Re: [gentoo-hardened] Mono build failure

[Mike Edenfield]

Chris S wrote:
> Mike Edenfield wrote:
>
>> I've never been able to get mono to build with the hardened kernel
>> extensions active.  The problem, as you might have already deduced, is
>> that mono violates some of hardened's protection bits -- specifically,
>> the mono runtime tries to execute data as code.  Once mono's installed
>> you can flag the binary to permit this.  But during the build, a new
>> mono binary is built then run against some IL code, and it fails.
>>
>> I have always had success in building mono by keeping a separate
>> kernel around without and of the GRSEC stuff compiled it.  It's a pain
>> in the ass but works.  I suspect the only real 'solution' would be to
>> somehow hack up the ebuild to detect GRSEC and set the proper flags on
>> the new binary mid-build.
>
>
> Thank you for your reply. This makes sense. I guess the problem is that
> I need to run .net as a service on an internet visible server. I do not
> however want to remove hardened just for the sake of .net support!
> Do you think it is possible to create an entirely seperate chroot
> environment on said server, from which to run apache on a non-standard
> port, which is non-hardened and has mono support?
>

You don't need to disable the GRSEC stuff to run mono -- 
only to build it.  Once it's build and in place in the right 
spot, you can disable the memory protection bits just for 
the `mono` binary.  You can either put GRSEC into learning 
mode and build a profile that way, or just manually toggle 
the bits yourself.  If I recall, you need to turn off NOEXEC 
or PAGEEXEC, whichever you're using, as well as SEGMEXEC for 
the mono binary.

-- 
-- Mike

Still using IE? Get Firefox!
http://www.spreadfirefox.com/?q=affiliates&id=6492&t=1
-- 
gentoo-hardened@g.o mailing list