Hi everyone,

I am going to list down those steps that I used to compile my own kernel version 2.4.31 with grsecuirty 2.1.6-2.4.31-200506141150 patch. This is mainly for Red Hat Linux and will work on version 7.2, 7.3, 8.0 & 9. I have also used these steps for Fedora Core 1 and CentOS 3.x. Actually some of these steps can be used for any linux distributions provided you know what you are doing :D

Before you try these steps, you must have some experiences to compile your own kernel from source and have some basic understanding about LILO (http://www.google.com.sg/search?hl=en&ie=UTF-8&oe=UTF-8&q=lilo+HOWTO&btnG=Google+Search&meta=) or GRUB (http://www.google.com.sg/search?hl=en&ie=UTF-8&oe=UTF-8&q=grub+HOWTO&btnG=Google+Search&meta=). I am using LILO as an example here.

It is a good idea that you update your system first using up2date before this. Here is my little up2date HOWTO (http://www.webhostingtalk.com/showthread.php?s=&threadid=227083).

FOLLOW THIS GUIDE AT YOUR OWN RISK AS I AM NOT RESPONSIBLE IN ANY DAMAGES CAUSED! YOU HAVE BEEN WARNED!!!

BEFORE YOU BEGIN

Before we build our custom kernel, you'll need to know what's in your server. Issue the following command as root to get the necessary names of your hardware, their PCI addresses, and their IRQs:
lspci
An example result for one of my server:
00:00.0 Host bridge: Intel Corp.: Unknown device 2578 (rev 02)
00:01.0 PCI bridge: Intel Corp.: Unknown device 2579 (rev 02)
00:03.0 PCI bridge: Intel Corp.: Unknown device 257b (rev 02)
00:1d.0 USB Controller: Intel Corp. 82801EB USB (Hub #1) (rev 02)
00:1d.1 USB Controller: Intel Corp. 82801EB USB (Hub #2) (rev 02)
00:1d.2 USB Controller: Intel Corp. 82801EB USB (Hub #3) (rev 02)
00:1d.3 USB Controller: Intel Corp. 82801EB USB EHCI Controller #2 (rev 02)
00:1d.7 USB Controller: Intel Corp. 82801EB USB EHCI Controller (rev 02)
00:1e.0 PCI bridge: Intel Corp. 82801BA/CA/DB PCI Bridge (rev c2)
00:1f.0 ISA bridge: Intel Corp. 82801EB ISA Bridge (LPC) (rev 02)
00:1f.1 IDE interface: Intel Corp. 82801EB ICH5 IDE (rev 02)
00:1f.2 RAID bus controller: Intel Corp.: Unknown device 24df (rev 02)
00:1f.3 SMBus: Intel Corp. 82801EB SMBus (rev 02)
02:01.0 Ethernet controller: Intel Corp.: Unknown device 1019
03:06.0 VGA compatible controller: ATI Technologies Inc Rage XL (rev 27)
03:08.0 Ethernet controller: Intel Corp. 82801EB (ICH5) PRO/100 VE Ethernet Controller (rev 01)
Now you can find more information related to the hardware shown above by issuing the following command:
lspci -s 03:08.0 -vv
The output for the above as below:
03:08.0 Ethernet controller: Intel Corp. 82801EB (ICH5) PRO/100 VE Ethernet Controller (rev 01)
Subsystem: Intel Corp.: Unknown device 342a
Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR+ FastB2B-
Status: Cap+ 66Mhz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
Latency: 32 (2000ns min, 14000ns max), cache line size 08
Interrupt: pin A routed to IRQ 20
Region 0: Memory at feafe000 (32-bit, non-prefetchable) size=4K
Region 1: I/O ports at bc00 size=64
Capabilities: [dc] Power Management version 2
Flags: PMEClk- DSI+ D1+ D2+ AuxCurrent=0mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
Status: D0 PME-Enable- DSel=0 DScale=2 PME-

You can use lsmod and cat /proc/interrupts to find out more about your current modules etc...
After you have all the necessary information, you can search for it at Google (http://google.com) with a query such as linux 82801EB to know which modules name to use for your hardware.

Ok, here we start... ...

As root, do the following steps in order:

INSTALL DEPENDENCIES PACKAGES

Step 1: Install gcc and all its dependencies packages

We need gcc to compile kernel. Simply run this command to install if it is not installed gcc and all its dependencies:
up2date gcc
OR if you are using Fedora you can use up2date or yum:
yum install gcc

Step 2: Install ncurses-devel and all its dependencies packages

ncurses-devel package is needed while compiling kernel from source specially for running make menuconfig:
up2date ncurses-devel
OR if you are using Fedora you can use up2date or yum:
yum install ncurses-devel

Step 3: Install patch package

You need patch package to be install so that you can use it to patch the kernel source:
up2date patch
OR if you are using Fedora you can use up2date or yum:
yum install patch

HERE WE REALLY BEGIN

Step 1: Change your current working directory

For me, I choose to download the kernel to /usr/local/src but you are free to choose a directory to store and build/compile your kernel.
cd /usr/local/src
Step 2: Download the latest stable kernel version 2.4.x series which is 2.4.31
wget -c http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.31.tar.bz2
Step 3: Download the grsecurity patch
wget -c http://www.grsecurity.net/grsecurity-2.1.6-2.4.31-200506141150.patch.gz
Step 4: Unpack the kernel source
tar xvfj linux-2.4.31.tar.bz2
Step 5: Patch the kernel source with grsecurity patch
gunzip < grsecurity-2.1.6-2.4.31-200506141150.patch.gz | patch -p0
Step 6: Change your current working directory to the kernel source directory
cd linux-2.4.31
Step 7: Clean your kernel source configuration etc...
make clean && make mrproper
Step 8: Use your current configuration to configure your new kernel

