grsecurity forums

After a successful boot, I get a black screen. Hitting ctrl-alt-f2 and running top, I can see Xorg is running.

Running xinit I see:

Code: Select all

xinit
> grsec: denied resource overstep by requesting 21 for RLIMIT_NICE against limit 0 for /usr/bin/xinit
> blah blah Xorg already running

sudo killall -9 Xorg
grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /usr/bin/gnome-session


Not sure if that is related.


My system:
MBP Retina with Intel Iris graphics

you should post your kernel config and dmesg at least.

dmesg: https://gist.github.com/anonymous/548cf14ba8273d3f9e71

config: https://gist.github.com/anonymous/978d36299f7378f4ddc7

Code: Select all

[ 9673.970225] grsec: denied resource overstep by requesting 31 for RLIMIT_NICE against limit 0 for /usr/bin/pulseaudio[pulseaudio:2339] uid/euid:42/42 gid/egid:42/42, parent /usr/bin/pulseaudio[pulseaudio:2338] uid/euid:42/42 gid/egid:42/42
[ 9673.975623] grsec: denied resource overstep by requesting 30 for RLIMIT_NICE against limit 0 for /usr/bin/pulseaudio[pulseaudio:2339] uid/euid:42/42 gid/egid:42/42, parent /usr/bin/pulseaudio[pulseaudio:2338] uid/euid:42/42 gid/egid:42/42
[ 9673.976501] grsec: denied resource overstep by requesting 29 for RLIMIT_NICE against limit 0 for /usr/bin/pulseaudio[pulseaudio:2339] uid/euid:42/42 gid/egid:42/42, parent /usr/bin/pulseaudio[pulseaudio:2338] uid/euid:42/42 gid/egid:42/42
[ 9673.978264] grsec: denied resource overstep by requesting 28 for RLIMIT_NICE against limit 0 for /usr/bin/pulseaudio[pulseaudio:2339] uid/euid:42/42 gid/egid:42/42, parent /usr/bin/pulseaudio[pulseaudio:2338] uid/euid:42/42 gid/egid:42/42
[ 9673.979564] grsec: more alerts, logging disabled for 10 seconds
[ 9674.652315] PAX: execution attempt in: <anonymous mapping>, 2b521e86000-2b521e96000 2b521e86000
[ 9674.652325] PAX: terminating task: /usr/bin/gnome-shell(gnome-shell):2324, uid/euid: 42/42, PC: 000002b521e86078, SP: 000003a7e2608a00
[ 9674.652329] PAX: bytes at PC: e9 3b 00 00 00 49 bb 40 6d 82 19 b5 02 00 00 4c 89 5b 08 48
[ 9674.652341] PAX: bytes at SP-8: 000002b5404ac8d2 000002b521e86078 0000000000000000 0000000000000000 0000000000000000 000003a7e2608d18 000002b54032ca43 0000000000000000 000002b51a2bf4d0 0000000001eec8e0 000002b51a69f000


this is the usual problem with various desktop programs wanting to generate code at runtime, probably from a 3D library or a javascript JIT engine, etc. you can search the forum on how people tried to fix this in various ways, ultimately you'll have to disable MPROTECT on the affected apps or in your kernel config.

Ah makes sense. Thanks. For reference, the workaround:

Code: Select all

paxctl -c /usr/bin/gnome-shell
paxctl -m /usr/bin/gnome-shell