grsecurity forums

Hello,

I am trying to cross-compile a kernel with patched gr-security for the Raspberry PI within the build system Yocto . It always fails with the error message:

Makefile:686: *** Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.. Stop.

So far I figured out, that the default cross-compiler on Yocto is not compiled with plugin support and I changed that.

The kernel I try to compile is the latest 3.16.y Raspberry Pi kernel with grsecurity-3.0-3.16.2-201409060014.patch

here is the output of

arm-poky-linux-gnueabi-gcc -v

Code: Select all

Using built-in specs.
COLLECT_GCC=./arm-poky-linux-gnueabi-gcc
COLLECT_LTO_WRAPPER=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/libexec/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/lto-wrapper
Target: arm-poky-linux-gnueabi
Configured with: /home/myuser/poky-daisy-11.0.1/build/tmp/work-shared/gcc-4.8.2-r0/gcc-4.8.2/configure --build=i686-linux --host=i686-linux --target=arm-poky-linux-gnueabi --prefix=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr --exec_prefix=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr --bindir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi --sbindir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi --libexecdir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/libexec/armv6-vfp-poky-linux-gnueabi --datadir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/share --sysconfdir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/etc --sharedstatedir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/com --localstatedir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/var --libdir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi --includedir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/include --oldincludedir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/include --infodir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/share/info --mandir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/share/man --disable-silent-rules --disable-dependency-tracking --with-libtool-sysroot=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux --enable-clocale=generic --with-gnu-ld --enable-shared --enable-languages=c,c++ --enable-threads=posix --disable-multilib --enable-c99 --enable-long-long --enable-symvers=gnu --enable-libstdcxx-pch --program-prefix=arm-poky-linux-gnueabi- --without-local-prefix --enable-target-optspace --enable-lto --enable-libssp --disable-bootstrap --disable-libmudflap --with-system-zlib --with-linker-hash-style=gnu --enable-linker-build-id --with-ppl=no --with-cloog=no --enable-checking=release --enable-cheaders=c_global --with-gxx-include-dir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/raspberrypi/usr/include/c++ --with-sysroot=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/raspberrypi --with-build-sysroot=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/raspberrypi --enable-poison-system-directories --disable-libunwind-exceptions --with-mpfr=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr --with-system-zlib --enable-plugin --disable-nls
Thread model: posix
gcc version 4.8.2 (GCC)


arm-poky-linux-gnueabi-gcc -print-file-name=plugin

Code: Select all

/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin


Any ideas where to look why the build is failing?

try to run

Code: Select all

sh -x ./scripts/gcc-plugin.sh $HOSTCXX $HOSTCXX $CC

by hand and see if you get any gcc error messages about missing headers. you'll have to install them by hand from the (cross) gcc source directory into the plugin include directory. HOSTCXX is the native g++ compiler, CC is the cross gcc.

Ok, there seems to be something missing

I´ll try to install the header and report back.

Code: Select all

+ dirname ./scripts/gcc-plugin.sh
+ srctree=./scripts
+ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc -print-file-name=plugin
+ gccplugins_dir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin
+ g++ -E - -o /dev/null -I./scripts/../tools/gcc -I/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include
+ plugincc=In file included from /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include/gcc-plugin.h:28:0,
                 from /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include/plugin.h:23,
                 from ./scripts/../tools/gcc/gcc-common.h:4,
                 from <stdin>:1:
/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include/system.h:645:23: fatal error: libiberty.h: No such file or directory
compilation terminated.
+ [ 1 -ne 0 ]
+ exit 1


After coping the header, I get the following output, compiling still does not work

Code: Select all

+ dirname ./scripts/gcc-plugin.sh
+ srctree=./scripts
+ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc -print-file-name=plugin
+ gccplugins_dir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin
+ g++ -E - -o /dev/null -I./scripts/../tools/gcc -I/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include
+ plugincc=<stdin>:3:2: warning: #warning g++ CXX [-Wcpp]
+ [ 0 -ne 0 ]
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g++ CC ]]
./scripts/gcc-plugin.sh: 19: ./scripts/gcc-plugin.sh: [[: not found
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g++ CXX ]]
./scripts/gcc-plugin.sh: 25: ./scripts/gcc-plugin.sh: [[: not found
+ exit 1


can you try with bash (or just try make now, it should work)?

