Arch Linux

th3voic3

Member

Registered: 2012-03-20

Posts: 92

[Solved]Linux-grsec in community and Nvidia

Hey,

I'm happy to try out the grsecurity kernel. I've been looking at various MAC systems as of late and I really like this implementation so far.
For know I have resolved to using nouveau, but in the long term I would really like to be able to use Nvidia's module again, since I like to game on this machine.
I was able to build and install it with nvidia-dkms, but it wouldn't load. I saw that it might need to be patched (as is the case with the nvidia-dkms-grsec package in AUR).
It tried modifying the PKGBUILD to include the patch from that package, which kind of worked, but that module also wouldn't load.

Now this might not yet be high on the priority list, but is there anything I can do as of know?

Last edited by th3voic3 (2014-04-23 04:51:26)

---

Github

thestinger

Package Maintainer (PM)

From: Toronto, Canada

Registered: 2010-01-23

Posts: 478

Re: [Solved]Linux-grsec in community and Nvidia

Patching the shims between the binary blob and the kernel usually works, but it's not supported by either the grsecurity upstream or Nvidia so it's not something that's going to be in the official repositories. I haven't included the necessary GCC plugin stuff in the package yet for building out-of-tree modules. I'll release 3.14.1.201404201132-2 soon with working DKMS support.

Last edited by thestinger (2014-04-22 21:43:53)

th3voic3

Member

Registered: 2012-03-20

Posts: 92

Re: [Solved]Linux-grsec in community and Nvidia

Ok great. I'll mark this as solved :-)

---

Github

thestinger

Package Maintainer (PM)

From: Toronto, Canada

Registered: 2010-01-23

Posts: 478

Re: [Solved]Linux-grsec in community and Nvidia

I pushed the fixed package and confirmed that I can built the VirtualBox host modules via DKMS and load them. Previously it would build an invalid module since it didn't have the modules. Hopefully it works for you with Nvidia now.

th3voic3

Member

Registered: 2012-03-20

Posts: 92

Re: [Solved]Linux-grsec in community and Nvidia

I pushed the fixed package and confirmed that I can built the VirtualBox host modules via DKMS and load them. Previously it would build an invalid module since it didn't have the modules. Hopefully it works for you with Nvidia now.

I just tried and now the module doesn't build anymore. I get a "kernel configuration is invalid" - message
Edit: I also tried to build the virtualbox modules just now and I also get the following (also got those with Nvidia I think)

cc1: error: incompatible gcc/plugin versions
cc1: error: fail to initialize plugin /usr/lib/modules/3.14.1-2-grsec/build/tools/gcc/stackleak_plugin.so
cc1: error: incompatible gcc/plugin versions
cc1: error: fail to initialize plugin /usr/lib/modules/3.14.1-2-grsec/build/tools/gcc/colorize_plugin.so
cc1: error: incompatible gcc/plugin versions
cc1: error: fail to initialize plugin /usr/lib/modules/3.14.1-2-grsec/build/tools/gcc/structleak_plugin.so

Maybe I'm doing something wrong?

Edit2: Hm. Also, I just tried to create my learned policy and there were 7 holes found. (Among them stuff like me having write access to stuff in my path, bspwm's config for example). I guess I just can't make this work for now. I appreciate your effort though, I just think I have to learn a bit more about how the whole system works, since I couldn't fix the policy myself.

Last edited by th3voic3 (2014-04-23 12:11:02)

---

Github

thestinger

Package Maintainer (PM)

From: Toronto, Canada

Registered: 2010-01-23

Posts: 478

Re: [Solved]Linux-grsec in community and Nvidia

I'm building the VirtualBox modules with the following command:

dkms install vboxhost/4.3.10 -k 3.14.1-2-grsec

It seems to be working fine. You need linux-grsec-headers and likely the current gcc in [core].

Edit2: Hm. Also, I just tried to create my learned policy and there were 7 holes found. (Among them stuff like me having write access to stuff in my path, bspwm's config for example). I guess I just can't make this work for now. I appreciate your effort though, I just think I have to learn a bit more about how the whole system works, since I couldn't fix the policy myself.

I definitely need to work on the documentation and start shipping a basic working permissive policy + systemd service. It's still the early days for these packages.