You might want to backup your current kernel modules and configuration.
cp /boot/config-`uname -r` .config
make oldconfig
make menuconfig
When you configure your kernel configuration using make oldconfig to use the current booted kernel configuration, please set CONFIG_CRYPTO=y and CONFIG_CRYPTO_SHA256=y within the CRYPTO option and nothing else within it. Then when you come to GRSECURITY option, set it to y and in Security level option can be set to Low, Medium or High. I set mine to Medium. The following are the explanation for each option:

Low additional security

If you choose this option, several of the grsecurity options will be enabled that will give you greater protection against a number of attacks, while assuring that none of your software will have any conflicts with the additional security measures. If you run a lot of unusual software, or you are having problems with the higher security levels, you should say Y here. With this option, the following features are enabled:

linking restrictions
fifo restrictions
random pids
enforcing nproc on execve()
restricted dmesg
random ip ids
enforced chdir("/") on chroot

Medium additional security

If you say Y here, several features in addition to those included in the low additional security level will be enabled. These features provide even more security to your system, though in rare cases they may be incompatible with very old or poorly written software. If you enable this option, make sure that your auth service (identd) is running as gid 10 (usually group wheel). With this option the following features (in addition to those provided in the low additional security level) will be enabled:

random tcp source ports
failed fork logging
time change logging
signal logging
deny mounts in chroot
deny double chrooting
deny sysctl writes in chroot
deny mknod in chroot
deny access to abstract AF_UNIX sockets out of chroot
deny pivot_root in chroot
denied writes of /dev/kmem, /dev/mem, and /dev/port
/proc restrictions with special gid set to 10 (usually wheel)
address space layout randomization
removal of addresses from /proc/<pid>/[maps|stat]

High additional security

If you say Y here, many of the features of grsecurity will be enabled, that will protect you against many kinds of attacks against your system. The heightened security comes at a cost of an increased chance of incompatibilities with rare software on your machine. Since this security level enables PaX, you should view <http://pax.grsecurity.net> and read about the PaX project. While you are there, download chpax and run it on binaries that cause problems with PaX. Also remember that since the /proc restrictions are enabled, you must run your identd as group wheel (gid 10). This security level enables the following features in addition to those listed in the low and medium security levels:

additional /proc restrictions
chmod restrictions in chroot
no signals, ptrace, or viewing processes outside of chroot
capability restrictions in chroot
deny fchdir out of chroot
priority restrictions in chroot
segmentation-based implementation of PaX
mprotect restrictions
kernel stack randomization
mount/unmount/remount logging
kernel symbol hiding

If you need to customized the Grsecurity options, you will need to run make menuconfig then go to Grsecurity option there and set the Security level to Customized and you are on your own since I am not a grsecurity guru :stickout

Many thanks to BigGorilla for more information about grsecurity configuration:
Spender's directory (http://grsecurity.net/~spender/) - includes a quickstart guide to grsecurity.
Grsecurity Config Help (http://grsecurity.net/confighelp.php) - list of all the grsec config options and what they do.

It is also a good idea for you to run make menuconfig so that you can disable one or more of the following which you have to make sure you really don't need it:
Telephony Support
Fusion MPT device support
IEEE 1394 (FireWire) support (EXPERIMENTAL)
Amateur Radio support
IrDA (infrared) support
ISDN subsystem
Multimedia devices
Sound
USB support
Old CD-ROM drivers (not SCSI, not IDE)
Bluetooth support
Library routines
Step 9: make dep
make dep
Setp 10: make bzImage
nohup make bzImage &
You will see something like:
nohup: appending output to `nohup.out'
Just press ENTER then issue this command to view the nohup.out
tail -f nohup.out
To exit from the above, use CTRL+C keys.
Check for any errors and when in doubts do not continue. Use the error message as the search terms to do your search at google might helps you.

Step 11: make modules & make modules_install

Bring up another new xterm shell window and follow these steps: This step is required ONLY if you had enabled Loadable module support in step "Configure Step" above. Loadable module are located in /lib/modules. You MUST do this step if you enabled or disabled any modules, otherwise you will get 'unresolved symbols' errors during or after kernel boot.
nohup make modules 1> modules.out 2> modules.err &

HAVE A BREAK

Step 12: Check
Make modules will take several minutes depending on your server specs. If you are curious about whether did make modules finish, issue ps auwx|grep make to check. Once you know that make modules finishes, check all the previous make...
less nohup.out
less modules.err
less modules.out
Again check for any errors and when in doubts do not continue. Use the error message as the search terms to do your search at google might helps you.

