Chris S wrote:
Mike Edenfield wrote:
I've never been able to get mono to build with the hardened kernel
extensions active. The problem, as you might have already deduced, is
that mono violates some of hardened's protection bits -- specifically,
the mono runtime tries to execute data as code. Once mono's installed
you can flag the binary to permit this. But during the build, a new
mono binary is built then run against some IL code, and it fails.
I have always had success in building mono by keeping a separate
kernel around without and of the GRSEC stuff compiled it. It's a pain
in the ass but works. I suspect the only real 'solution' would be to
somehow hack up the ebuild to detect GRSEC and set the proper flags on
the new binary mid-build.
Thank you for your reply. This makes sense. I guess the problem is that
I need to run .net as a service on an internet visible server. I do not
however want to remove hardened just for the sake of .net support!
Do you think it is possible to create an entirely seperate chroot
environment on said server, from which to run apache on a non-standard
port, which is non-hardened and has mono support?
You don't need to disable the GRSEC stuff to run mono --
only to build it. Once it's build and in place in the right
spot, you can disable the memory protection bits just for
the `mono` binary. You can either put GRSEC into learning
mode and build a profile that way, or just manually toggle
the bits yourself. If I recall, you need to turn off NOEXEC
or PAGEEXEC, whichever you're using, as well as SEGMEXEC for
the mono binary.
--
-- Mike
Still using IE? Get Firefox!
http://www.spreadfirefox.com/?q=affiliates&id=6492&t=1
--
[email protected] mailing list
