more errors (grsecurity-2.2.2-2.6.39.4-201108132040.patch)

[simonbcn]

The diff between init/.do_mounts.o.cmd files (do_mounts.o.cmd = grsec file / linux-2.6.39.4/init/.do_mounts.o.cmd = vanilla kernel): http://paste.ubuntu.com/671216/

so vanilla passes -fno-stack-protector whereas grsec doesn't. question is where it comes from in the vanilla kernel...

Can I force this with grsec?

[PaX Team]

so vanilla passes -fno-stack-protector whereas grsec doesn't. question is where it comes from in the vanilla kernel...

Can I force this with grsec?

well, passing it in KCFLAGS should fix it but that's a hack as we still wouldn't know the root cause.

[simonbcn]

so vanilla passes -fno-stack-protector whereas grsec doesn't. question is where it comes from in the vanilla kernel...

Can I force this with grsec?

well, passing it in KCFLAGS should fix it but that's a hack as we still wouldn't know the root cause.

Yes, if I pass "KCFLAGS=-fno-stack-protector" it works.
But the problem is that this passes the flag to all compilation kernel.

[simonbcn]

With the last patch: "grsecurity-2.2.2-2.6.39.4-201108211939.patch", it fails too.

[simonbcn]

This is already solved in last grsecurity patch: grsecurity-2.2.2-3.0.4-201109150655.patch.
Thanks.

[Pryka]

I've got still something like this on: "grsecurity-2.2.2-3.0.4-201109150655.patch"

Code: Select all

-hardened-r2/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN -fplugin=/usr/src/linux-3.0.4-hardened-r2/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100   -I/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel -Wall -MD -Wno-cast-qual -Wno-error -D__KERNEL__ -DMODULE -DNVRM -DNV_VERSION_STRING=\"285.03\" -Wno-unused-function -mno-red-zone -mcmodel=kernel -UDEBUG -U_DEBUG -DNDEBUG  -DMODULE  -D"KBUILD_STR(s)=#s" -D"KBUILD_BASENAME=KBUILD_STR(nv_usermap)"  -D"KBUILD_MODNAME=KBUILD_STR(nvidia)" -c -o /var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-usermap.o /var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-usermap.c
/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-procfs.c: In function ‘nv_register_procfs’:
/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-procfs.c:710:5: error: assignment of read-only variable ‘nv_procfs_registry_fops’
/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-procfs.c:711:5: error: assignment of read-only variable ‘nv_procfs_registry_fops’
make[4]: *** [/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel/nv-procfs.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [_module_/var/tmp/portage/x11-drivers/nvidia-drivers-285.03/work/kernel] Error 2
make[2]: *** [sub-make] Error 2
NVIDIA: left KBUILD.
nvidia.ko failed to build!
make[1]: *** [module] Error 1
make: *** [module] Error 2
emake failed
 * ERROR: x11-drivers/nvidia-drivers-285.03 failed (compile phase):
 *   Unable to emake HOSTCC=x86_64-pc-linux-gnu-gcc CROSS_COMPILE=x86_64-pc-linux-gnu- LDFLAGS=  IGNORE_CC_MISMATCH=yes V=1 SYSSRC=/usr/src/linux       SYSOUT=/lib/modules/3.0.4-hardened-r2/build CC=x86_64-pc-linux-gnu-gcc clean module

[spender]

You need this:

https://grsecurity.net/~paxguy1/nvidia- ... onst.patch
and this:
https://grsecurity.net/~paxguy1/nvidia- ... copy.patch

-Brad

[Pryka]

But I have 285 drivers this gonna work?

BTW. Is there any other way to fix this? Some option i grsecurity?

[spender]

You could ask the gentoo maintainer to fix it on their end (though they'd need to apply a conditional patch).

-Brad

[Pryka]

Hmm I'm not sure if this is Gentoo fault.

Yesterday I'm patch clean kernel sources(vanilla) with latest grsecurity patch and there is same problem with nvidia.

Unless u are talking about this Nvidia patch.

[PaX Team]

But I have 285 drivers this gonna work?

i haven't checked 285.x yet but a similar patch is likely needed there as well, just try to apply it and see how far it gets.

BTW. Is there any other way to fix this? Some option i grsecurity?

constifying ops structures is not configurable but you can remove the CONSTIFY_PLUGIN := ... line from the main Makefile if you really don't want it.

[Quark]

Hi,
I created a nvidia-drivers-285.03.ebuild in my overlay.
Give it a try if you like: http://www.startux.de/gitweb/quarks.git

https://grsecurity.net/~paxguy1/nvidia- ... onst.patch works fine for 285.03.
No luck with https://grsecurity.net/~paxguy1/nvidia- ... copy.patch,
but PAX_USERCOPY had to be disabled for the stock nvidia binary drivers previously as well.

So far so good
Stefan

[Quark]

Quick update:

In order to get the nvidia module working having PAX_USERCOPY enabled, one has to actually use the SLAB allocator!
I used the SLUB allocator before ..

Also updated to nvidia-drivers-290.06.ebuild.

Cheers

[PaX Team]

In order to get the nvidia module working having PAX_USERCOPY enabled, one has to actually use the SLAB allocator!
I used the SLUB allocator before ..

the nvidia driver works with SLUB as well, it just needs the patch i mentioned above (i have since updated it to 285 that also applies to 290).

[Quark]

Hi,
confirmed,

With the updated patches the SLUB allocator works too, using 290.10.
I updated my ebuild which includes these patches!