mainDazuko - Support: sr #105754, Dazuko not reloaded in kernel at...

 
 

sr #105754: Dazuko not reloaded in kernel at boot, SuSE 10.2

Submitter:  Duane Tash <duane52>
Submitted:  Wed 31 Jan 2007 09:08:21 PM UTC
   
 
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 19 Jun 2007 03:45:33 PM UTC, comment #7: 

Hi,

Currently it is not possible to use AppArmour and Dazuko together as security modules. AppAmour does not allow stacking and also refuses to load a secondary module. Novell is aware of this and has considered allowing Dazuko to stack. I do not know the current status.

One possible workaround is to use syscall hooking instead of running Dazuko as a security module. You can do this by configuring Dazuko with:

$ ./configure --enable-syscalls --mapfile=/boot/System.map-`uname -r`

Be aware of the possible problems you may encounter when using this method:
http://www.dazuko.org/tgen.shtml#SYSCALL-HOOKING

John Ogness <ogman>
Group administrator
Mon 18 Jun 2007 11:17:34 PM UTC, comment #6: 

Hi Damon,

I started the thread with a fix that's always worked for me through several kernel updates with 10.2, but I've never been able to have APPARMOUR and Dazuko work together.  I played around for quite a while and just as a user I was successful with one or the other working fine, but not together.  I really wanted Dazuko to load and stay loaded, so I disabled  APPARMOUR in the run options in Yast.  It was more important to me to have AntiVir worked perfectly than APPARMOUR.

Duane

Duane Tash <duane52>
Mon 18 Jun 2007 07:02:07 PM UTC, comment #5: 

Can I reopen this thread with a dumb question?

I've been trying to do the same - load up DAZUKO on OpenSUSE 10.2. Following the below instructions as best I could does in fact get DAZUKO to run on system boot, the trouble is APPARMOUR then fails to initiate. How do you get both to initiate on boot? Is it possible?

Please, any answers can you write in dumb user language as I'm pretty knew to LINUX.

Thanks.

Damon Swatton <newsuseuser>
Thu 12 Apr 2007 05:59:48 PM UTC, comment #4: 

Update FYI:  Not too long ago I updated my kernel as part of a SuSE 10.2 update to kernel 2.6.18.8_0.1_default.  I found I had to do over again what I have already discussed, EXCEPT, this time I had to do the step $ ./configure --enable-syscalls --mapfile=/path/to/mapfile even though I did not have AppArmor enabled.  Everything has been working 100% OK for realtime scanning and is still OK after rebooting.

Duane Tash

Duane Tash <duane52>
Sat 10 Feb 2007 02:11:27 PM UTC, comment #3: 

Yes, I agree 100% in trying to always use Yast.  However, in my case the Dazuko module never remained as a boot module after booting.  Also, the Dazuko module loaded via Yast did not work for me.  A number of the steps I did according to the Dazuko FAQ for SuSE were done via Yast, and I also did not have to do step 3. "3. modify the boot parameters to disable NSA SELinux support

- edit /boot/grub/menu.lst and add "selinux=0" to the end of the line:
kernel hd(... showopts"

After I did these various steps I discussed earlier the Dazuko module remained as a boot module  through numerous reboots and that was now about several weeks ago.

I expected it to kick-out again as a boot module, but it remained, and is 100% stable today.  After spending what seemed an eternity surfing and trying various fixes, I decided to drop back and also do for SuSE 10.2 as the Dazuko FAQ had outlined for SuSE  9.1, and it worked!

Thanks for your feedback,

Duane

Duane Tash <duane52>
Sat 10 Feb 2007 10:15:48 AM UTC, comment #2: 

If you want to modify the boot parameters permanently, wouldn't it be better to do it through YaST? Everything that is under the control of YaST (config files, etc.) should be changed only with its modules, because the next time you run SuSEConfig (eg. when you install packages) hand-made changes may be overwritten.

Anonymous
Sun 04 Feb 2007 05:37:39 AM UTC, comment #1: 

Oops, I forgot to mention I did not do step (3.) as listed above.  Dazuko stayed loaded after booting as a kernel module after doing all other steps I mentioned above and omitting step 3.   I did not do step 3., because in /boot/grub/menu.lst there was a commented out message by SuSE not to edit anything there as already set by Yast.  And in my case, apparently, this step was not needed.

3. modify the boot parameters to disable NSA SELinux support

- edit /boot/grub/menu.lst and add "selinux=0" to the end of the line:
kernel hd(... showopts

Duane

Duane Tash <duane52>
Wed 31 Jan 2007 09:08:21 PM UTC, original submission:  

I've been using Dazuko releases together with a number of SuSE and AntiVir releases for quite awhile.  I am not using SuSE AppArmor and have it disabled in Yast in SuSE.  I recently installed openSUSE 10.2 and installed the Dazuko kernel module with no difficulty, AntiVir functioned correctly...  On reboot, the Dazuko module did not load.  If I started it manually, it worked, and all was fine scanning realtime with AntiVir.  As AppArmor is enabled by default in SuSE 10.2, I had already disabled it before loading Dazuko.

I surfed the Internet quite a bit and found others have had similar problems with Dazuko in SuSE 10.2.  I tried a number of solutions listed on the Internet I found in surfing, none worked.

My Resolution:  After installing Dazuko kernel as normal, per the excellent HOWTO Install on the Dazuko website, I then referenced the FAQ for SuSE 9.1, steps 2. through 5.  Note:  As I am not using AppArmor, I did not do the step $ ./configure --enable-syscalls --mapfile=/path/to/mapfile

From the SuSE 9.1 Dazuko FAQ I did:

2. copy dazuko.ko to kernel module directory and refresh module dependencies

# cp dazuko.ko /lib/modules/`uname -r`/kernel/security
# depmod -a

3. modify the boot parameters to disable NSA SELinux support

- edit /boot/grub/menu.lst and add "selinux=0" to the end of the line:
kernel hd(... showopts

4. set Dazuko and Capability to be automatically loaded on startup

- edit /etc/sysconfig/kernel and change the line:
MODULES_LOADED_ON_BOOT=""
     to
MODULES_LOADED_ON_BOOT="dazuko capability"

5. reboot machine

From then on the Dazuko module loaded fine on reboot and AntiVir worked properly for realtime scanning.

I'm just passing this on as an FYI, hopefully of some help, as to what I experienced.  As I found I'm not alone with this difficulty, I was wondering if perhaps something for SuSE 10.2 might be needed in the Dazuko FAQ on the Dazuko website, if necessary.

Thanks for listening and I am very grateful to the developers for Dazuko!

Thanks,

Duane


Duane Tash <duane52>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by newsuseuser (Posted a comment)
  • -email is unavailable- added by ogman (Updated the item)
  • -email is unavailable- added by duane52 (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-19 ogman Assigned toogman None
    2007-04-12 ogman Assigned toNone ogman
    2007-01-31 duane52 Carbon-Copy- Added duane52

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code