Re: [gentoo-hardened] linux32 chroot issue

[Anthony G. Basile]

On 02/21/2014 05:48 PM, Alexander Tiurin wrote:
> hi!
>
> emerge  return  errors during build of any atoms in linux32 chroot only.
>
>   (null)*(null) (null)ACCESS DENIED(null):  open_wr:      /dev/tty
>   (null)*(null) (null)ACCESS DENIED(null):  open_wr:      /dev/null
>
> The full log http://pastebin.com/4An1ajY0
>
> stat /dev/{null,tty}
>    File: '/dev/null'
>    Size: 0               Blocks: 0          IO Block: 4096   character
> special file
> Device: 5h/5d   Inode: 1028        Links: 1     Device type: 1,3
> Access: (0666/crw-rw-rw-)  Uid: (    0/    root)   Gid: (    0/    root)
>
>    File: '/dev/tty'
>    Size: 0               Blocks: 0          IO Block: 4096   character
> special file
> Device: 5h/5d   Inode: 1035        Links: 1     Device type: 5,0
> Access: (0666/crw-rw-rw-)  Uid: (    0/    root)   Gid: (    5/     tty)
>
> Kernel 3.11.7-hardened-r1
> Kernel config
> zcat /proc/config.gz | grep -i -e grkern -e pax
> http://pastebin.com/ka63Jf98
>
> emerge --info
> http://pastebin.com/WJ7BRXCA
>
>
> In x86_64 chroot all works fine. Also, with hardened-sources-3.2.52-r3
> linux32 chroot works fine too.
> Please suggest any solution.
>


There's not enough context to really nail it, but start by trying this:

for i in /proc/sys/kernel/grsecurity/chroot_* ; do
   echo 0 > $i
done

Also, can you give my your `df -a` so I can see what is mounted in the 
chroot.  Run that from *outside* the chroot.


-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
[phone]