Step 13: Install the modules
After checking and there is no error for make bzImage and make modules, it is time to install your newly build modules.
make modules_install

Step 14: Bootloader and others
cp .config /boot/config-2.4.31-grsec
cp arch/i386/boot/bzImage /boot/vmlinuz-2.4.31-grsec
cp System.map /boot/System.map-2.4.31-grsec
mkinitrd /boot/initrd-2.4.31-grsec.img 2.4.31-grsec
If you are using LILO as your bootloader, edit your /etc/lilo.conf file to add this new kernel but do not set it as default boot kernel. An example as below:

image=/boot/vmlinuz-2.4.31-grsec
label=2.4.31-grsec
append="root=LABEL=/"
read-only
initrd=/boot/initrd-2.4.31-grsec.img
If you are using GRUB as your bootloader, edit /boot/grub/grub.conf file to add this new kernel but do not set it as default boot kernel. An example as below:
title Red Hat Linux (2.4.31-grsec)
root (hd0,0)
kernel /vmlinuz-2.4.31-grsec ro root=LABEL=/
initrd /initrd-2.4.31-grsec.img
Step 15: Test your new kernel
If you are using LILO, use the following command to check errors and update your LILO:
lilo -v -v
lilo
Then set LILO to boot to the new kernel for the next reboot:
lilo -R 2.4.31-grsec
If you are using GRUB, check out this thread (http://www.webhostingtalk.com/showthread.php?s=&threadid=235241)

Assume your default boot kernel is in the first entry among the rest of the kernels.
Add your new kernel in the first entry among the rest of the kernels (on top of your first original kernel which is the first entry before changes). You just change default=1 and fallback=2.
grub shell
grub> savedefault --default=0 --once
grub> quit
Then reboot:
reboot
If your system unable to boot up to the new kernel or causing all type of errors, then you have to reboot the server back to its default/old kernel. Thus it is good to have Remote Reboot Port (RRP) or APC MasterSwitch or similiar so that you don't have to call up your provider just for a reboot. Alternatively you can ask your provider to test your new kernel for you.

If the system is able to boot to your new kernel, please use lsmod, dmesg, cat /var/log/boot.log etc... to check any errors. Leave the system there running with this new kernel at least for a week to test for any errors before setting it as the default kernel.

Again, NEVER set your new kernel as default boot kernel until you have tested it and run FINE for a period of time like a week or so to make sure that your kernel is stable with no error.

References:
Grsecurity (http://www.grsecurity.net/)
Grsecurity Features (http://www.grsecurity.net/features.php)
Kernel (http://kernel.org/)
Kernel HOW TO (http://en.tldp.org/HOWTO/Kernel-HOWTO.html)
Kernel Trap (http://www.kerneltrap.org/)
Kernel Newbies (http://www.kernelnewbies.org/)
Upgrading the Linux Kernel on Red Hat Linux systems (http://www.redhat.com/support/resources/howto/kernel-upgrade/)
Grsecurity at SecurityFocus.com (http://www.securityfocus.com/infocus/1551)

Hope this helps :)

Thanks.

Kindest regards,
Choon
P.S. I might be wrong in certain steps but these steps as listed above work for me
P.P.S. Suggestions or addons are very welcome :)

UPDATED and Leaders please keep this post just in case in future I have more to add where the above post cannot withstand the amount of characters I posted :stickout

Thanks ;)

Hi

It's great that you're posting this, but hope you don't mind giving additional help.

At step 5 it says this to me
-bash patch: command not found

At step 10, it says this to me
[1] 11755
nohup: appending output to `nohup.out'
Is this right?

Also, for the other command, this
[root@aries linux-2.4.24]# tail -f nohup.out
rm -f $tmppiggy $tmppiggy.gz $tmppiggy.lnk
ld -m elf_i386 -Ttext 0x100000 -e startup_32 -o bvmlinux head.o misc.o piggy.o
make[2]: Leaving directory `/usr/local/src/linux-2.4.24/arch/i386/boot/compressed'
objcopy -O binary -R .note -R .comment -S compressed/bvmlinux compressed/bvmlinux.out
tools/build -b bbootsect bsetup compressed/bvmlinux.out CURRENT > bzImage
Root device is (3, 2)
Boot sector 512 bytes.
Setup is 4840 bytes.
System is 914 kB
make[1]: Leaving directory `/usr/local/src/linux-2.4.24/arch/i386/boot'

It stops here, system not hang, but didn't go back. Any problem here?

I will update this HOWTO as the kernel for 2.4.x series is 2.4.25 when I have time but right now you should follow this HOWTO (http://www.webhostingtalk.com/showthread.php?s=&threadid=227083) to get your system up2date if you are using Red Hat Linux 9.

Ok, updated so that it is for kernel version 2.4.25 instead of 2.4.24. Thanks ;)

Hi

This is great, wonderful.

But from step 15, i am using grub, how should i test it and set it to boot to the new kernel from the next reboot?

thanks!

Show us your grub.conf content and also:
ls -al /boot
ls /lib/modules
df -H
If you are sure that your grub entry for the new kernel is alright, you can ask your provider to test boot to the new kernel.

Hi

This is my/etc/grub.conf
default=0
timeout=10
splashimage=(hd0,0)/grub/splash.xpm.gz
title Red Hat Linux (2.4.25-grsec)
root (hd0,0)
kernel /vmlinuz-2.4.25-grsec ro root=LABEL=/
initrd /initrd-2.4.25-grsec.img
title Red Hat Linux (2.4.20-30.9)
root (hd0,0)
kernel /vmlinuz-2.4.20-30.9 ro root=LABEL=/
initrd /initrd-2.4.20-30.9.img
title Red Hat Linux (2.4.20-8)
root (hd0,0)
kernel /vmlinuz-2.4.20-8 ro root=LABEL=/
initrd /initrd-2.4.20-8.img

Ops...
default=0
And the first title is Red Hat Linux (2.4.25-grsec)
You have set that as your default boot kernel :(

Choon,

Thank you for the guide, worked quite well. Like Choon said, if you dont have much kernel experience this will be difficult to understand. New kernel is working perfectly.

