Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel

[Amadeusz Sławiński]

On Wed, 11 Sep 2013 19:57:03 +0300
Balint Szente <balint@×××××××××.ro> wrote:

> Hello!
>
>
> I have a Dell Inspiron N5110 laptop with Optimus. I used Xorg with the
> Intel driver only until now, but I was thinking to start using the
> nVidia card as well, because the HDMI output is connected directly to
> the nVidia GPU.
>
> My kernel:
> Linux 3.10.1-hardened-r1 #4 SMP PREEMPT Sat Sep 7 17:26:02 EEST 2013
> x86_64 Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz GenuineIntel
> GNU/Linux
>
> Please find at the and of the mail the relevant kernel config part.
>
> I emerged =nvidia-drivers-325.15 successfully, but I cannot load the
> nvidia module:
>
> # modprobe nvidia
> modprobe: ERROR: could not insert 'nvidia': Exec format error
>
> The kernel log does not contain any information about this. I tried
> also with the stable 319.49 as well, but the error is the same.
>
> Do you know whether this is a (known) bug in the driver/ebuild or is a
> problematic GRSEC/PAX option in my kernel config?
>
> Regards,
> Balint
>
> Relevant log:
> CONFIG_PAX_KERNEXEC_PLUGIN=y
> CONFIG_PAX_PER_CPU_PGD=y
> CONFIG_PAX_USERCOPY_SLABS=y
> CONFIG_GRKERNSEC=y
> CONFIG_GRKERNSEC_CONFIG_CUSTOM=y
> CONFIG_GRKERNSEC_PROC_GID=10
> CONFIG_PAX=y
> CONFIG_PAX_PT_PAX_FLAGS=y
> CONFIG_PAX_NO_ACL_FLAGS=y
> CONFIG_PAX_NOEXEC=y
> CONFIG_PAX_PAGEEXEC=y
> CONFIG_PAX_EMUTRAMP=y
> CONFIG_PAX_MPROTECT=y
> CONFIG_PAX_KERNEXEC=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR=y
> CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="or"
CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR:
 This method is incompatible with binary only modules but
 has a lower runtime overhead. 

Try using bts

> CONFIG_PAX_ASLR=y
> CONFIG_PAX_RANDKSTACK=y
> CONFIG_PAX_RANDUSTACK=y
> CONFIG_PAX_RANDMMAP=y
> CONFIG_PAX_MEMORY_STACKLEAK=y
> CONFIG_PAX_MEMORY_STRUCTLEAK=y
> CONFIG_PAX_MEMORY_UDEREF=y
> CONFIG_PAX_REFCOUNT=y
> CONFIG_PAX_CONSTIFY_PLUGIN=y
> CONFIG_PAX_USERCOPY=y
> CONFIG_PAX_SIZE_OVERFLOW=y
> CONFIG_PAX_LATENT_ENTROPY=y
> CONFIG_GRKERNSEC_KMEM=y
> CONFIG_GRKERNSEC_RAND_THREADSTACK=y
> CONFIG_GRKERNSEC_PROC_MEMMAP=y
> CONFIG_GRKERNSEC_BRUTE=y
> CONFIG_GRKERNSEC_MODHARDEN=y
> CONFIG_GRKERNSEC_HIDESYM=y
> CONFIG_GRKERNSEC_ACL_HIDEKERN=y
> CONFIG_GRKERNSEC_ACL_MAXTRIES=3
> CONFIG_GRKERNSEC_ACL_TIMEOUT=30
> CONFIG_GRKERNSEC_PROC=y
> CONFIG_GRKERNSEC_PROC_USERGROUP=y
> CONFIG_GRKERNSEC_PROC_ADD=y
> CONFIG_GRKERNSEC_LINK=y
> CONFIG_GRKERNSEC_FIFO=y
> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y
> CONFIG_GRKERNSEC_CHROOT=y
> CONFIG_GRKERNSEC_CHROOT_MOUNT=y
> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
> CONFIG_GRKERNSEC_CHROOT_PIVOT=y
> CONFIG_GRKERNSEC_CHROOT_CHDIR=y
> CONFIG_GRKERNSEC_CHROOT_CHMOD=y
> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
> CONFIG_GRKERNSEC_CHROOT_MKNOD=y
> CONFIG_GRKERNSEC_CHROOT_SHMAT=y
> CONFIG_GRKERNSEC_CHROOT_UNIX=y
> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
> CONFIG_GRKERNSEC_CHROOT_NICE=y
> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
> CONFIG_GRKERNSEC_CHROOT_CAPS=y
> CONFIG_GRKERNSEC_RESLOG=y
> CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
> CONFIG_GRKERNSEC_AUDIT_PTRACE=y
> CONFIG_GRKERNSEC_AUDIT_MOUNT=y
> CONFIG_GRKERNSEC_SIGNAL=y
> CONFIG_GRKERNSEC_FORKFAIL=y
> CONFIG_GRKERNSEC_TIME=y
> CONFIG_GRKERNSEC_PROC_IPADDR=y
> CONFIG_GRKERNSEC_RWXMAP_LOG=y
> CONFIG_GRKERNSEC_DMESG=y
> CONFIG_GRKERNSEC_HARDEN_PTRACE=y
> CONFIG_GRKERNSEC_PTRACE_READEXEC=y
> CONFIG_GRKERNSEC_RANDNET=y
> CONFIG_GRKERNSEC_BLACKHOLE=y
> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y
> CONFIG_GRKERNSEC_FLOODTIME=10
> CONFIG_GRKERNSEC_FLOODBURST=6
>