grsecurity forums

Code: Select all

  CC [M]  drivers/char/mxser.o
drivers/char/mxser.c: In function 'mxser_initbrd':
drivers/char/mxser.c:551: warning: unused variable 'flags'
  CC [M]  drivers/char/ip2.o
  CC [M]  drivers/char/ip2main.o
drivers/char/ip2main.c:469: warning: initialization from incompatible pointer type
drivers/char/ip2main.c: In function 'ip2_tiocmget':
drivers/char/ip2main.c:2003: warning: unused variable 'wait'
drivers/char/ip2main.c: In function 'ip2_ioctl':
drivers/char/ip2main.c:2208: warning: 'save_flags' is deprecated (declared at include/linux/interrupt.h:73)
drivers/char/ip2main.c:2208: warning: 'cli' is deprecated (declared at include/linux/interrupt.h:65)
drivers/char/ip2main.c:2210: warning: 'restore_flags' is deprecated (declared at include/linux/interrupt.h:78)drivers/char/ip2main.c:2230: warning: 'save_flags' is deprecated (declared at include/linux/interrupt.h:73)
drivers/char/ip2main.c:2230: warning: 'cli' is deprecated (declared at include/linux/interrupt.h:65)
drivers/char/ip2main.c:2232: warning: 'restore_flags' is deprecated (declared at include/linux/interrupt.h:78)drivers/char/ip2main.c:2270: warning: 'save_flags' is deprecated (declared at include/linux/interrupt.h:73)
drivers/char/ip2main.c:2270: warning: 'cli' is deprecated (declared at include/linux/interrupt.h:65)
drivers/char/ip2main.c:2272: warning: 'restore_flags' is deprecated (declared at include/linux/interrupt.h:78)drivers/char/ip2main.c: At top level:
drivers/char/./ip2/i2cmd.c:142: warning: 'ct89' defined but not used
  CC [M]  drivers/char/isicom.o
drivers/char/isicom.c:154: error: array type has incomplete element type
drivers/char/isicom.c:155: error: array type has incomplete element type
make[2]: *** [drivers/char/isicom.o] Error 1
make[1]: *** [drivers/char] Error 2
make: *** [drivers] Error 2


using:

Code: Select all

root@lore:/usr/src/kernel/2.6.11.12-grsec/linux-2.6.11.12# gcc --ver
Using built-in specs.
Target: i486-linux-gnu
Configured with: ../src/configure -v --enable-languages=c,c++,java,f95,objc,ada,treelang --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --enable-nls --without-included-gettext --enable-threads=posix --program-suffix=-4.0 --enable-__cxa_atexit --enable-libstdcxx-allocator=mt --enable-clocale=gnu --enable-libstdcxx-debug --enable-java-gc=boehm --enable-java-awt=gtk --enable-gtk-cairo --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-4.0-1.4.2.0/jre --enable-mpfr --disable-werror --enable-checking=release i486-linux-gnu
Thread model: posix
gcc version 4.0.2 20050821 (prerelease) (Debian 4.0.1-6)


on 2.6.11.12 + latest patch.

Btw, what is the best but 100% not-braking-anything config? That will work even with Xfree, OpenGL, etc stuff, so it allows non-grsecurity-kernel users to smoothly try a bit grsecurity?

Raf256 wrote:

Code: Select all

  CC [M]  drivers/char/isicom.o
drivers/char/isicom.c:154: error: array type has incomplete element type
drivers/char/isicom.c:155: error: array type has incomplete element type
make[2]: *** [drivers/char/isicom.o] Error 1
make[1]: *** [drivers/char] Error 2
make: *** [drivers] Error 2


that's a vanilla kernel bug, the two structures in question are defined after the arrays of them are, that could not have possibly compiled before either. it seems that 2.6.13 fixes it though.

Btw, what is the best but 100% not-braking-anything config? That will work even with Xfree, OpenGL, etc stuff, so it allows non-grsecurity-kernel users to smoothly try a bit grsecurity?

that's what softmode was made for: you compile in softmode support then enable it on the kernel command line so that apps won't get protected by default, only those that you explicitly set up via paxctl.

So with exacly 2.6.x kernel and with (here to download) grSec patch should I use?

Raf256 wrote:So with exacly 2.6.x kernel and with (here to download) grSec patch should I use?

well, you can fix 2.6.11 by moving a few lines of code, or you can wait for the 2.6.13-grsec release. right now it's in the testing phase and there're some bugs to be resolved (check the forums for more info), so you should not use it for production.