Dan

<edit>signature removed</edit>

would this work on RH EL v3 as well? Just curious.

<edit>signature removed</edit>

not really cMark RHE requires nptl patching

<edit>signature removed</edit>

Originally posted by thelinuxguy
not really cMark RHE requires nptl patching

<edit>signature removed</edit>

can someone explain this a bit more? ie how to do it

thanks

Just to let anyone interested, there is a new kernel exploit...
Linux kernel setsockopt MCAST_MSFILTER integer overflow (http://isec.pl/vulnerabilities/isec-0015-msfilter.txt)
And grsecurity patch for 2.4.26 is available at the author's site ;)
I will update this HOWTO when I have time but please consider to upgrade/update your kernel :)

You the man, choon!

Thank you, worked like a charm.

Regards,
Matt

You can also patch the kernel with Openwall security patches since grsecurity site got defaced few weeks ago we don't trust them anymore.
http://www.openwall.com/linux/

<<< Signature removed since it is disallowed in all HOWTO forums >>>

Didn't notice about openwall support 2.4.x series of kernels... all the while I am thinking of they only support 2.2.x series and below... ok, thanks for the info :D

I would appreciate anyone posting in this thread to stick your topic to grsecurity as this is the thread all related to grsecurity patch. Anyone is welcome to post a new thread in the Technical forum to discuss while I test that openwall patch in the 2.4.26 kernel in one of my test box or server :stickout

Once again, thanks and sorry for my outdated notice about openwall patch :stickout

Originally posted by KingAdmin
You can also patch the kernel with Openwall security patches since grsecurity site got defaced few weeks ago we don't trust them anymore.
http://www.openwall.com/linux/

&lt;&lt;&lt; Signature removed since it is disallowed in all HOWTO forums &gt;&gt;&gt;

&nbsp;

it was an april fools joke

<<< Signature removed since it is disallowed in all HOWTO forums >>>

As far as believe it or not it is beyond this thread topic and without providing facts... you decide to believe it or not :rolleyes:

no one can really explain how to do it for RHE? ;)

If you let me try :stickout
Or pay thelinuxguy and learn from him :blush:

Originally posted by choon
If you let me try :stickout
Or pay thelinuxguy and learn from him :blush:

i let you try as long as you stop when you get to make it with no errors and then ***I*** put it on the boot sector ;)

2.4.26 will compile and work on RHEL without problems, 2.6.5 is more difficult but it's do-able.

KingAdmin you will experience Segfaults with bind and other programs since the vanilia kernels do not have ntpl

Originally posted by thelinuxguy
KingAdmin you will experience Segfaults with bind and other programs since the vanilia kernels do not have ntpl

so, the kernel will compile ok, but some programs will not run?

or it won't even compile?

it compiles fine, so does 2.6.5 with and with out grsec

Thanks to choon, we now have an easy way to get rid of segmentation faults with bind and other scripts.

If you are using Red Hat Enterprise Linux ES release 3 (Taroon Update 1), then take a look at this script and follow the instruction or else your will get Segfaults with bind and other programs cannot be started. You can use it on other versions of Red Hat Enterprise Linux, but it will require some modification.


http://choon.net/nptl.php

just a thought...

-bash-2.05b$ cat /etc/redhat-release
Red Hat Enterprise Linux ES release 3 (Taroon Update 1)
-bash-2.05b$ uname -a
Linux server01.* 2.4.21-9.0.1.ELsmp #1 SMP Mon Feb 9 22:26:51 EST 2004 i686 i686 i386 GNU/Linux

so this Taroon Update 1 uses kernel 2.4.21-9.0.1.ELsmp

can't I just download the source of this kernel (i don't know where can i found it, but i'm sure redhat must distribute the source for free because of GPL) and apply the grsecurity patch for kernel 2.4.21?

You can download the source... it is kernel-source rpm... just use up2date to install the source... up2date kernel-source and it will be installed on directory /usr/src. But is it worth since grsecurity patches are for kernel sources from kernel.org and see the difference in the version ;)

you might be able to do that. I havent tried to compile the kernel with grsec yet. :P Im doing that right now.

Just compile 2.4.26 from source then use the script above to get rid of seg faults.

i'm trying to compile it right now

got that:

root@server01 [/usr/local/src/linux-2.4.26]# mkinitrd /boot/initrd-2.4.26-grsec.img 2.4.26-grsec
No module ata_piix found for kernel 2.4.26-grsec, aborting.

should I remove "alias scsi_hostadapter ata_piix" from /etc/modules and run the command again?

thanks

Are you using SATA? Use lsmod to check whether ata_piix is being used.

Originally posted by Lem0nHead
i'm trying to compile it right now

got that:



should I remove "alias scsi_hostadapter ata_piix" from /etc/modules and run the command again?

thanks

libata 28644 0 [ata_piix]

i really don't know which modules I use
i just got the old .config and run the "make"s

libata 28644 0 [ata_piix] not in use so ok for you to comment out that in /etc/modules.conf file ;)

Originally posted by Lem0nHead
just a thought...

