Bug#836746: linux-image-grsec: Cannot boot grsec within XEN provided VM, missing GRKERNSEC_CONFIG_VIRT_XEN in kernel config ?

Mon, 07 Nov 2016 09:00:45 -0800 

On Mon, 2016-11-07 at 17:30 +0100, Sebastien Bocahu wrote:
> What incompability ?
> Grsecurity documentation does not mention any. I've been running older 
> versions of Linux/Grsec in PV guests for a while and have never spotted 
> any issue.

Check PAX kconfig?

config PAX_KERNEXEC
        bool "Enforce non-executable kernel pages"
        default y if GRKERNSEC_CONFIG_AUTO && (!X86 || 
GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && 
GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && 
GRKERNSEC_CONFIG_VIRT_KVM))
        depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !(ARM_LPAE 
&& MODULES))) && !XEN
        select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
        select ARM_KERNMEM_PERMS if ARM

config PAX_MEMORY_UDEREF
        bool "Prevent invalid userland pointer dereference"
        default y if GRKERNSEC_CONFIG_AUTO && !(X86_64 && 
GRKERNSEC_CONFIG_PRIORITY_PERF) && !(X86_64 && GRKERNSEC_CONFIG_VIRT_HOST && 
GRKERNSEC_CONFIG_VIRT_VIRTUALBOX) && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || 
GRKERNSEC_CONFIG_VIRT_EPT)
        depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !ARM_LPAE)) 
&& !UML_X86 && !XEN
        select PAX_PER_CPU_PGD if X86_64

You can run a grsec kernel with Xen, just not with UDEREF and KERNEXEC, which
then doesn't make much sense.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part

Reply via email to