am wrote:I patched the kernel 2.6.19.2 with the grsecurity patch.
I enabled the option "Security Level (High)" without any other grsec option.
When I boot this kernel, it hangs with
---snip---
grsec: signal 11 send to /sbin/init[init:1] uid/euid :0/0 gid/eid :0/0,
parent /[swapper :0] uid/euid :0/0 gid/edid :0/0
---snip---
Technically, your description is not exactly incorrect: the kernel did
not "hang", it killed init (which presumably was trying to do something
weird).
Distribution is debian sarge.
I've got a sarge chroot (used as buildd) on my x86 etch box running
2.6.19.2, it works just fine. The .config is available at
<http://theor.jinr.ru/~varg/web/linux/config-2.6.19.2-grsec-p4-smp>
Which grsec option cause this.
This is not necessary some "grsec option" caused this. Anyway, according
to grsecurity/Kconfig, the difference between "Security Level (High)"
(GRKERNSEC_HIGH) and "Security Level (Medium)" is the following:
- Code: Select all
select GRKERNSEC_LINK
select GRKERNSEC_FIFO
select GRKERNSEC_EXECVE
select GRKERNSEC_DMESG
select GRKERNSEC_FORKFAIL
select GRKERNSEC_TIME
select GRKERNSEC_SIGNAL
select GRKERNSEC_CHROOT_SHMAT
select GRKERNSEC_CHROOT_UNIX
select GRKERNSEC_CHROOT_MOUNT
select GRKERNSEC_CHROOT_FCHDIR
select GRKERNSEC_CHROOT_PIVOT
select GRKERNSEC_CHROOT_DOUBLE
select GRKERNSEC_CHROOT_CHDIR
select GRKERNSEC_CHROOT_MKNOD
select GRKERNSEC_CHROOT_CAPS
select GRKERNSEC_CHROOT_SYSCTL
select GRKERNSEC_CHROOT_FINDTASK
select GRKERNSEC_PROC
select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
select GRKERNSEC_HIDESYM
select GRKERNSEC_BRUTE
select GRKERNSEC_SHM if (SYSVIPC)
select GRKERNSEC_PROC_USERGROUP
select GRKERNSEC_KMEM
select GRKERNSEC_RESLOG
select GRKERNSEC_RANDNET
select GRKERNSEC_PROC_ADD
select GRKERNSEC_CHROOT_CHMOD
select GRKERNSEC_CHROOT_NICE
select GRKERNSEC_AUDIT_MOUNT
select GRKERNSEC_MODSTOP if (MODULES)
select PAX_NOEXEC
select PAX_MPROTECT
select PAX_EI_PAX
select PAX_PT_PAX_FLAGS
select PAX_HAVE_ACL_FLAGS
select PAX_KERNEXEC if (!X86_64 && !MODULES && !HOTPLUG_PCI_COMPAQ_NVRAM && !PCI_BIOS)
select PAX_RANDKSTACK if (X86_TSC && !X86_64)
select PAX_SEGMEXEC if (X86 && !X86_64)
select PAX_PAGEEXEC if (!X86)
select PAX_EMUPLT if (ALPHA || PARISC || PPC32 || SPARC32 || SPARC64)
select PAX_DLRESOLVE if (SPARC32 || SPARC64)
select PAX_SYSCALL if (PPC32)
select PAX_EMUTRAMP if (PARISC)
select PAX_EMUSIGRT if (PARISC)
select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
In my config I have almost all of these (leaving aside arch-dependent
work-arounds) switched on too, _except_
- Code: Select all
GRKERNSEC_PROC_MEMMAP
GRKERNSEC_FORKFAIL
PAX_RANDKSTACK
So one of these 3 _MIGHT_ make your kernel to kill init. There are
some more options I use -- TPE, socket restrictions, etc., but I don't
think they are relevant here.
Is there a problem in the init command?
Install busybox-static and try to boot with init=/bin/busybox to check
If I try "Security Level (Medium)" it is working, but I would enable
"Security Level (High)"
It is not a silver bullet :) Anyway, you might take the config from
"Security Level (Medium)" and enable different options selected by
"Security Level (High)" one-by-one. Or the other way around: manually
select every option that "Security Level (High)" selects, and switch
them off one-by-one. Those 3 options I've mentioned previously might
be good candidates to start with...
Posted: Mon Mar 12, 2007 5:12 am
.