-bash-2.05b$ cat /etc/redhat-release
Red Hat Enterprise Linux ES release 3 (Taroon Update 1)
-bash-2.05b$ uname -a
Linux server01.* 2.4.21-9.0.1.ELsmp #1 SMP Mon Feb 9 22:26:51 EST 2004 i686 i686 i386 GNU/Linux

so this Taroon Update 1 uses kernel 2.4.21-9.0.1.ELsmp

can't I just download the source of this kernel (i don't know where can i found it, but i'm sure redhat must distribute the source for free because of GPL) and apply the grsecurity patch for kernel 2.4.21?

I worked at it for about 2 hours, there are to many problems becaause you have to apply other patches to the kernel for security reasons since they use the stock 2.4.21 kernel. ONce you apply the patches grsecurity loses some paths and files and it wont work correctly.

<<< Signature removed >>>

Originally posted by choon
libata 28644 0 [ata_piix] not in use so ok for you to comment out that in /etc/modules.conf file ;)

If i remember correctly isent this the IDE card?

<<< Signature removed >>>

I also not sure... so let us ask google ;)
http://www.google.com.sg/search?q=ata_piix&ie=UTF-8&oe=UTF-8&hl=en&btnG=Google+Search&meta=

its a drive controller bro, you need that. Find the drivers for it.

Well... I commented that for my desktop when I use Fedora since lsmod shown to me that it is used 0... I experienced a few servers which are in used for that which are using SATA thus I just download the libata1 and patch the kernel... so whether is it required to me really depend on it is needed or not. I might be wrong but this is how it worked for me ;)

i found that on lsmod:

libata 28644 0 [ata_piix]
scsi_mod 117800 3 [sg ata_piix libata sd_mod]

so it seens it's not used by libata, but may be being used by scsi_mod?

thanks

Originally posted by choon
Well... I commented that for my desktop when I use Fedora since lsmod shown to me that it is used 0... I experienced a few servers which are in used for that which are using SATA thus I just download the libata1 and patch the kernel... so whether is it required to me really depend on it is needed or not. I might be wrong but this is how it worked for me ;)

Most of SM's dual xeons will require it

<<< Signature removed >>>

Originally posted by Lem0nHead
i found that on lsmod:

libata 28644 0 [ata_piix]
scsi_mod 117800 3 [sg ata_piix libata sd_mod]

so it seens it's not used by libata, but may be being used by scsi_mod?

thanks
Are you using any SCSI devices and/or SATA? If no, just comment out that line then before compile and install any kernel from source... do a reboot to see any error ;)

Originally posted by choon
Are you using any SCSI devices and/or SATA? If no, just comment out that line then before compile and install any kernel from source... do a reboot to see any error ;)

no

well... i'm still afraid it doesn't come back, but gonna try it in 1 (preparing myself psicologically :P )

didn't test too much, but i'd say it worked, despite for bind going down once (before I runned the nptl.sh)

but I have a question:
are you sure this nptl.sh should be put on /etc/profile.d/ and not on /etc/init.d/ ?

apparently this script runs everytime I log with some user (even not root) and I get error message saying i can't move this file

Edit: now I got this script should be run just once
right? ;)

Yes, it must be within the /etc/profile.d. The script should be run just once upon every bootup before those services such as bind being executed to start up. I will modified that script so that only root and to check on log or something so that it won't execute multiple times... ... later ;)

<ADDON>By right it shouldn't be executed if the shell is a login shell ;)</ADDON>

Nice guide Choon!

Couple URL's that might be worthy additions for those brave enough to custom configure grsec:

Spender's directory (http://grsecurity.net/~spender/) - includes a quickstart guide to grsecurity.
Grsecurity Config Help (http://grsecurity.net/confighelp.php) - list of all the grsec config options and what they do.

I don't see them prominently linked anywhere on grsecurity.net, so might be worth a mention.

Hey BigGorilla... many thanks for the links especially the second one... ;)
Will update in my little HOWTO for the next update... or release of the kernel :eek: :stickout
Once again, many thanks :D

yeah
thanks

i was searching for something like that

Once again, many thanks to BigGorilla as I have included in your info in the HOWTO... :blush: :D

Choon

im a newbie to remote compiles but thanks to you I got grsecuirty up and running.

Thank you so much. YOU SHOULD CONSIDER doing this for a LIVING.


CHEERS
Brandon

:D

i think he does :P

Originally posted by thelinuxguy
i think he does :P
Should I start to issue warning on :topic: :dgrin: (j/k)
Well... hehe... I am not going to discuss about this in this grsecurity thread :rolleyes: :angel:

I put nptl-profile.sh in /etc/profile.d folder but after doing this I cannot loginn anymore, what's wrong with it?

Thanks

Anymore info besides what you just posted? What you have done besides putting that nptl-profile.sh as /etc/profile.d/nptl.sh ?

Thanks for the reply.

What you have done besides putting that nptl-profile.sh as /etc/profile.d/nptl.sh

Nothing, putting that script there made me simply unable to login, I tried to login as unprivileged user since direct root login is disabled.

I removed the script and could login again, I cannot explain this...

Try to download the script again. I have modified checking for root and hopefully this does fix your problem ;)

Thank you choon, I will try it and let you know

Yes, it works :)

Thank you choon

You are welcome and glad it helps :D

hey choon

do you know if it will work applying the patch to fix the kernel crashes (the famous one that was found on 2.4.x and 2.6.x)?

Originally posted by Lem0nHead
hey choon

do you know if it will work applying the patch to fix the kernel crashes (the famous one that was found on 2.4.x and 2.6.x)?

Does not work, i tested it out, crashed the box still.

