grsecurity forums

Hello.

I've tried to compile vanilla kernel 2.6.26.3 with grsecurity-2.1.12-2.6.26.3-200808262105 patch applied. While it builds properly on x86_64 on x86 it always gives following error:

Code: Select all

  CC      arch/x86/kernel/efi.o
  CC      arch/x86/kernel/efi_32.o
arch/x86/kernel/efi_32.c: In function 'efi_call_phys_prelog':
arch/x86/kernel/efi_32.c:50: error: 'USER_PGD_PTRS' undeclared (first use in this function)
arch/x86/kernel/efi_32.c:50: error: (Each undeclared identifier is reported only once
arch/x86/kernel/efi_32.c:50: error: for each function it appears in.)
arch/x86/kernel/efi_32.c:58: warning: assignment makes integer from pointer without a cast
arch/x86/kernel/efi_32.c: In function 'efi_call_phys_epilog':
arch/x86/kernel/efi_32.c:67: warning: assignment makes integer from pointer without a cast
make[1]: *** [arch/x86/kernel/efi_32.o] Error 1
make: *** [arch/x86/kernel] Error 2


Hawk wrote:I've tried to compile vanilla kernel 2.6.26.3 with grsecurity-2.1.12-2.6.26.3-200808262105 patch applied. While it builds properly on x86_64 on x86 it always gives following error:

thanks, fixed in test18, interdiff applies to grsec as well.

Are we able to grab the link to the fixed patch or are you guys still working on it? just that I had 4 new machines that needed recompiling and patching this morning and I wanted to use the latest kernel.

Edit: I noticed that you said it was fixed the test18 revision, I did in fact attempt to patch it with the following commands but ended up at the same thing;

patch -p0 < grsecurity-2.1.12-2.6.26.3-200808262105.patch
patch -p0 -R < pax-linux-2.6.26.3-test18.patch

And once the compile reaches about 3-4 minutes;

-(root@colo152)-(/usr/local/src/linux-2.6.26.3)- tail -f nohup.out
CC arch/x86/kernel/efi_32.o
arch/x86/kernel/efi_32.c: In function âefi_call_phys_prelogâ:
arch/x86/kernel/efi_32.c:50: error: âUSER_PGD_PTRSâ undeclared (first use in this function)
arch/x86/kernel/efi_32.c:50: error: (Each undeclared identifier is reported only once
arch/x86/kernel/efi_32.c:50: error: for each function it appears in.)
arch/x86/kernel/efi_32.c:58: warning: assignment makes integer from pointer without a cast
arch/x86/kernel/efi_32.c: In function âefi_call_phys_epilogâ:
arch/x86/kernel/efi_32.c:67: warning: assignment makes integer from pointer without a cast
make[1]: *** [arch/x86/kernel/efi_32.o] Error 1
make: *** [arch/x86/kernel] Error 2

damier wrote:Edit: I noticed that you said it was fixed the test18 revision, I did in fact attempt to patch it with the following commands but ended up at the same thing;

patch -p0 < grsecurity-2.1.12-2.6.26.3-200808262105.patch
patch -p0 -R < pax-linux-2.6.26.3-test18.patch

the way it works is that you interdiff test17/test18 and apply that on top of grsec . btw, do you actually use EFI? i'm just asking it because for many years now i never got any feedback on whether my fixes to that area of code (unrelated to PaX) work as intended or not.

I think I've got it now, I'll link you to the small set of commands I wrote for reference anything you'd suggest adding/removing? http://privatepaste.com/381Ds1TJ46 - In regards to the patching I simply patch the kernel with grsec, then patch with test17/test18? and as for EFI I didn't specifically enable it I used the "High" setting within the grsecurity menu and left it at that.

damier wrote:I think I've got it now, I'll link you to the small set of commands I wrote for reference anything you'd suggest adding/removing? http://privatepaste.com/381Ds1TJ46

it's better to use -p1 instead of -p0 for patch because the root dir in patches may not be what you expect (say, PaX patches are against a -pax dir).

In regards to the patching I simply patch the kernel with grsec, then patch with test17/test18?

if you mean the interdiff of those two PaX patches, yes.

and as for EFI I didn't specifically enable it I used the "High" setting within the grsecurity menu and left it at that.

grsec doesn't touch anything EFI related, so it must have come from some other way, if you don't need it, you should probably disable it .