Re: nvidia.ko with Grsecurity & PaX kernel
Hinnerk van Bruinehsen <h.v.bruinehsen-j/[email protected]>
| Newsgroups | gmane.linux.gentoo.hardened |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Sep 11, 2013 at 11:44:07PM +0300, Balint Szente wrote: > On Wed, 11 Sep 2013 19:55:13 +0200 > Amadeusz Sławiński <[email protected]> wrote: > > > [...] > > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR=y > > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="or" > > CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR: > > This method is incompatible with binary only modules but > > has a lower runtime overhead. > > > > Try using bts > > Yes, of course! Stupid me. This was it... thank you very much. > > Now there is another issue: > kernel: grsec: denied RWX mmap of /usr/lib64/opengl/nvidia/lib/libGL.so.325.15 > on pretty much everything, but it is a known issue: > <https://bugs.gentoo.org/show_bug.cgi?id=433121> > > So I disabled CONFIG_PAX_MPROTECT for the moment. I'd rather paxctl(-ng) -m the offenders and keep CONFIG_PAX_MPROTECT=y- that way you'd have mprotect for at least everything else. You can also use blueness revdep-pax to make the process easier... WKR Hinnerk
signature.asc
(application/pgp-signature, 490 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (GNU/Linux) iQEcBAEBAgAGBQJSMNlPAAoJEJwwOFaNFkYcG3EH/R+f6FcTXp8pAsmWRT3KUQW6 fzI6ebZxPye2eKpG9+3edi1kQ+Ia2EVChXjs9ycgc8GjUEMvh0RxMAtdvX5Enbyv Iz9a0umXgzC+z8eqx6heKubG1HG+uLJojxvc5cOBWusYAE2Gdmr1QcqAah0HxoZ/ D0h2Iq1d8+LwFKUxEavJCTNVbxDRNjGIJ1m6viBOz/sLi6mZ3hMdWGQ1TQhuZG4N s8cqYhBmHqE+4GzuCBGbVVbXiA9SeFBMqp2Tz/i9CGzvKjO5sPvLamMcBE3GagK2 Rm+loRZk7hUGph7HJHlGxwcn1imXHvngVOhlNFvCa6cqYYSxoBJvKjcDvJzLFQY= =oVe1 -----END PGP SIGNATURE-----