<signature removed since this thread from the start I removed all signatures>

Originally posted by thelinuxguy
Does not work, i tested it out, crashed the box still.

hmm.. that sucks

http://forums.grsecurity.net/viewtopic.php?t=849
says the same

Originally posted by thelinuxguy
Does not work, i tested it out, crashed the box still.
Well... which file you test? I test on the following:
wget -O crash.c http://linuxreviews.org/news/2004-06-11_kernel_crash/krnl-1.c.txt
gcc crash.c -o evil
./evil >/dev/null 2>&1 &
Then I run top -c and see that evil script is running for more than 30 minutes without crashing or causing any high load... just high CPU... do I get the right file?

Originally posted by Lem0nHead
hey choon

do you know if it will work applying the patch to fix the kernel crashes (the famous one that was found on 2.4.x and 2.6.x)?
I have already updated my HOWTO about which file to patch. Thanks ;)

Originally posted by choon
Well... which file you test? I test on the following:
wget -O crash.c http://linuxreviews.org/news/2004-06-11_kernel_crash/krnl-1.c.txt
gcc crash.c -o evil
./evil >/dev/null 2>&1 &
Then I run top -c and see that evil script is running for more than 30 minutes without crashing or causing any high load... just high CPU... do I get the right file?

Server was down for 4 hours because of it.

<signature removed since this thread from the start I removed all signatures>

Hmmm... no for my case... which patch you apply? Is it:
http://linuxreviews.org/news/2004-06-11_kernel_crash/24_kernel_ia32-and-x86_64-fix-fpu-state.patch.txt

Originally posted by cMark
Thanks to choon, we now have an easy way to get rid of segmentation faults with bind and other scripts.

If you are using Red Hat Enterprise Linux ES release 3 (Taroon Update 1), then take a look at this script and follow the instruction or else your will get Segfaults with bind and other programs cannot be started. You can use it on other versions of Red Hat Enterprise Linux, but it will require some modification.


h t t p :// choonhost . net / nptl - profile . txt

Ermm, that link's now dead. Can we have an alternate please choon? (Stupid forum not allowing me to pass URL's until my 6th post...)

I have edited the post to reflect the updated link. Thanks.

anyone already tried following almost the same steps for kernel 2.4.27?

can we expect another how-to for this kernel soon, choon? ;)

Steps are exactly the same just the files are different ;)
I will update this HOWTO later when free... ...

<EDIT>HOWTO Updated</EDIT>

Sorry, this post isn't about HOWTO but just for your information... http://grsecurity.net/ got its new look which I just noticed few minutes ago :D

today I started getting errors when loging and, after debugging a little, I found the reason

mv /lib/tls /lib/tls.disabled was moving /lib/tls to /lib/tls.disabled/tls

maybe a rm -rf /lib/tls.disabled before would fix that?

thanks

No, you can't just delete that if you intend to use stock kernel anytime. Any files in /lib/tls.disabled/tls ? May I know which kernel version you boot to which lead you to encounter such error?

Originally posted by choon
No, you can't just delete that if you intend to use stock kernel anytime. Any files in /lib/tls.disabled/tls ? May I know which kernel version you boot to which lead you to encounter such error?

root@server01 [~]# uname -a
Linux server01.xxx.com 2.4.26-grsec #1 SMP Fri Apr 30 22:45:21 BRT 2004 i686 i686 i386 GNU/Linux

it's weird that it was everything ok for more than 1 month

there where all the /lib/tls files on /lib/tls.disabled/tls

so that's problably happening what I said
instead of moving /lib/tls/ to /lib/tls.disabled/, it was moving to /lib/tls.disabled/tls/

thanks

now i'm afraid to reboot

if it can't move the files to /lib/tls.disabled/ (because of this error), the system won't start, will it?

Show me the output:
ls -al /lib/tls.disabled/

Originally posted by choon
Show me the output:
ls -al /lib/tls.disabled/

now it's "fixed"
because i deleted all files of /lib/tls.disabled and moved the files from /lib/tls.disabled/tls to /lib/tls.disable

but i don't know if it may happen again

BTW, as long as you boot to vanilla kernel... you should be safe but you are still using 2.4.26 kernel?

Originally posted by choon
BTW, as long as you boot to vanilla kernel... you should be safe but you are still using 2.4.26 kernel?

yep
i think now i'm motivated to try with 2.4.27 ;)

but i'd me sure it works

doesn't it makes sense that, if /lib/tls.disabled/ exists, the command "mv /lib/tls /lib/tls.disabled" will move tls/ to /lib/tls.disabled/tls
while the correct would be something like "delete what's on tls.disabled and put tls instead

If you are using my script, the script will only move /lib/tls to /lib/tls.disabled if /lib/tls is a directory. If /lib/tls is not found, then nothing will be done ... ...

Originally posted by choon
If you are using my script, the script will only move /lib/tls to /lib/tls.disabled if /lib/tls is a directory. If /lib/tls is not found, then nothing will be done ... ...

yes
i'm using it
but what if /lib/tls and /lib/tls.disabled dir exists (like this case)?
it will do the following command:
mv /lib/tls /lib/tls.disabled

right?

since /lib/tls.disabled exists, the /lib/tls will be moved to /lib/tls.disabled/tls and not /lib/tls.disabled

-bash-2.05b$ mkdir a
-bash-2.05b$ mkdir b
-bash-2.05b$ mv b a
-bash-2.05b$ cd a
-bash-2.05b$ ls
b

b/ was moved to a/b, and not b/

if you create a new dir and issue the command again, you'll receive the error:

-bash-2.05b$ cd ..
-bash-2.05b$ mkdir b
-bash-2.05b$ mv b a
mv: cannot overwrite directory `a/b'

Yes but why will that moved directory exists after the move?