Last edited by thestinger (2014-04-23 18:53:03)

th3voic3

Member

Registered: 2012-03-20

Posts: 92

Re: [Solved]Linux-grsec in community and Nvidia

I know and I'm really glad that you're doing what you're doing. :-)
Edit: For anyone wondering: I solved my problem by installing gcc and libtool from [core]. I had installed the ones from [multilib]

Last edited by th3voic3 (2014-04-24 05:40:26)

---

Github

BitThief

Member

Registered: 2014-04-24

Posts: 1

Re: [Solved]Linux-grsec in community and Nvidia

Hey,

I'm happy to try out the grsecurity kernel. I've been looking at various MAC systems as of late and I really like this implementation so far.
For know I have resolved to using nouveau, but in the long term I would really like to be able to use Nvidia's module again, since I like to game on this machine.
I was able to build and install it with nvidia-dkms, but it wouldn't load. I saw that it might need to be patched (as is the case with the nvidia-dkms-grsec package in AUR).
It tried modifying the PKGBUILD to include the patch from that package, which kind of worked, but that module also wouldn't load.

Now this might not yet be high on the priority list, but is there anything I can do as of know?

Hi,

I have been running a custom built grsec kernel for quite a while now with pretty much all the protections enabled. I am not sure what gets shipped with Daniel's (thestinger) kernel config, but essentially you will need:
1. If you are using the CONSTIFY plugin: a patch for the nvidia-uvm module. I can provide you with one that I made if you need it.
2. If you are using the PAX_USERCOPY protection: the guys working on grsec/PaX provide a patch at https://grsecurity.net/~paxguy1/
The one for 285.09 should work.
And obviously, to set the appropriate paxctl flags on the shared object libraries for stuff like libGL after installing the driver (mostly doing paxctl -m).

I've also noticed that Daniel added gcc plugin support to his PKGBUILD after our last conversation on IRC, so it should just work following my instructions now.
I am running bbswitch and nvidia with no issues on my laptop. I recommend looking at: https://aur.archlinux.org/packages/nvidia-dkms/ and patching the sources in /usr/src after installing the package.
After that install with DKMS and everything should work.

Good luck!

thestinger

Package Maintainer (PM)

From: Toronto, Canada

Registered: 2010-01-23

Posts: 478

Re: [Solved]Linux-grsec in community and Nvidia

And obviously, to set the appropriate paxctl flags on the shared object libraries for stuff like libGL after installing the driver (mostly doing paxctl -m).

This will have to be done via setfattr because I decided to only provide one way of doing this, and extended attributes make a lot more sense than modifying the binary. Arch requires that the filesystems it's installed on support extended attributes so it can be relied upon.

th3voic3

Member

Registered: 2012-03-20

Posts: 92

Re: [Solved]Linux-grsec in community and Nvidia

Hi,

I have been running a custom built grsec kernel for quite a while now with pretty much all the protections enabled. I am not sure what gets shipped with Daniel's (thestinger) kernel config, but essentially you will need:
1. If you are using the CONSTIFY plugin: a patch for the nvidia-uvm module. I can provide you with one that I made if you need it.
2. If you are using the PAX_USERCOPY protection: the guys working on grsec/PaX provide a patch at https://grsecurity.net/~paxguy1/
The one for 285.09 should work.
And obviously, to set the appropriate paxctl flags on the shared object libraries for stuff like libGL after installing the driver (mostly doing paxctl -m).

I've also noticed that Daniel added gcc plugin support to his PKGBUILD after our last conversation on IRC, so it should just work following my instructions now.
I am running bbswitch and nvidia with no issues on my laptop. I recommend looking at: https://aur.archlinux.org/packages/nvidia-dkms/ and patching the sources in /usr/src after installing the package.
After that install with DKMS and everything should work.

Good luck!

I got it working right after my last post. I simply took the nvidia-dkms package and the nvidia-dkms-grsec package. Then I copied the patch from the grsec version and copied it in the regular nvidia-dkms folder, copied over the relevant patch lines from the PKGBUILD and the md5sum and that did it.

I know also got a kind of working but not perfect policy. For example right now my policy breaks systemd-logind. Right now I want to try putting only that subject in learning mode and see if that solves it, but I'm getting the hang of this I think.

---

Github