grsecurity forums

Hello.

I've been trying to setup a grsecurity enabled kernel on my server for a few days now, with only limited success.

My server is running Debian Wheezy, and has a Supermicro X10SAE motherboard. The onboard NICs on this motherboard are Intel I210-AT and Intel I217-LM.

For some reason, whenever I install a grsec-enabled kernel from the mempo project, all networking is disabled and the computer can't see either of the NICs. I also have a WiFi card in there, which is also being hidden. All these devices work fine with the stock 3.2.0-4-amd64 kernel that comes with Debian.

The kernels I've tried are linux-image-3.2.66-grsec-mempo.servmax.0.2.103 and linux-image-3.2.66-grsec-mempo.serv.0.2.103. Same results with both.

I've already run the "i.sh" script made by the mempo project.

Any tips on how to re-enable networking? I believe the appropriate modules are included with those mempo kernels, but for some reason they aren't showing up in lsmod. The modules required are igb and either e1000 or e1000e - I can't remember which right now.

Any help would be greatly appreciated. Thanks!

You simply aren't compiling the kernel with those modules enabled.

Have you checked that they're enabled in your .config before you build your kernel?

This isn't a grsec issue, it's a kernel-build issue.

Thanks for the reply, tjh.

I'm using a pre-compiled kernel from the Mempo project (http://deb.mempo.org/), and apparently the appropriate modules for my NIC are being compiled and installed. They're just not auto-loading. I can modprobe them in, but networking still doesn't work for some reason.

During boot, I see the following messages. Could they be significant?

Code: Select all

ipconfig: eth1: SIOCGIFINDEX: No such device
ipconfig: no devices to configure

Thanks.

That message is saying "I'm trying to configure the eth0 interface, but it's not there"

If you modprobe in the modules, then restart networking (/etc/init.d/networking restart)

Does it work then?

If so, you need to ensure that your modules _are_ loaded at boot time, before the networking script runs.

HOw to do that I"m not 100% sure.