[SOLVED]Pax kills Cgrulesengd, Cgexec, Cgclassify.
Posted: Sat Mar 14, 2015 2:21 amPax kills Cgrulesengd, Cgexec, Cgclassify:
System:
Installed:
Linux-3.19.1 + patches:
After running command:
Dmesg says:
For each game are saved earlier kernels 3.17.x and 3.18.x and Cgrulesengd and the remaining programs provided by libcgroup work correctly.
Grsec & Pax config:
EDIT:
Linux-3.19.1 & grsecurity-3.1-3.19.1-201503122205.patch solved this problem.
Cheers
System:
- Code: Select all
Linux version 3.19.1-gr1 (root@localhost) (gcc version 4.8.3 (Gentoo Hardened 4.8.3 p1.1, pie-0.5.9) ) #1 SMP PREEMPT Tue Mar 10 11:03:51 CET 2015
Installed:
- Code: Select all
dev-libs/libcgroup-0.41 daemon debug pam tools
Linux-3.19.1 + patches:
- Code: Select all
4200_fbcondecor-3.19.patch
grsecurity-3.1-3.19.1-201503092204.patch
random_timestamp.diff
After running command:
- Code: Select all
/usr/sbin/cgrulesengd --nodaemon --nolog
Killed
Dmesg says:
- Code: Select all
[ 6857.702306] PAX: size overflow detected in function kernfs_fop_write fs/kernfs/file.c:269 cicus.253_250 max, count: 17
[ 6857.702314] CPU: 0 PID: 16030 Comm: cgrulesengd Tainted: P W OE 3.19.1-gr1 #1
[ 6857.702317] Hardware name: Gigabyte Technology Co., Ltd. P43-ES3G/P43-ES3G, BIOS F14 08/23/2010
[ 6857.702320] 0000000000000000 0000000000000000 0000000000000000 ffffc9000ca83dd8
[ 6857.702325] ffffffff83a300cf 0000000080000000 ffffffff83d2e18b ffffc9000ca83e18
[ 6857.702330] ffffffff831cdecc ffffc9000ca83e18 ffffffff83d2e19c ffff88003e07acb0
[ 6857.702335] Call Trace:
[ 6857.702346] [<ffffffff83a300cf>] dump_stack+0x4f/0x81
[ 6857.702352] [<ffffffff831cdecc>] report_size_overflow+0x3f/0x49
[ 6857.702359] [<ffffffff8323b963>] kernfs_fop_write+0x29d/0x2dd
[ 6857.702366] [<ffffffff8341683e>] ? security_file_permission+0x34/0xae
[ 6857.702372] [<ffffffff831c76a1>] vfs_write+0x133/0x2dc
[ 6857.702378] [<ffffffff831e539d>] ? __fdget+0x1d/0x25
[ 6857.702388] [<ffffffff831c8502>] SyS_write+0x4f/0x99
[ 6857.702395] [<ffffffff83a368a7>] system_call_fastpath+0x16/0x1b
[ 6892.848523] PAX: size overflow detected in function kernfs_fop_write fs/kernfs/file.c:269 cicus.253_250 max, count: 17
[ 6892.848531] CPU: 0 PID: 16249 Comm: cgrulesengd Tainted: P W OE 3.19.1-gr1 #1
[ 6892.848534] Hardware name: Gigabyte Technology Co., Ltd. P43-ES3G/P43-ES3G, BIOS F14 08/23/2010
[ 6892.848537] 0000000000000000 0000000000000000 0000000000000000 ffffc9000d1b3dd8
[ 6892.848542] ffffffff83a300cf 0000000080000000 ffffffff83d2e18b ffffc9000d1b3e18
[ 6892.848547] ffffffff831cdecc ffffc9000d1b3e18 ffffffff83d2e19c ffff88003e07a590
[ 6892.848552] Call Trace:
[ 6892.848562] [<ffffffff83a300cf>] dump_stack+0x4f/0x81
[ 6892.848568] [<ffffffff831cdecc>] report_size_overflow+0x3f/0x49
[ 6892.848575] [<ffffffff8323b963>] kernfs_fop_write+0x29d/0x2dd
[ 6892.848582] [<ffffffff8341683e>] ? security_file_permission+0x34/0xae
[ 6892.848588] [<ffffffff831c76a1>] vfs_write+0x133/0x2dc
[ 6892.848593] [<ffffffff831e539d>] ? __fdget+0x1d/0x25
[ 6892.848598] [<ffffffff831c8502>] SyS_write+0x4f/0x99
[ 6892.848605] [<ffffffff83a368a7>] system_call_fastpath+0x16/0x1b
For each game are saved earlier kernels 3.17.x and 3.18.x and Cgrulesengd and the remaining programs provided by libcgroup work correctly.
