grsecurity forums

Hello,

I tried to compile new kernel-3.2.45 with grsecurity-2.9.1-3.2.45-201305251007 patch on Mandriva 2011/Fedora 15.
After make i receive an error:

Makefile:619: *** Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.. Stop.

On both OSes I have RPM gcc-plugin-devel-4.6.x- installed. Could you tell me there is a bug in bad package detection?
GCC compiled with --enable-plugin:

Code: Select all

Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib64/gcc/x86_64-mandriva-linux-gnu/4.6.1/lto-wrapper
Target: x86_64-mandriva-linux-gnu
Configured with: ./configure --build=x86_64-mandriva-linux-gnu --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/lib64 --localstatedir=/var --sharedstatedir=/usr/com --mandir=/usr/share/man --infodir=/usr/share/info --x-includes=/usr/include --x-libraries=/usr/lib64 --disable-libjava-multilib --with-java-home=/usr/lib/jvm/java-rpmbuild --with-ecj-jar=/usr/share/java/eclipse-ecj.jar --enable-java-awt=gtk --enable-gtk-cairo --with-cloog --with-ppl --enable-cloog-backend=ppl --disable-libssp --disable-libunwind-exceptions --disable-werror --enable-__cxa_atexit --enable-bootstrap --enable-checking=release --enable-gnu-unique-object --enable-languages=c,ada,c++,fortran,go,java,lto,objc,obj-c++ --enable-linker-build-id --enable-plugin --enable-shared --enable-threads=posix --with-system-zlib --with-bugurl=https://qa.mandriva.com/ --with-tune=generic --with-arch_32=i686 --host=x86_64-mandriva-linux-gnu --target=x86_64-mandriva-linux-gnu
Thread model: posix
gcc version 4.6.1 20110627 (Mandriva) (GCC)


Could you fix it?

Regards,
Tom

what does gcc -print-file-name=plugin say on your systems? also can you execute the following in a shell and tell me results:

Code: Select all

gcc -E -shared - -o /dev/null -I`gcc -print-file-name=plugin`/include 2>&1 <<EOF
#include "gcc-plugin.h"
#include "tree.h"
#include "tm.h"
#include "rtl.h"
#ifdef ENABLE_BUILD_WITH_CXX
#warning g++
#else
#warning gcc
#endif
EOF


Executed code returned a warning:

Code: Select all

<stdin>:8:2: warning: #warning gcc [-Wcpp]

Regards,
Tom

ok, so your default gcc (whichever version it is, would have been nice to answer the first question as well ) should work with plugins so i can only image that for kernel compilation you used a different version. can you check that your kernel build system (probably some distro specific way) uses this default gcc and not some hardcoded gcc version that is not plugin capable or lacks the gcc plugin headers at least? look for CC=... on the make command line for example, that'd be a sure sign that your kernel build system has its own mind about which gcc to use.

I am sorry for the missed answer. I thought that is one question

gcc -print-file-name=plugin wrote:

Code: Select all

/usr/lib64/gcc/x86_64-mandriva-linux-gnu/4.6.1/plugin

I have only one (gcc-4.6.1-3.3.x86_64) installed on the system.

Code: Select all

rpm -aq |grep gcc
lib64gcc1-4.6.1-3.3.x86_64
gcc-cpp-4.6.1-3.3.x86_64
gcc-4.6.1-3.3.x86_64
gcc-c++-4.6.1-3.3.x86_64
gcc-plugin-devel-4.6.1-3.3.x86_64


Are you quite sure that gcc-plugin-devel detection works correct on RPM-based OSes?

Regards,
Tom

the previous script basically simulated what the kernel build system does but you can try this by hand as well: bash ./scripts/gcc-plugin.sh gcc g++ gcc and see if it prints gcc or not (if you used a newer gcc then it'd print g++). now if this works then it could fail only if any/some of CC/HOSTCC/HOSTCXX are somehow improperly set by your kernel build system. if the script doesn't work then we'll have something to debug (try the command with bash -x then).

Result of these command below:

Code: Select all

bash ./scripts/gcc-plugin.sh gcc g++ gcc
gcc


Code: Select all

bash -x ./scripts/gcc-plugin.sh gcc g++ gcc
+++ gcc -print-file-name=plugin
++ gcc -E -shared - -o /dev/null -I/usr/lib64/gcc/x86_64-mandriva-linux-gnu/4.6.1/plugin/include
+ plugincc='<stdin>:8:2: warning: #warning gcc [-Wcpp]'
+ '[' 0 -eq 0 ']'
+ [[ <stdin>:8:2: warning: #warning gcc [-Wcpp] =~ gcc ]]
+ echo gcc
gcc
+ [[ <stdin>:8:2: warning: #warning gcc [-Wcpp] =~ g\+\+ ]]


Any sugestions?

Regards,
Tom

can you add $(Q)echo PLUGINCC:$(PLUGINCC) to the main Makefile around where the "warning, your gcc installation does not support plugins" error message is printed?
edit: actually you might as well print out HOSTCC/etc.

Weird thing.. I removed kernel source, make fresh setup with grsec patch and.. an error disappeared.
I will test a bit deeper..

Thank you for now. I am sorry for bothering you. Seems that problem has solved by self

Regards,
Tom

Same thing is happening to me, what do you mean remove kernel source kanadaa?

i'm not shy to admit this

apt-get install build-essential

fixed this issue for me

jlambrecht wrote:i'm not shy to admit this

apt-get install build-essential

fixed this issue for me

And for me, too! Thank you, Mr./Ms. Jlambrecht! You saved the day!

I ran into the same problem with the missing gcc-plugin-dev (several times in fact, but I waited until the build-essential would switch to gcc-5).

First I ran "apt-get install build-essential gcc-5-plugin-dev". I removed the 4.9 versions of gcc and the gcc-4.9-plugin-dev (Debian sid).
I installed a new kernel (with grsecurity-3.1-4.1.3-201508011613.patch).

After reading this thread I changed the Makefile:

Code: Select all

--- ~/Makefile    2015-08-03 20:59:17.432365867 +0200
+++ linux/Makefile      2015-08-03 20:56:38.993088990 +0200
@@ -681,6 +681,7 @@
 endif
 else
 gcc-plugins:
+ $(Q)echo PLUGINCC:$(PLUGINCC)
 ifeq ($(call cc-ifversion, -ge, 0405, y), y)
        $(error Your gcc installation does not support plugins.  If the necessary headers for plugin support are missing, they should be installed.  On Debian, apt-get install gcc-<ver>-plugin-dev.  If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
 else


I was thinking the echo command would provide some debug information, but with my configuration the kernel was build (first time with gcc-5.2).

Was this how this line was supposed to work?
I am a bit confused now.

i must be missing something here but if you can compile a kernel then what problem are you trying to debug exactly?

To followup to my last message:
The new kernel (gcc-5.2 instead of gcc-4.9) is at least 100kB smaller, but does not start.
(No logentries.)

In answer to the question of PAX team:

$ make bzImage modules
scripts/kconfig/conf --silentoldconfig Kconfig
Makefile:685: *** Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.. Stop.

$ dpkg -l|grep gcc
ii gcc 4:5.2.1-3 amd64 GNU C compiler
ii gcc-5 5.2.1-14 amd64 GNU C compiler
ii gcc-5-base:amd64 5.2.1-14 amd64 GCC, the GNU Compiler Collection (base package)
ii gcc-5-plugin-dev 5.2.1-14 amd64 Files for GNU GCC plugin development.

In short I can't build a (working) kernel with gcc-5.2 instead of gcc-4.9 (Debian).