Originally posted by choon
Yes but why will that moved directory exists after the move?

won't it be created somewhen?

i do auto-updated on crontab of RHEL and the dir just appeared one day (although i can't assure it was because RHEL up2date)

If you are sure it is due to up2date, then in future do this before running any up2date...
mv /lib/tls.disabled /lib/tls
Then run up2date... after that move back:
mv /lib/tls /lib/tls.disabled

just trying to understand

i though this dir (/lib/tld) would be created every restart
if it won't be created anymore, why to do a profile that "renames" it instead of just renaming once?

It is not /lib/tld... it is /lib/tls.
Some using export LD_ASSUME_KERNEL=2.4.1 as it suppose to force ld-linux.so.2 to ignore /lib/tls... ... my script to move /lib/tls is just an added part to ensure /lib/tls won't be used.
Hmmm... upon every restart /lib/tls will be created??? I didn't hear anyone about this... can you please counter-check?
I can't understand what you trying to ask in your last question.
If /lib/tls is found and kernel is non-stock then it will be moved... ... I move /lib/tls if it is booted to vanilla kernel and move /lib/tls back if it is booted to stock kernel... ...

i understood now
i though the script just moved /lib/tls/ to /lib/tls.disabled/, and didn't move it back if it were other kernel

thanks for the explanation

The problem is, when up2date was ran recently it upgraded GLIBC which will readd /lib/tls directory

<signature removed since this thread from the start I removed all signatures>

Originally posted by thelinuxguy
The problem is, when up2date was ran recently it upgraded GLIBC which will readd /lib/tls directory
Read one of my replies... I did mentioned about moving back then run up2date then move to disabled... or simply use export... without moving to disabled ... which also can be found in one of my replies or in my script ;)

Originally posted by choon
Read one of my replies... I did mentioned about moving back then run up2date then move to disabled... or simply use export... without moving to disabled ... which also can be found in one of my replies or in my script ;)

I did read it, I was giving the reason why you have to do it. Apparently you did not know the exact reason. Which is why i gave you it. *rolls eyes*

<signature removed since this thread from the start I removed all signatures>

Originally posted by thelinuxguy
I did read it, I was giving the reason why you have to do it. Apparently you did not know the exact reason. Which is why i gave you it. *rolls eyes*
Thanks for your reason and clarification. I know the /lib/tls directory is under glibc package from your previous post then run the below command to counter-check:
rpm -qf /lib/tls

Does anyone receive such errors when compiling bzImage:

gcc -D__KERNEL__ -I/usr/src/linux-2.4.28/include -Wall -Wstrict-prototypes
-Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe
-mpreferred-stack-boundary=2 -march=i686 -nostdinc -iwithprefix include
-DKBUILD_BASENAME=pci_pc -c -o pci-pc.o pci-pc.c
{standard input}: Assembler messages:
{standard input}:1023: Warning: indirect lcall without `*'
{standard input}:1099: Warning: indirect lcall without `*'
{standard input}:1183: Warning: indirect lcall without `*'
{standard input}:1264: Warning: indirect lcall without `*'
{standard input}:1280: Warning: indirect lcall without `*'
{standard input}:1290: Warning: indirect lcall without `*'
{standard input}:1359: Warning: indirect lcall without `*'
{standard input}:1374: Warning: indirect lcall without `*'
{standard input}:1385: Warning: indirect lcall without `*'
{standard input}:1880: Warning: indirect lcall without `*'
{standard input}:1970: Warning: indirect lcall without `*'

And also:

gcc -D__KERNEL__ -I/usr/src/linux-2.4.28/include -Wall -Wstrict-prototypes
-Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe
-mpreferred-stack-boundary=2 -march=i686 -nostdinc -iwithprefix include
-DKBUILD_BASENAME=fault -c -o fault.o fault.c
fault.c: In function `do_page_fault':
fault.c:394: warning: long long unsigned int format, different type arg (arg 2)
fault.c:397: warning: long long unsigned int format, different type arg (arg 2)
fault.c:400: warning: long long unsigned int format, different type arg (arg 2)

Any ideas ?

Warning and Error are different things. Just continue and look for any errors please.

Do you think it is safe to go ahead with the modules, install the kernel and reboot ? Do you think the machine will come back again from the reboot ?

It is common to see warnings.

<signature removed since this thread from the start I removed all signatures>

Originally posted by Vladislav
Do you think it is safe to go ahead with the modules, install the kernel and reboot ? Do you think the machine will come back again from the reboot ?
If you are asking me... my suggestion would be after you have installed the kernel... ask your provider to test boot the newly installed kernel for you... do not set it as default boot kernel ;)

when making modules

mpc.c:330: warning: `mpoa_device_type_string' defined but not used
dn_neigh.c:584: `THIS_MODULE' undeclared here (not in a function)
dn_neigh.c:584: initializer element is not constant
dn_neigh.c:584: (near initialization for `dn_neigh_seq_fops.owner')
make[2]: *** [dn_neigh.o] Error 1
make[1]: *** [_modsubdir_decnet] Error 2
make: *** [_mod_net] Error 2

any ideas?

