Arch Linux

zorggy

Member

Registered: 2013-05-30

Posts: 23

grsecurity on server

Hello,

I've got a personal barebone PC used as a server (sshfs and https open on the Internet) running Arch Linux + grsecurity. There is an update and a subsequent reboot every day.

Sometimes there is a power cut because of some storm in the region and usually the next reboot does not work correctly.

journalctl of the reboot:

[...]
systemd[1]: Starting Remount Root and Kernel File Systems...
kernel: grsec: denied socket(netlink,raw,15) by /usr/lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0, parent /[swapper/0:0] uid/euid:0/0 gid/egid:0/0
systemd[1]: systemd-udevd-kernel.socket failed to listen on sockets: Permission denied
systemd[1]: Failed to listen on udev Kernel Socket.
systemd[1]: Unit systemd-udevd-kernel.socket entered failed state.
systemd[1]: Starting udev Kernel Socket.
[...] 30 sec...
systemd[1]: Job dev-disk-by\x2dlabel-local.device/start timed out.
systemd[1]: Timed out waiting for device dev-disk-by\x2dlabel-local.device.

I installed grsecurity because I think it is better in case of a security breach. Is there someone else using it? Do you think I should continue this way?

thoffmeyer

Member

From: Chi

Registered: 2006-07-27

Posts: 91

Re: grsecurity on server

Do you just have it installed or did you configure RBAC (role based access control) along with it?

zorggy

Member

Registered: 2013-05-30

Posts: 23

Re: grsecurity on server

Hello Thoffmeyer,

Thank you for your answer. I just installed three packages: gradm, grsec-common and linux-grsec. The command gradm -S gives: The RBAC system is currently disabled.

thestinger

Package Maintainer (PM)

From: Toronto, Canada

Registered: 2010-01-23

Posts: 478

Re: grsecurity on server

It might be this issue: https://bugs.archlinux.org/task/45807

phoenix

Member

Registered: 2015-03-28

Posts: 18

Re: grsecurity on server

I don't think the bug you linked is the same issue. As i got the same error as the thread starter with linux-grsec 4.1.7.201509201149-1, but it asks me first for my luks password, unlike specified in the bug report. Doesn't seem to happen on every boot though.