grsecurity forums

Hi,

Is there a patch for the utility of crash (written by Dave Anderson) which to analyze kernel crashes?

thanks,
yao

what kind of patch are you looking for? is it related to grsec?

PaX Team wrote:what kind of patch are you looking for? is it related to grsec?

Yes, the "crash" utility is very tied to the kernel code.
So I am looking for a patch from grsecurity to patch it to work with grsecurity enabled kernel.

for example: grsecurity patched kernel module.h
/* Here is the actual code + data, vfree'd on unload. */
void *module_core_rx, *module_core_rw;

/* Here are the sizes of the init and core sections */
unsigned int init_size_rw, core_size_rw;

/* The size of the executable code in each section. */
unsigned int init_size_rx, core_size_rx;

when I first read here I even didn't realize it is patched by grsecurity as no macro around the change.

but crash is looking for like module_core, core_size not the new core_size_rx...

yao

well, that's 'easy' . in PaX i split up those fields into rw/rx variants, so any user of these old fields will have to be changed to use the proper one (which may very well mean to compute the sum of the sizes for example or duplicating some logic for both regions). so the question you'll have to answer is what crash is doing with these module fields and which of the replacements should be used there.

Thanks Pax Team.

Yes, that is easy but many and that is what I see in 1 hour debugging of "crash".
I guess there will be more to be changed so I am looking for a working patch:)

It seems someone had one but not official into crash's repository:
http://www.linux-archive.org/crash-util ... pport.html
Not sure how good it is?

yao