grsecurity forums

I turned off /dev/kmem access and X would no longer work on my centrino-based laptop. Actually what I should say is I turned off /dev/kmem access and then installed X and was surprised to see it not working, until I got around to checking dmesg. Anyway on my system the following:

!(offset == 0xc0000 && ((vma->vm_end - vma->vm_start) <= 0xf0000) in grsec_mem.c fixed the first /dev/[k]mem access...

but then it bombed trying to map 0xb7f4b000...0xb7f4c000

at this point I gave up adding more offsets, I'm out of my element here already. Disable privileged I/O is *NOT* enabled, btw. This is 2.6.11 gentoo hardened.

Anyway I'll just turn that feature off but I thought I'd pass the word on to more knowledgable people, in the event that there is a fix or whatever.

--

I just added ATI radeon support to the /dev/(k)mem feature, and it may fix your problems as well. Apply this diff to your grsecurity/grsec_mem.c file:

http://cvsweb.grsecurity.net/index.cgi/ ... r1=1.1&f=u

Also, for debugging purposes (in case this doesn't fix your problem), can you also add the following, just below the "end = start + vma->vm_end - vma->vm_start" line:

if (start < __pa(high_memory)) printk(KERN_ALERT "start=%08lx end=%08lx\n", start, end);

Thanks

-Brad

@spender..

What about other graphic cards ?

And also, what's the catch of those patches (maybe i'm able to make myself the proper patch

Other cards work fine. The purpose of the patch is to only keep kernel memory from being written to. Previously, we were a little more restrictive than necessary.

-Brad

nt