Re: [gentoo-hardened] xen + pax + grsec

[Andreas Philipp]

Hi Brad,

Am 13.11.2006 um 12:12 schrieb Brad Plant:

Hi Andreas,

Andreas Philipp wrote:

I've tried enabling all of pax/grsec while disabling selinux but without

success. As long as I've enabled
PAX ->
    Miscellaneous hardening features ->
        Sanitize all freed memory
I even get another error in mm/page_allac.c:
  CC      mm/page_alloc.o
  GZIP    kernel/config_data.gz
mm/page_alloc.c: In function '__free_one_page':

once
mm/page_alloc.c:333: error: for each function it appears in.)
  IKCFG   kernel/config_data.h
make[1]: *** [mm/page_alloc.o] Error 1
make: *** [mm] Error 2  CC      kernel/configs.o

mm/page_alloc.c:333: error: 'index' undeclared (first use in this function) mm/page_alloc.c:333: error: (Each undeclared identifier is reported only

I managed to get this error too when I enabled the PAX_MEMORY_SANITIZE
option. But the fix was simple... just a missing 'int index;' at the



kernel sources directory and it compiled fine. I then reread your

initially. This patch is for xen-3.0.3. The ebuilds haven't quite hit
the main tree yet, but they're already in an overlay:

http://overlays.gentoo.org/dev/aross/browser


in the 3.0.2 xen-sources ebuild, but it shouldn't matter which way you
do it. They're both going to give you the same result.

Cheers,

Brad
<grsec-2.1.9-2.6.16.29-xen-3.0.3.patch.gz>

start of the function call. I have added this into the patch (attached). As for your first compile error: I copied the config you sent me into my original email and noticed that you were using xen-3.0.2 which I missed I actually created my sources manually by performing the commands listed

Cheers,

Andreas

I was already working with the overlays. For me it made no difference whether I compiled a kernel compatible with xen-3.0.2/3.0.3 or only with xen-3.0.3. This time I took a closer look at the error itself and finally I found the references to arch_align_stack which have caused my troubles. The patch is for a kernel with your patch already aplied. Now I can compile and link my kernel (I just guessed the changes so they can be really garbage.)

arch_align_stack.patch.gz
Description: GNU Zip compressed data