On Wed, Sep 11, 2013 at 11:44:07PM +0300, Balint Szente wrote: > On Wed, 11 Sep 2013 19:55:13 +0200 > Amadeusz Sławiński <[email protected]> wrote: > > > [...] > > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR=y > > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="or" > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR: > > This method is incompatible with binary only modules but > > has a lower runtime overhead. > > > > Try using bts > > Yes, of course! Stupid me. This was it... thank you very much. > > Now there is another issue: > kernel: grsec: denied RWX mmap of /usr/lib64/opengl/nvidia/lib/libGL.so.325.15 > on pretty much everything, but it is a known issue: > <https://bugs.gentoo.org/show_bug.cgi?id=433121> > > So I disabled CONFIG_PAX_MPROTECT for the moment.
I'd rather paxctl(-ng) -m the offenders and keep CONFIG_PAX_MPROTECT=y- that way you'd have mprotect for at least everything else. You can also use blueness revdep-pax to make the process easier... WKR Hinnerk
signature.asc
Description: Digital signature
