grsecurity forums

Hi,

I'm having a similar issue to this previously discussed problem (I'm not sure if that one got solved and how):
viewtopic.php?f=3&t=4226&p=15343

Error message when trying to load QubesOS VM kernel module (u2mfn):

Code: Select all

modprobe: ERROR: could not insert 'u2mfn': Exec format error
version magic '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload modversions REFCOUNT GRSEC ' should be '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload modversions REFCOUNT STACKLEAK_PLUGIN GRSEC RANDSTRUCT_PLUGIN_fff12345.....


installation works fine though (and the links in /lib/modules/*/build seem correct.

Code: Select all

# dkms install u2mfn/3.1.8 -k 4.4.8-300.grsec.fc23.x86_64

Creating symlink /var/lib/dkms/u2mfn/3.1.8/source ->
                 /usr/src/u2mfn-3.1.8
DKMS: add completed.
Kernel preparation unnecessary for this kernel.  Skipping...
Building module:
cleaning build area...
make KERNELRELEASE=4.4.8-300.grsec.fc23.x86_64 -C /lib/modules/4.4.8-300.grsec.fc23.x86_64/build M=/var/lib/dkms/u2mfn/3.1.8/build...
cleaning build area...
DKMS: build completed.
u2mfn.ko:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/4.4.8-300.grsec.fc23.x86_64/extra/
Adding any weak-modules
depmod...
DKMS: install completed.


vanilla kernel version (removed all fedora patches): 4.4.8
grsec version: grsecurity-3.1-4.4.8-201604252206.patch

Any hints how to fix this are appreciated!

thanks!
joe

well, based on the mismatched modversion strings, you/DKMS built the module against a rather different config, you should find out why.

The configuration in

Code: Select all

/lib/modules/4.4.8-300.grsec.fc23.x86_64/build/.config


and

Code: Select all

/usr/src/kernels/4.4.8-300.grsec.fc23.x86_64/.config


matches the one of the kernel in

Code: Select all

/boot/config-4.4.8-300.grsec.fc23.x86_64


So for some reason the following two ifdefs in

Code: Select all

/usr/src/kernels/4.4.8-300.grsec.fc23.x86_64/include/linux/vermagic.h


are not true leading empty strings:

Code: Select all

#ifdef STACKLEAK_PLUGIN
#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
#else
#define MODULE_STACKLEAK_PLUGIN ""
#endif

#ifdef RANDSTRUCT_PLUGIN
#include <generated/randomize_layout_hash.h>
#define MODULE_RANDSTRUCT_PLUGIN "RANDSTRUCT_PLUGIN_" RANDSTRUCT_HASHED_SEED
#else
#define MODULE_RANDSTRUCT_PLUGIN
#endif


Where is STACKLEAK_PLUGIN and RANDSTRUCT_PLUGIN usually defined?

update: found it in scripts/Makefile.gcc-plugins

Code: Select all

ifdef CONFIG_PAX_MEMORY_STACKLEAK
STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
endif

Code: Select all

 grep CONFIG_PAX_MEMORY_STACKLEAK .config
CONFIG_PAX_MEMORY_STACKLEAK=y


Code: Select all

ifdef CONFIG_GRKERNSEC_RANDSTRUCT
RANDSTRUCT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/randomize_layout_plugin.so -DRANDSTRUCT_PLUGIN
ifdef CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE
RANDSTRUCT_PLUGIN_CFLAGS += -fplugin-arg-randomize_layout_plugin-performance-mode
endif

Code: Select all

grep CONFIG_GRKERNSEC_RANDSTRUCT .config
CONFIG_GRKERNSEC_RANDSTRUCT=y

So I'm wondering why it is not defined if the config has the relevant parts enabled?