i still have a problem with hardened kernel and a java application i run on a server.
My /var/log/critical/* is filling with error messages like those below
Sep 16 16:12:59 [kernel] grsec: From 84.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:25967] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:13:00 [kernel] grsec: From 200.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:15654] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:18:22 [kernel] grsec: From 82.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:11995] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:20:03 [kernel] grsec: From 151.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:17771] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:22:24 [kernel] grsec: From 128.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:24246] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:23:03 [kernel] grsec: From 200.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:22643] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:23:22 [kernel] grsec: From 151.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:31400] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Sep 16 16:23:46 [kernel] grsec: From 80.x.x.x: signal 11 sent to /opt/sun-jre-bin-1.5.0.04/bin/java[java:4265] uid/euid:1002/1002 gid/egid:100/100, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Installed Java: sun-jre-bin-1.5.0.04
Installed Kernel: hardened-sources-2.6.11-r15
Application: http://www.powerfolder.com
Distro: Gentoo 2005.1 + NTPL (world + system up-to-date)
I used the following guide to change the ELF binaries of java to work with PAX:
http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml#paxjava
The java application itself is a tool to synchronize files with multiple clients over the lan/wan. The application is running, though i have a feeling that it gets limited by the grsec extensions, since it sometimes has internal problems running the hardened extended servers. I can't say which because i am not a programmer. Its normal that it lists so many different ips cause it connects to a lot of hosts asking for status updates or just checking the availabilty.
So my questions are:
1) What do these critical log messages mean ?
2) How do i get rid of them ? (if i should disable a grsec option, i am ok with it, i just want to get rid of those error messages and possible reasons for the program to not work properly)
As i stated above i followed the guide on using chpax on the java binaries as well added chpax to the default runlevel. Here is my kernel config regarding grsec and pax:
#
# Grsecurity
#
CONFIG_GRKERNSEC=y
# CONFIG_GRKERNSEC_LOW is not set
# CONFIG_GRKERNSEC_MEDIUM is not set
# CONFIG_GRKERNSEC_HIGH is not set
CONFIG_GRKERNSEC_CUSTOM=y
#
# Address Space Protection
#
# CONFIG_GRKERNSEC_KMEM is not set
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_PROC_MEMMAP=y
# CONFIG_GRKERNSEC_BIGMEM is not set
# CONFIG_GRKERNSEC_BRUTE is not set
CONFIG_GRKERNSEC_HIDESYM=y
#
# Role Based Access Control Options
#
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30
#
# Filesystem Protections
#
CONFIG_GRKERNSEC_PROC=y
CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=10
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
#
# Kernel Auditing
#
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_RESLOG=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
CONFIG_GRKERNSEC_AUDIT_CHDIR=y
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
CONFIG_GRKERNSEC_AUDIT_IPC=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
CONFIG_GRKERNSEC_PROC_IPADDR=y
# CONFIG_GRKERNSEC_AUDIT_TEXTREL is not set
#
# Executable Protections
#
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_SHM=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_RANDPID=y
# CONFIG_GRKERNSEC_TPE is not set
#
# Network Protections
#
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_RANDSRC=y
# CONFIG_GRKERNSEC_SOCKET is not set
#
# Sysctl support
#
CONFIG_GRKERNSEC_SYSCTL=y
CONFIG_GRKERNSEC_SYSCTL_ON=y
#
# Logging Options
#
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=4
#
# PaX
#
CONFIG_PAX=y
#
# PaX Control
#
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
#
# Non-executable pages
#
CONFIG_PAX_NOEXEC=y
# CONFIG_PAX_PAGEEXEC is not set
CONFIG_PAX_SEGMEXEC=y
CONFIG_PAX_EMUTRAMP=y
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_NOELFRELOCS is not set
#
# Address Space Layout Randomization
#
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_NOVSYSCALL=y
# CONFIG_KEYS is not set
# CONFIG_SECURITY is not set
I know that there are x threads in this forum about signal 11 and java, but i can't get any useful information out of them. If i should provide more information, debug reports, etc just tell me how and i will post them here.
Best regards
Wurstteppich