Re: [gentoo-hardened] xen + pax + grsec

[Andreas Philipp]

Hi Brad,

Am 13.11.2006 um 12:12 schrieb Brad Plant:

> Hi Andreas,
>
> Andreas Philipp wrote:
>> I've tried enabling all of pax/grsec while disabling selinux but
>> without
>> success. As long as I've enabled
>> PAX ->
>>     Miscellaneous hardening features ->
>>         Sanitize all freed memory
>> I even get another error in mm/page_allac.c:
>>   CC      mm/page_alloc.o
>>   GZIP    kernel/config_data.gz
>> mm/page_alloc.c: In function '__free_one_page':
>> mm/page_alloc.c:333: error: 'index' undeclared (first use in this
>> function)
>> mm/page_alloc.c:333: error: (Each undeclared identifier is
>> reported only
>> once
>> mm/page_alloc.c:333: error: for each function it appears in.)
>>   IKCFG   kernel/config_data.h
>> make[1]: *** [mm/page_alloc.o] Error 1
>> make: *** [mm] Error 2  CC      kernel/configs.o
>
> I managed to get this error too when I enabled the PAX_MEMORY_SANITIZE
> option. But the fix was simple... just a missing 'int index;' at the
> start of the function call. I have added this into the patch
> (attached).
>
> As for your first compile error: I copied the config you sent me
> into my
> kernel sources directory and it compiled fine. I then reread your
> original email and noticed that you were using xen-3.0.2 which I
> missed
> initially. This patch is for xen-3.0.3. The ebuilds haven't quite hit
> the main tree yet, but they're already in an overlay:
>
> http://overlays.gentoo.org/dev/aross/browser
>
> I actually created my sources manually by performing the commands
> listed
> in the 3.0.2 xen-sources ebuild, but it shouldn't matter which way you
> do it. They're both going to give you the same result.
>
> Cheers,
>
> Brad
> <grsec-2.1.9-2.6.16.29-xen-3.0.3.patch.gz>

I was already working with the overlays. For me it made no difference  
whether I compiled a kernel compatible with xen-3.0.2/3.0.3 or only  
with xen-3.0.3.
This time I took a closer look at the error itself and finally I  
found the references to arch_align_stack which have caused my  
troubles. The patch is for a kernel with your patch already aplied.  
Now I can compile and link my kernel (I just guessed the changes so  
they can be really garbage.)

Cheers,

Andreas