grsecurity forums

I'm using Debian Woody with 2.4.24 kernel + grsecurity 1.9.13 + gradm 1.9.13.

When I try to run the Team Speak server (http://www.teamspeak.org) it crashes immediately. In /var/log/kernel.log the following message appears:

Feb 17 18:28:05 serwer kernel: grsec: From 80.54.174.29: attempted resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 by (server_linux:3284) UID(0) EUID(0), parent (tss.minimal_sta:12136) UID(0) EUID(0)

I set ulimit -c to 10000 and started Team Speak again, it also crashed but now I can see the following message in kernel.log.

Feb 17 18:35:03 serwer kernel: PAX: From 80.54.174.29: execution attempt in: /home/wujek/tss2_rc2/server_linux, 08209000-08222000 000c0000
Feb 17 18:35:03 serwer kernel: PAX: From 80.54.174.29: terminating task: /home/wujek/tss2_rc2/server_linux(server_linux):10277, uid/euid: 0/0, PC: 0820d587, SP: 5f3139d8
Feb 17 18:35:03 serwer kernel: PAX: bytes at PC: 83 44 24 04 dc e9 4b 23 e4 ff 83 44 24 04 dc e9 55 23 e4 ff

When I try to generate locales using "localegen", similar messages appear. With no grsec enabled kernel, everything works fine.

I have had this problem with grsec enabled kernels since 2.4.20.

Is it possible to fix this problem somehow?

UncleGoodAdvice wrote:Feb 17 18:35:03 serwer kernel: PAX: From 80.54.174.29: execution attempt in: /home/wujek/tss2_rc2/server_linux, 08209000-08222000 000c0000
Feb 17 18:35:03 serwer kernel: PAX: From 80.54.174.29: terminating task: /home/wujek/tss2_rc2/server_linux(server_linux):10277, uid/euid: 0/0, PC: 0820d587, SP: 5f3139d8
Feb 17 18:35:03 serwer kernel: PAX: bytes at PC: 83 44 24 04 dc e9 4b 23 e4 ff 83 44 24 04 dc e9 55 23 e4 ff

this is an already known bug/feature of Borland's linux toolchain - it puts code into the .data section which is not executable. your only remedy is to chpax -sp it (and/or complain to Borland).

When I try to generate locales using "localegen", similar messages appear. With no grsec enabled kernel, everything works fine.

the glibc locale stuff uses a nested function trampoline, either use chpax -E (if you have EMUTRAMP in your kernel) or chpax -sp on it (or fix the use of the trampoline, but that's some ugly work in this case).

It worked! Thank You