Originally posted by Lem0nHead
when making modules



any ideas?
Try this after you unpack the 2.4.28 kernel source ;)
cd /usr/local/src/linux-2.4.28
cat net/decnet/dn_neigh.c | sed 's@#include <linux/jhash.h>@#include <linux/jhash.h> \\\
#include <linux/module.h>@g' > net/decnet/dn_neigh.c~
mv net/decnet/dn_neigh.c~ net/decnet/dn_neigh.c

Or use this patch:
--- linux-2.4.28/net/decnet/dn_neigh.c.original 2004-11-23 07:01:03.000000000 +0800
+++ linux-2.4.28/net/decnet/dn_neigh.c 2004-11-23 07:01:46.000000000 +0800
@@ -36,6 +36,7 @@
#include <linux/spinlock.h>
#include <linux/seq_file.h>
#include <linux/jhash.h>
+#include <linux/module.h>
#include <asm/atomic.h>
#include <net/neighbour.h>
#include <net/dst.h>

thanks, it worked

just letting you know that your first patch (the perl one) don't work
it adds a "\" in the end of the first include, messing the compilation

Did you paste the below command in one paste:
cat net/decnet/dn_neigh.c | sed 's@#include <linux/jhash.h>@#include <linux/jhash.h> \\\
#include <linux/module.h>@g' > net/decnet/dn_neigh.c~

Ops... my bad... try this might work :p
cat net/decnet/dn_neigh.c | sed 's@#include <linux/jhash.h>@#include <linux/jhash.h>\
#include <linux/module.h>@g' > net/decnet/dn_neigh.c~

basic simple question
after downloading the vanilla kernel, isn't it needed to download the official patches?!
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.4%2Fpatch-2.4.29.bz2
and
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.4%2Ftesting%2Fincr%2Fpatch-2.4.29-rc4-final.bz2

thanks

Originally posted by Lem0nHead
basic simple question
after downloading the vanilla kernel, isn't it needed to download the official patches?!
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.4%2Fpatch-2.4.29.bz2
and
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.4%2Ftesting%2Fincr%2Fpatch-2.4.29-rc4-final.bz2

thanks
Not necessary... I would advice you to read the README file which can be found in the source after you unpack the tarball.

now it's this error on make modules_install

mkdir -p /lib/modules/2.4.29-grsec/kernel/arch/i386/kernel/
cp cpuid.o edd.o microcode.o msr.o /lib/modules/2.4.29-grsec/kernel/arch/i386/kernel/
cp: cannot stat `cpuid.o': No such file or directory
cp: cannot stat `edd.o': No such file or directory
cp: cannot stat `microcode.o': No such file or directory
cp: cannot stat `msr.o': No such file or directory
make[1]: *** [_modinst__] Error 1
make[1]: Leaving directory `/usr/local/src/linux-2.4.29/arch/i386/kernel'
make: *** [_modinst_arch/i386/kernel] Error 2

no one got this error also?

Can you try to recompile from scratch and see whether the error still appear... ...

sorry
i didn't understand

i followed the steps on the first post

I mean redo from scratch to see whether you still get the same error or not...

Originally posted by choon
I mean redo from scratch to see whether you still get the same error or not...

this time i didn't get the error! :D

will reboot this night for test

btw... do you think that, if no errors were given on nohup.out, modules.out, modules.err (it has just warnings) and lilo didn't say anything wrong... is there a chance that it doesn't work?

thanks

it worked... again ;D

thanks

any ideas if it works on RHEL also, using the nptl patch?

i mean... i've using this tutorial without problems (except this last time that a problem showed up while compiling) since 2.4.26 if I'm not wrong
i just need to do the same now and it will probably work?

thanks

i had problems with php cpu crashing 100% if for example a user programmed a script that called itself recursively unlimited times, and somebody told me this GR security patch is what i need

will this really solve the prob ???

Originally posted by LT_Radio
i had problems with php cpu crashing 100% if for example a user programmed a script that called itself recursively unlimited times, and somebody told me this GR security patch is what i need

will this really solve the prob ???

that's called fork bomb and even a simple bash script can do that:
#!/bin/sh

$0 & $0 &

it starts consuming a lot of CPU resource and other application don't get their time

there isn't a way to don't suffer from that, since it's like a DoS, but there're ways to try to detect and kill process
i'm almost sure grsecurity does that

Originally posted by Lem0nHead
any ideas if it works on RHEL also, using the nptl patch?

i mean... i've using this tutorial without problems (except this last time that a problem showed up while compiling) since 2.4.26 if I'm not wrong
i just need to do the same now and it will probably work?

thanks
No problem for me since I have personally compiled and installed vanilla kernels 2.4.x with my nptl patch in a few RHEL servers.

Originally posted by Lem0nHead
that's called fork bomb and even a simple bash script can do that:
#!/bin/sh

$0 & $0 &

it starts consuming a lot of CPU resource and other application don't get their time

there isn't a way to don't suffer from that, since it's like a DoS, but there're ways to try to detect and kill process
i'm almost sure grsecurity does that

Rlimits can help alot with that.

<signature removed since this thread from the start I removed all signatures>

any hints on this error I got on the new 2.4.34 kernel?

make[3]: *** [aic7xxx_osm.o] Error 1
make[2]: *** [_modsubdir_aic7xxx] Error 2
make[1]: *** [_modsubdir_scsi] Error 2
make: *** [_mod_drivers] Error 2