init and /dev/kmem problems on debian stable

[Sleight of Mind]

I got a weird problem on a debian box. I'm using grsec on plenty of boxes but i've never seen this problem before. The box seems to boot as it is supposed to, but dmesg shows me:

Code: Select all

grsec: attempted write to /dev/kmem by (init:8) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: attempted write to /dev/kmem by (init:8) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: attempted write to /dev/kmem by (init:8) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)


Then it continues with booting. It comes up as it is supposed to and i can login using ssh. But when i try to call init (ie. `init 6`) init malfunctions and doesn't do anything. dmesg shows me:

Code: Select all

grsec: From 10.0.0.5: attempted write to /dev/kmem by (init:225) UID(0) EUID(0), parent (init:224) UID(0) EUID(0)
grsec: From 10.0.0.5: attempted write to /dev/kmem by (init:225) UID(0) EUID(0), parent (init:224) UID(0) EUID(0)
grsec: From 10.0.0.5: attempted write to /dev/kmem by (init:225) UID(0) EUID(0), parent (init:224) UID(0) EUID(0)


And init outputs:

Code: Select all

# init 6
/dev/null
Init: idt=0xc02b6000, sct[]=0xc02b7554, kmalloc()=0xc019f1b4, gfp=0x1f0
Init: Allocating kernel-code memory...Done, 12677 bytes, base=0xfffffff2
Done, pid=267


Is it just the init binary that is broken or might there be some other problem around?

[spender]

Yea, looks like your init is just doing strange things. Do you have any idea why it wants to allocate kernel memory?

-Brad

[Sleight of Mind]

It's just the init that comes with debian i guess, since i never replaced it. I've rebuild the kernel with 'deny writing to /dev/kmem' turned off and everything works fine. No idea what's causing this all tho.

[hightower]

It's just the init that comes with debian i guess, since i never replaced it. I've rebuild the kernel with 'deny writing to /dev/kmem' turned off and everything works fine. No idea what's causing this all tho.

funny. I also use Debian on ~500 boxen with grsec and never ever saw this message, only with XFree but that's normal. I really think your init binary is b0rked. Could you verify the md5sum?

ciao, Marc

[PaX Team]

It's just the init that comes with debian i guess, since i never replaced it. I've rebuild the kernel with 'deny writing to /dev/kmem' turned off and everything works fine. No idea what's causing this all tho.

you probably got backdoored by SucKIT, better verify your system.