grsecurity forums

Hey,

iptables 1.2.11 doesn't compile when grsecurity-2.0.3-2.6.10-200501011505.patch is applied to the kernel.

Heiko

cc -O2 -fno-stack-protector -Wall -Wunused -I/data/build/tmp/linux-2.6.10/include -Iinclude/ -DIPTABLES_VERSION=\"1.2.11\" -fPIC -o extensions/libipt_ah_sh.o -c extensions/libipt_ah.c
ld -shared -o extensions/libipt_ah.so extensions/libipt_ah_sh.o
cc -O2 -fno-stack-protector -Wall -Wunused -I/data/build/tmp/linux-2.6.10/include -Iinclude/ -DIPTABLES_VERSION=\"1.2.11\" -fPIC -o extensions/libipt_connlimit_sh.o -c extensions/libipt_connlimit.c
In file included from /data/build/tmp/linux-2.6.10/include/asm/processor.h:18,
from /data/build/tmp/linux-2.6.10/include/asm/atomic.h:6,
from /data/build/tmp/linux-2.6.10/include/linux/netfilter_ipv4/ip_conntrack.h:11,
from extensions/libipt_connlimit.c:9:
/data/build/tmp/linux-2.6.10/include/asm/system.h: In function `__set_64bit_var':
/data/build/tmp/linux-2.6.10/include/asm/system.h:194: warning: dereferencing type-punned pointer will break strict-aliasing rules
/data/build/tmp/linux-2.6.10/include/asm/system.h:194: warning: dereferencing type-punned pointer will break strict-aliasing rules
In file included from /data/build/tmp/linux-2.6.10/include/asm/atomic.h:6,
from /data/build/tmp/linux-2.6.10/include/linux/netfilter_ipv4/ip_conntrack.h:11,
from extensions/libipt_connlimit.c:9:
/data/build/tmp/linux-2.6.10/include/asm/processor.h: In function `load_esp0':
/data/build/tmp/linux-2.6.10/include/asm/processor.h:481: warning: implicit declaration of function `unlikely'
/data/build/tmp/linux-2.6.10/include/asm/processor.h: In function `prefetch':
/data/build/tmp/linux-2.6.10/include/asm/processor.h:647: error: `__KERNEL_TEXT_OFFSET' undeclared (first use in this function)
/data/build/tmp/linux-2.6.10/include/asm/processor.h:647: error: (Each undeclared identifier is reported only once
/data/build/tmp/linux-2.6.10/include/asm/processor.h:647: error: for each function it appears in.)
/data/build/tmp/linux-2.6.10/include/asm/processor.h: In function `prefetchw':
/data/build/tmp/linux-2.6.10/include/asm/processor.h:661: error: `__KERNEL_TEXT_OFFSET' undeclared (first use in this function)
make: *** [extensions/libipt_connlimit_sh.o] Error 1

Oh I almost forgott, here's the relevant parts of the kernel config:

root:/data/build/tmp/linux-2.6.10# grep PAX .config
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
# CONFIG_PAX_EI_PAX is not set
CONFIG_PAX_PT_PAX_FLAGS=y
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_SEGMEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_NOELFRELOCS is not set
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_RANDEXEC=y
CONFIG_PAX_NOVSYSCALL=y

***********************************************************
root:/data/build/tmp/linux-2.6.10# grep GRKERN .config
CONFIG_GRKERNSEC=y
# CONFIG_GRKERNSEC_LOW is not set
# CONFIG_GRKERNSEC_MEDIUM is not set
# CONFIG_GRKERNSEC_HIGH is not set
CONFIG_GRKERNSEC_CUSTOM=y
CONFIG_GRKERNSEC_KMEM=y
CONFIG_GRKERNSEC_IO=y
CONFIG_GRKERNSEC_PROC_MEMMAP=y
CONFIG_GRKERNSEC_BRUTE=y
CONFIG_GRKERNSEC_HIDESYM=y
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30
CONFIG_GRKERNSEC_PROC=y
CONFIG_GRKERNSEC_PROC_USER=y
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_RESLOG=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
CONFIG_GRKERNSEC_AUDIT_CHDIR=y
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
CONFIG_GRKERNSEC_AUDIT_IPC=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
CONFIG_GRKERNSEC_PROC_IPADDR=y
# CONFIG_GRKERNSEC_AUDIT_TEXTREL is not set
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_RANDPID=y
# CONFIG_GRKERNSEC_TPE is not set
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_RANDISN=y
CONFIG_GRKERNSEC_RANDID=y
CONFIG_GRKERNSEC_RANDSRC=y
CONFIG_GRKERNSEC_RANDRPC=y
# CONFIG_GRKERNSEC_SOCKET is not set
CONFIG_GRKERNSEC_SYSCTL=y
CONFIG_GRKERNSEC_SYSCTL_ON=y
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=10

This has been fixed in the latest patch. Thanks for reporting the problem.

-Brad

OK that was fast.

I started a new compile of the distribution, to see if there are any other problems.
If you don't hear from me tonight, then everything worked.

Heiko

So far so good.
All the base libraries and programs for DL compiled fine with the latest patch.
I'll start a full compile, but that will take until tomorrow morning.

Heiko
D:evil:-Linux

The full compilation of the distribution ran through without any problems.
I still need to do some functional testing, but have no idea when I'll get to it.

But so far you have my blessing (except the mentioned SYSCTL_ON annoyance)

Heiko

what SYSCTL_ON annoyance?

-Brad

My other post with the title CONFIG_GRKERNSEC_SYSCTL_ON

Heiko