PAX_EI_PAX is not set
CONFIG_PAX_PT_PAX_FLAGS=y
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set

#
# Non-executable pages
#
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_SEGMEXEC=y
# CONFIG_PAX_DEFAULT_PAGEEXEC is not set
CONFIG_PAX_DEFAULT_SEGMEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
CONFIG_PAX_NOELFRELOCS=y
# CONFIG_PAX_KERNEXEC is not set

#
# Address Space Layout Randomization
#
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y

#
# Miscellaneous hardening features
#
CONFIG_PAX_MEMORY_SANITIZE=y
CONFIG_PAX_MEMORY_UDEREF=y
# CONFIG_KEYS is not set
# CONFIG_SECURITY is not set

It resulting in a compiling kernel. On boot init got killed recusively.
No screendump since the kernel won't boot far enough.

But for some problems with one binary with /dev/ports access I might have tightened the whole grsec and pax setting, but right now I want the program to work with as much of the protection of grsecurity as possible. I do realize it is only a weak protection without the major features turned on.

Right now I'm trying to get a kernel to compile which will boot.
Perhaps I should try to patch pax to the latest test-patch after patching in the grsec-patch.

Kernel version 2.6.21.6 with grsecurity-2.1.10-2.6.21.5-200706182032.patch.
GNU ld (GNU Binutils for Debian) 2.17.50.20070718

[specs]

A little more on the messages:

Freeing unused kernel memory : 152k freed
Write protecting the kernel read-only data : 274k
Recusive die() failure, output suppressed
Kernel panic - not syncing : Attemped to kill init!
BUG : unable to handle kernel paging request at virtual address c02a701c
printing eip:
c012cc34
*pgd = 345063
*pmd = 345063
*pte = 2a7161

During the bootup it seems the keyboard has some influence on the actual errors produced (the first time the Freeing kernel memory messages had already disappeared from the screen.

Following the above message similar messages appeared with address c02a8078 instead of c02a701c and *pte 2a8161.

Hope this helps.
Pc is an Epia M10000 with C3 Nehemiah and 256MB memory.

[PaX Team]

Kernel panic - not syncing : Attemped to kill init!
BUG : unable to handle kernel paging request at virtual address c02a701c
printing eip:
c012cc34
*pgd = 345063
*pmd = 345063
*pte = 2a7161

if you can reproduce this with the latest PaX test version, try to capture the full oops report (even a digital camera will do) and post it here.