grsecurity forums

I've had some problems getting fglrx (legacy 13.1 x86_64) to build on grsecurity kernels using debian testing (wheezy). For debian stable (squeeze) fglrx has always built fine and worked for me with grsecurity provided I disable the features which are known to conflict with the driver.

I am using a custom kernel (3.2.40) built with grsecurity 2.9.1-3.2.40. GCC Version: gcc-4.6 with plugin support (gcc-4.6-plugin-dev), ARCH: AMD64 (AMD Phenom II).

I have some of the grsecurity logging options on in the kernel and there is no log, plus syslog has nothing about it. But the fglrx install log has this:

Check if system has the tools required for installation.
Uninstalling any previously installed drivers.
Unloading radeon module...
Error: Module radeon is in use
Unloading drm module...
Error: Module drm is in use by: drm_kms_helper ttm radeon
[Message] Kernel Module : Trying to install a precompiled kernel module.
[Message] Kernel Module : Precompiled kernel module version mismatched.
[Message] Kernel Module : Found kernel module build environment, generating kernel module now.
AMD kernel module generator version 2.1
doing Makefile based build for kernel 2.6.x and higher
rm -rf *.c *.h *.o *.ko *.a .??* *.symvers
make -C /lib/modules/3.2.40-grsec/build SUBDIRS=/lib/modules/fglrx/build_mod/2.6.x modules
make[1]: Entering directory `/usr/src/linux-3.2.40'
CC [M] /lib/modules/fglrx/build_mod/2.6.x/firegl_public.o
CC [M] /lib/modules/fglrx/build_mod/2.6.x/kcl_acpi.o
/lib/modules/fglrx/build_mod/2.6.x/kcl_acpi.c: In function ‘KCL_ACPI_InstallLidHandler’:
/lib/modules/fglrx/build_mod/2.6.x/kcl_acpi.c:430:9: error: assignment of member ‘notifier_call’ in read-only object
make[2]: *** [/lib/modules/fglrx/build_mod/2.6.x/kcl_acpi.o] Error 1
make[1]: *** [_module_/lib/modules/fglrx/build_mod/2.6.x] Error 2
make[1]: Leaving directory `/usr/src/linux-3.2.40'
make: *** [kmod_build] Error 2
build failed with return value 2
[Error] Kernel Module : Failed to compile kernel module - please consult readme.
[Reboot] Kernel Module : update-initramfs

What I've tried so far:

Using debians default kernel configuration for my custom kernel along with the grsecurity patch (didn't change anything).
Disabling the grsecurity option altogether in the kernel build, but leaving the patch intact in the build (fglrx still will not build).
I tried fglrx on a build of 3.2.40 without the grsecurity patch and that works ok.
I tried some other changes in the kernel configuration which didn't help.

I don't think there is a config problem because I can usually get fglrx to build for custom kernels and amd say this driver will work for kernels up to 3.4.

I googled the error "assignment of member ‘notifier_call’ in read-only object" and found someone having a similar problem (though not with fglrx): https://github.com/Bumblebee-Project/bbswitch/issues/48. So I tried using the same gcc version as debian stable uses (4.4) as it has no plugin support and fglrx builds but the module cannot be inserted to the kernel - I lost the log for this but IIRC that's normal when building a module with a different gcc version than the one used to build the kernel.

I did see this: viewtopic.php?f=3&t=3320&p=12599&hilit=fglrx#p12599 but I don't know if we have the same problem, which is the reason for the new post

Is this a known problem? If so, is there a way to solve it?

Thanks

this is due to the constify plugin that grsec (unlike PaX) enforces so you can't just turn it off. the proper solution to this would be to patch the fglrx module wrapper like gentoo does: http://sources.gentoo.org/cgi-bin/viewv ... h?view=log

Ah. How could I go about that? I can probably patch kcl_acpi.c once the build fails in /lib/modules/fglrx/build_dir etc, but is there a way I can I continue the build from there?

Thanks

Edit:
I was able to patch kcl_acpi.c and then run make.sh in /lib/modules/fglrx/build_mod/ but after that it's just the same problem but on line 437 instead.

you'll have to adapt the patch to activate the new code for 3.2 as well, not just >= 3.7.

It's all working thanks

The whole process after fglrx install fails for anyone who wants to know:

Code: Select all

cd /lib/modules/fglrx/build_mod/
wget -O patchfile http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/x11-drivers/ati-drivers/files/const-notifier-block.patch?revision=1.1
sed 's/3,7,0/2,6,32/' patchfile > fglrx-grsec26x-patch
patch kcl_acpi.c fglrx-grsec26x-patch
./make.sh
cd ..
./make_install.sh