Re: [gentoo-hardened] xen + pax + grsec

[Brad Plant]

Hi Andreas,

Andreas Philipp wrote:
> I've tried enabling all of pax/grsec while disabling selinux but without
> success. As long as I've enabled
> PAX ->
>     Miscellaneous hardening features ->
>         Sanitize all freed memory
> I even get another error in mm/page_allac.c:
>   CC      mm/page_alloc.o
>   GZIP    kernel/config_data.gz
> mm/page_alloc.c: In function '__free_one_page':
> mm/page_alloc.c:333: error: 'index' undeclared (first use in this function)
> mm/page_alloc.c:333: error: (Each undeclared identifier is reported only
> once
> mm/page_alloc.c:333: error: for each function it appears in.)
>   IKCFG   kernel/config_data.h
> make[1]: *** [mm/page_alloc.o] Error 1
> make: *** [mm] Error 2  CC      kernel/configs.o

I managed to get this error too when I enabled the PAX_MEMORY_SANITIZE
option. But the fix was simple... just a missing 'int index;' at the
start of the function call. I have added this into the patch (attached).

As for your first compile error: I copied the config you sent me into my
kernel sources directory and it compiled fine. I then reread your
original email and noticed that you were using xen-3.0.2 which I missed
initially. This patch is for xen-3.0.3. The ebuilds haven't quite hit
the main tree yet, but they're already in an overlay:

http://overlays.gentoo.org/dev/aross/browser

I actually created my sources manually by performing the commands listed
in the 3.0.2 xen-sources ebuild, but it shouldn't matter which way you
do it. They're both going to give you the same result.

Cheers,

Brad