Tried to compile but it still shows the same error message. Deleted the kernel sources, unpacked them for a fresh start, but still the same error.

Thanks for your help so far, any other ideas what could be wrong?

what kind of bash have you got there? what's the output of the script when you run it through bash and not sh?

bash -x ./scripts/gcc-plugin.sh g++ g++ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc

Code: Select all

++ dirname ./scripts/gcc-plugin.sh
+ srctree=./scripts
++ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc -print-file-name=plugin
+ gccplugins_dir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin
++ g++ -E - -o /dev/null -I./scripts/../tools/gcc -I/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include
+ plugincc='<stdin>:3:2: warning: #warning g++ CXX [-Wcpp]'
+ '[' 0 -ne 0 ']'
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g\+\+ CC ]]
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g\+\+ CXX ]]
++ g++ -c -x c++ -std=gnu++98 - -o /dev/null -I./scripts/../tools/gcc -I/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include
+ plugincc='<stdin>:6:2: error: expected primary-expression before ‘.’ token'
+ '[' 1 -eq 0 ']'
+ exit 1

sh -x ./scripts/gcc-plugin.sh g++ g++ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc

Code: Select all

+ dirname ./scripts/gcc-plugin.sh
+ srctree=./scripts
+ /home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/bin/armv6-vfp-poky-linux-gnueabi/arm-poky-linux-gnueabi-gcc -print-file-name=plugin
+ gccplugins_dir=/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin
+ g++ -E - -o /dev/null -I./scripts/../tools/gcc -I/home/myuser/poky-daisy-11.0.1/build/tmp/sysroots/i686-linux/usr/lib/armv6-vfp-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/4.8.2/plugin/include
+ plugincc=<stdin>:3:2: warning: #warning g++ CXX [-Wcpp]
+ [ 0 -ne 0 ]
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g++ CC ]]
./scripts/gcc-plugin.sh: 19: ./scripts/gcc-plugin.sh: [[: not found
+ [[ <stdin>:3:2: warning: #warning g++ CXX [-Wcpp] =~ g++ CXX ]]
./scripts/gcc-plugin.sh: 25: ./scripts/gcc-plugin.sh: [[: not found
+ exit 1


I actually don´t know what is used to auto-build the image with yocto as these are run automatically by python scripts.

what is the host g++ version? it has to be 4.7+ otherwise it won't understand the designated initializer gcc extension in c++ mode.

I am on Ubuntu 12.04.5 LTS, which is using ...

gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5)

I´ll try switch to an Ubuntu 14.04.1 LTS, it has

gcc version 4.8.2 (Ubuntu 4.8.2-19ubuntu1)

Takes a bit to set up the Build System, i´ll post back if I have

Ok I switched to Ubuntu 14.04 now, copied over the needed header files like before and ... it builds!

Thank you very much for your great help!

One more thing - after compiling the build system tries to strip the debug info from the files and before the files are deployed I get an error message:

Code: Select all

ERROR: objcopy failed with exit code 256 (cmd was 'arm-poky-linux-gnueabi-objcopy' --only-keep-debug '/usr/src/kernel/tools/gcc/colorize_plugin.so' '/usr/src/kernel/tools/gcc/.debug/colorize_plugin.so'):
arm-poky-linux-gnueabi-objcopy:/usr/src/kernel/tools/gcc/colorize_plugin.so: File format not recognized

what build system tries to save off the debug info on the plugins? all i can see in the kernel's is the builddeb target saving the debug info of kernel modules, but that doesn't include the plugins...