Kernel: hardened-sources-2.6.28-r9
(grsec-2.1.13-2.6.28.10-200905241817.patch)
Kernel config:
- Code: Select all
CONFIG_PAX_SEGMEXEC=y
or
- Code: Select all
Security options -> Grsecurity -> Security Level ---> Hardened Gentoo [server]
.config
- Code: Select all
#
# Grsecurity
#
# CONFIG_GRKERNSEC is not set
#
# PaX
#
CONFIG_PAX=y
#
# PaX Control
#
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
CONFIG_PAX_NO_ACL_FLAGS=y
# CONFIG_PAX_HAVE_ACL_FLAGS is not set
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
#
# Non-executable pages
#
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
CONFIG_PAX_SEGMEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
CONFIG_PAX_NOELFRELOCS=y
CONFIG_PAX_KERNEXEC=y
#
# Address Space Layout Randomization
#
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
#
# Miscellaneous hardening features
#
CONFIG_PAX_MEMORY_SANITIZE=y
CONFIG_PAX_MEMORY_UDEREF=y
CONFIG_PAX_REFCOUNT=y
# CONFIG_KEYS is not set
CONFIG_SECURITY=y
# CONFIG_SECURITYFS is not set
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_FILE_CAPABILITIES=y
# CONFIG_SECURITY_ROOTPLUG is not set
CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=0
CONFIG_CRYPTO=y
kernel.log
- Code: Select all
Jan 20 21:32:33 gentoo kernel: [ 3387.497417] ------------[ cut here ]------------
Jan 20 21:32:33 gentoo kernel: [ 3387.498182] Kernel BUG at 00050f65 [verbose debug info unavailable]
Jan 20 21:32:33 gentoo kernel: [ 3387.498913] invalid opcode: 0000 [#1] SMP
Jan 20 21:32:33 gentoo kernel: [ 3387.499608] last sysfs file: /sys/devices/pci0000:00/0000:00:1f.2/host1/uevent
Jan 20 21:32:33 gentoo kernel: [ 3387.500002]
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] Pid: 11364, comm: python2.6 Not tainted (2.6.28-hardened-r9-nohard-lite #4)
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] EIP: 0060:[<00050f65>] EFLAGS: 00210046 CPU: 0
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] EIP is at __remove_from_page_cache+0x95/0xa0
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] EAX: 00000000 EBX: c287c3c0 ECX: c0c24949 EDX: 00000018
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] ESI: f0c192d0 EDI: f0c192d0 EBP: f0c192d0 ESP: f4cc5d8c
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] DS: 0068 ES: 0068 FS: 00d8 GS: 0033 SS: 0068
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] Process python2.6 (pid: 11364, ti=f4cc4000 task=f5affc00 task.ti=f4cc4000)
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] Stack:
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] f0c192d0 f0c192e0 c287c3c0 00050f8e c287c3c0 00000004 c287c3c0 00057cb5
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] 00000003 00057e14 00001000 00000000 00000000 00000003 f6fc8ea8 00000000
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] 00000000 00000000 ffffffff 00000000 0000000a 00000000 c28483a0 c2871d40
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] Call Trace:
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00050f8e>] remove_from_page_cache+0x1e/0x30
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00057cb5>] truncate_complete_page+0x35/0x70
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00057e14>] truncate_inode_pages_range+0x124/0x340
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00058047>] truncate_inode_pages+0x17/0x20
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<000ca063>] reiserfs_delete_inode+0x43/0x100
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<0009dc77>] inotify_inode_is_dead+0x17/0x80
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<0009dc77>] inotify_inode_is_dead+0x17/0x80
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<000ca020>] reiserfs_delete_inode+0x0/0x100
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00087e30>] generic_delete_inode+0x90/0x160
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<000870b4>] iput+0x44/0x50
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00084982>] d_kill+0x32/0x60
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<0008505e>] dput+0x6e/0x100
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<0007f96d>] sys_renameat+0x1fd/0x2a0
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00062a0c>] unmap_region+0xbc/0x110
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00200246>] do_md_run+0x6/0x920
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00063db6>] __do_munmap+0x296/0x2c0
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<0007fa37>] sys_rename+0x27/0x30
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00004572>] syscall_call+0x7/0xb
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00200246>] do_md_run+0x6/0x920
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] [<00200206>] md_notify_reboot+0xb6/0xf0
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] Code: 0f bd 0d c0 6a c3 c0 0f 44 ca 8d 14 cd 08 00 00 00 b9 ff ff ff ff 89 14 24 ba ff ff ff ff e8 93 60 0c 00 53 9
d 83 c4 04 5b 5e c3 <0f> 0b eb fe 8d b4 26 00 00 00 00 57 56 89 c6 53 8b 78 10 f6 00
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] EIP: [<00050f65>] __remove_from_page_cache+0x95/0xa0 SS:ESP 0068:f4cc5d8c
Jan 20 21:32:33 gentoo kernel: [ 3387.500002] ---[ end trace d81cb411896ffb92 ]---
to solve the problem diable kernel option CONFIG_PAX_SEGMEXEC