Grsec & Pax config:
- Code: Select all
CONFIG_PAX_KERNEXEC_PLUGIN=y
CONFIG_PAX_PER_CPU_PGD=y
CONFIG_PAX_USERCOPY_SLABS=y
CONFIG_GRKERNSEC=y
CONFIG_GRKERNSEC_CONFIG_AUTO=y
# CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set
# CONFIG_GRKERNSEC_CONFIG_SERVER is not set
CONFIG_GRKERNSEC_CONFIG_DESKTOP=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_NONE is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_HOST=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_EPT is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_SOFT=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_XEN is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_VMWARE is not set
# CONFIG_GRKERNSEC_CONFIG_VIRT_KVM is not set
CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX=y
# CONFIG_GRKERNSEC_CONFIG_VIRT_HYPERV is not set
# CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF is not set
CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY=y
CONFIG_GRKERNSEC_PROC_GID=397
CONFIG_GRKERNSEC_TPE_TRUSTED_GID=900
CONFIG_GRKERNSEC_SYMLINKOWN_GID=397
# PaX
CONFIG_PAX=y
# PaX Control
CONFIG_PAX_SOFTMODE=y
# CONFIG_PAX_EI_PAX is not set
# CONFIG_PAX_PT_PAX_FLAGS is not set
CONFIG_PAX_XATTR_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_EMUTRAMP=y
CONFIG_PAX_MPROTECT=y
CONFIG_PAX_MPROTECT_COMPAT=y
CONFIG_PAX_ELFRELOCS=y
CONFIG_PAX_KERNEXEC=y
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS=y
# CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR is not set
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="bts"
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_MEMORY_SANITIZE=y
CONFIG_PAX_MEMORY_STACKLEAK=y
CONFIG_PAX_MEMORY_STRUCTLEAK=y
# CONFIG_PAX_MEMORY_UDEREF is not set
CONFIG_PAX_REFCOUNT=y
CONFIG_PAX_CONSTIFY_PLUGIN=y
CONFIG_PAX_USERCOPY=y
# CONFIG_PAX_USERCOPY_DEBUG is not set
CONFIG_PAX_SIZE_OVERFLOW=y
CONFIG_PAX_LATENT_ENTROPY=y
CONFIG_GRKERNSEC_KMEM=y
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_BPF_HARDEN=y
CONFIG_GRKERNSEC_PERF_HARDEN=y
CONFIG_GRKERNSEC_RAND_THREADSTACK=y
CONFIG_GRKERNSEC_PROC_MEMMAP=y
CONFIG_GRKERNSEC_KSTACKOVERFLOW=y
CONFIG_GRKERNSEC_BRUTE=y
CONFIG_GRKERNSEC_MODHARDEN=y
CONFIG_GRKERNSEC_HIDESYM=y
CONFIG_GRKERNSEC_RANDSTRUCT=y
CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y
# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
# CONFIG_GRKERNSEC_NO_RBAC is not set
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=90
CONFIG_GRKERNSEC_PROC=y
# CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_SYMLINKOWN=y
CONFIG_GRKERNSEC_FIFO=y
# CONFIG_GRKERNSEC_SYSFS_RESTRICT is not set
CONFIG_GRKERNSEC_ROFS=y
CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_RENAME=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
# CONFIG_GRKERNSEC_CHROOT_INITRD is not set
CONFIG_GRKERNSEC_AUDIT_GROUP=y
CONFIG_GRKERNSEC_AUDIT_GID=397
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_RESLOG=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
CONFIG_GRKERNSEC_AUDIT_PTRACE=y
CONFIG_GRKERNSEC_AUDIT_CHDIR=y
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
CONFIG_GRKERNSEC_PROC_IPADDR=y
CONFIG_GRKERNSEC_RWXMAP_LOG=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_HARDEN_PTRACE=y
CONFIG_GRKERNSEC_PTRACE_READEXEC=y
CONFIG_GRKERNSEC_SETXID=y
CONFIG_GRKERNSEC_HARDEN_IPC=y
CONFIG_GRKERNSEC_TPE=y
CONFIG_GRKERNSEC_TPE_ALL=y
CONFIG_GRKERNSEC_TPE_INVERT=y
CONFIG_GRKERNSEC_TPE_GID=900
CONFIG_GRKERNSEC_RANDOM_TIMESTAMPS=y
CONFIG_GRKERNSEC_BLACKHOLE=y
CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
CONFIG_GRKERNSEC_SOCKET=y
CONFIG_GRKERNSEC_SOCKET_ALL=y
CONFIG_GRKERNSEC_SOCKET_ALL_GID=901
CONFIG_GRKERNSEC_SOCKET_CLIENT=y
CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=903
CONFIG_GRKERNSEC_SOCKET_SERVER=y
CONFIG_GRKERNSEC_SOCKET_SERVER_GID=905
CONFIG_GRKERNSEC_DENYUSB=y
# CONFIG_GRKERNSEC_DENYUSB_FORCE is not set
CONFIG_GRKERNSEC_SYSCTL=y
CONFIG_GRKERNSEC_SYSCTL_ON=y
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=6
EDIT:
Linux-3.19.1 & grsecurity-3.1-3.19.1-201503122205.patch solved this problem.
Cheers