grsecurity forums

Hiya, know i'm new here but I hope u guyz are willing to help me
I started about 3 months ago with the Gentoo-grsec sources and I am now running 2.4.26-grsec2.0 without any real problems.
No problems that is until I recently installed Tomcat 5.0.18. For a schoolproject we needed Tomcat but it seems as if the Grsec-options cause some problems.
Tomcat wont start due to this error and I cant seem to find out why and how.

This is the error in my syslog:
Apr 22 12:30:39 kernel: grsec: From [insert IP]: signal 11 sent to /opt/blackdown-jdk-1.4.1/bin/java[java:27081] uid/euid:265/265 gid/egid:265/265, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0
Apr 22 12:30:39 kernel: grsec: From [insert IP]: signal 6 sent to /opt/blackdown-jdk-1.4.1/bin/java[java:27081] uid/euid:265/265 gid/egid:265/265, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

I did some research but it seems as if no-one on the internet eiter experienced this problem or knows a solution...
I hope the Grsec gurus know how to solve this.
If u guyz need more info I will gladly provide it

Thnx in advance for helping me...


this is my Grsec config:
# Grsecurity
#
CONFIG_GRKERNSEC=y
CONFIG_CRYPTO=y
CONFIG_CRYPTO_SHA256=y
# CONFIG_GRKERNSEC_LOW is not set
# CONFIG_GRKERNSEC_MID is not set
# CONFIG_GRKERNSEC_HI is not set
CONFIG_GRKERNSEC_CUSTOM=y

#
# PaX Control
#
# CONFIG_GRKERNSEC_PAX_SOFTMODE is not set
CONFIG_GRKERNSEC_PAX_EI_PAX=y
CONFIG_GRKERNSEC_PAX_PT_PAX_FLAGS=y
CONFIG_GRKERNSEC_PAX_NO_ACL_FLAGS=y
# CONFIG_GRKERNSEC_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_GRKERNSEC_PAX_HOOK_ACL_FLAGS is not set

#
# Address Space Protection
#
# CONFIG_GRKERNSEC_PAX_NOEXEC is not set
CONFIG_GRKERNSEC_PAX_ASLR=y
# CONFIG_GRKERNSEC_PAX_RANDKSTACK is not set
CONFIG_GRKERNSEC_PAX_RANDUSTACK=y
CONFIG_GRKERNSEC_PAX_RANDMMAP=y
# CONFIG_GRKERNSEC_KMEM is not set
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_PROC_MEMMAP=y
# CONFIG_GRKERNSEC_HIDESYM is not set

#
# Role Based Access Control Options
#
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30

#
# Filesystem Protections
#
CONFIG_GRKERNSEC_PROC=y
# CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=24
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
# CONFIG_GRKERNSEC_CHROOT_CHMOD is not set
# CONFIG_GRKERNSEC_CHROOT_FCHDIR is not set
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
# CONFIG_GRKERNSEC_CHROOT_SHMAT is not set
CONFIG_GRKERNSEC_CHROOT_UNIX=y
# CONFIG_GRKERNSEC_CHROOT_FINDTASK is not set
# CONFIG_GRKERNSEC_CHROOT_NICE is not set
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
# CONFIG_GRKERNSEC_CHROOT_CAPS is not set

#
# Kernel Auditing
#
# CONFIG_GRKERNSEC_AUDIT_GROUP is not set
# CONFIG_GRKERNSEC_EXECLOG is not set
# CONFIG_GRKERNSEC_RESLOG is not set
# CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set
# CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
# CONFIG_GRKERNSEC_AUDIT_MOUNT is not set
# CONFIG_GRKERNSEC_AUDIT_IPC is not set
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
# CONFIG_GRKERNSEC_PROC_IPADDR is not set
# CONFIG_GRKERNSEC_AUDIT_TEXTREL is not set

#
# Executable Protections
#
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_RANDPID=y
# CONFIG_GRKERNSEC_TPE is not set

#
# Network Protections
#
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_RANDISN=y
CONFIG_GRKERNSEC_RANDID=y
CONFIG_GRKERNSEC_RANDSRC=y
CONFIG_GRKERNSEC_RANDRPC=y
# CONFIG_GRKERNSEC_SOCKET is not set

#
# Sysctl support
#
# CONFIG_GRKERNSEC_SYSCTL is not set

#
# Logging options
#
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=4

Ryceck wrote:No problems that is until I recently installed Tomcat 5.0.18. For a schoolproject we needed Tomcat but it seems as if the Grsec-options cause some problems.

not sure what java doesn't like (you don't have non-exec pages enabled which is what normally kills java and friends), maybe it's randomization, try to disable it on /opt/blackdown-jdk-1.4.1/bin/java (chpax or paxctl -r). if that still doesn't help, then it's at least not a PaX related problem, no idea how to go from there (besides debugging java...)

ok, thnx to ur randomization fix I only get the error 11 in my logs:
The signal 6 is gone now and it only spawns an signal 11, but it works :S

So this logentry remains:
Apr 22 12:30:39 kernel: grsec: From [insert IP]: signal 11 sent to /opt/blackdown-jdk-1.4.1/bin/java[java:27081] uid/euid:265/265 gid/egid:265/265, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

But it starts and works, but ahs anyone any idea what this is? and how to prevent it.... cuz I dont like errors :p