grsecurity forums

I was trying latest grsecurity + 2.4.18 kernel + security patch
and mysql wont start.
This is what i have in my logs from mysql.

020308 15:28:01 mysqld started
020308 15:28:04 Can't create interrupt-thread (error 11, errno: 4)
020308 15:28:04 mysqld ended
020308 15:28:04 mysqld ended

no problems here, mysqld 3.23.44 + kernel 2.4.18-grsec-1.9.4 + secfix + acl system enabled

What messages show up in your system logs when this occurs?
Also, what is your ACL setup?

Michael

mysql also works fine for me..

i have the same problem as ZEX (with the latest grsecurity and 2.4.18 kernel and security patch)

mysqld.log

020322 12:51:09 mysqld started
020322 12:51:10 Can't create interrupt-thread (error 11, errno: 4)
020322 12:51:10 mysqld ended

messages logfile

localhost kernel: grsec: Attempted loading of shellcode via mmap by (mysqld:10893) UID(100) EUID(100), parent (mysqld:12015) UID(100) EUID(100)
localhost kernel: grsec: more attempted mmaps, logging disabled for 30 seconds

i hope someone can solve this problem.

disable the mmap restrictions in the buffer overflow protection section. I'll have to rethink how I do that option so it doesn't break any applications.

if you could strace mysql for me and just give me the last line where it does the mmap() it would be useful for writing a new version of the mmap restrictions.

just thought that alternatively, you could disable pax on just that binary. Perhaps adding another filesystem flag for this feature might be necessary.

ok we have a fix for your problem that will be in grsecurity 1.9.5. I'm going to start doing developer releases (really just consider them stable releases in shorter time periods, since I run them successfully on my own system) so when that's done, you can just download that. If you'd like to fix it now, do the following:

in /usr/src/linux/mm/mmap.c

find the line:

#ifdef CONFIG_GRKERNSEC_MMAPFIXED

the second and 3rd lines after that should be removed. one is a security alert and the other is an error return. Replace those two lines with the following:

prot &= ~PROT_EXEC;
vm_flags &= ~VM_MAYEXEC;

Thank you very much for the great and fast support after the change my problem is solved.