mainDazuko - Support: sr #105824, Dazuko-2.3.3 and FC5 error

 
 

sr #105824: Dazuko-2.3.3 and FC5 error

Submitter:  None
Submitted:  Wed 11 Apr 2007 06:10:48 AM UTC
   
 
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 11 Jul 2007 09:01:27 AM UTC, comment #11: 

With the latest Red Hat kernels, system call hooking is not possible. The system call table is effectively protected.

The only option is to build a new kernel where capabilities are a separate module rather than built-in. Then it is possible to load Dazuko as intentdend... with LSM rather than syscall hooking. Information about how to this is available here:

http://fedoraproject.org/wiki/Docs/CustomKernel

John Ogness <ogman>
Group administrator
Tue 10 Jul 2007 06:15:35 PM UTC, comment #10: 

Hello, I also I have the same problem:

[root@host dazuko-2.3.3]# <b>./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-`uname -r`</b>
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/2.6.20-1.2320.fc5/source... yes
kernel build source in /lib/modules/2.6.20-1.2320.fc5/build... yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.20)
checking for System.map file... ok (/boot/System.map-2.6.20-1.2320.fc5)
locating sys_call_table... ok (0xc120c560)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc10641a1)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

=======================
 Configuration summary
=======================

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes
module debug = no
library 1.x compatibility = yes

[root@host dazuko-2.3.3]# <b>make</b>
make -C /lib/modules/2.6.20-1.2320.fc5/build include/linux/version.h include/asm scripts
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686'
  CHK     include/linux/version.h
make[1]: `include/asm' is up to date.
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686'
make -C /lib/modules/2.6.20-1.2320.fc5/build SUBDIRS="/root/pkg/noarch/dazuko/dazuko-2.3.3" modules
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686'
  CC [M]  /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_core.o
  CC [M]  /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686'
touch dummy_rule

[root@host dazuko-2.3.3]# <b>make install</b>
mkdir -p /lib/modules/2.6.20-1.2320.fc5/extra
cp dazuko.ko /lib/modules/2.6.20-1.2320.fc5/extra
/sbin/depmod -ae

[root@host 2.6.20-1.2320.fc5]# <b>modprobe dazuko</b>
FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2320.fc5/extra/dazuko.ko): Operation not permitted

I have tryed also from the console but without success.
With FC5 the problem was resolved?
In that way?
Thank you.

Gian Luca Ziosi <lucapsg>
Mon 16 Apr 2007 04:31:07 AM UTC, comment #9: 

I already install from console. and got here:

[root@xseries ~]# dmesg
Modules linked in: dazuko(U) autofs4 smsc47m1 hwmon i2c_isa sunrpc ipv6 dm_mirror dm_mod video sbs i2c_ec dock container button battery asus_acpi backlight ac lp parport_pc parport ehci_hcd uhci_hcd floppy sg ata_piix libata e1000 serio_raw iTCO_wdt iTCO_vendor_support i6300esb ide_cd i82875p_edac cdrom edac_mc i2c_i801 pcspkr i2c_core ext3 jbd aic7xxx aic79xx scsi_transport_spi sd_mod scsi_mod
CPU:    0
EIP:    0060:[<f8afaf84>]    Not tainted VLI
EFLAGS: 00010287   (2.6.20-1.2312.fc5 #1)
EIP is at xp_sys_hook+0x21/0x2cd [dazuko]
eax: ff400000   ebx: ee88da3c   ecx: c0752624   edx: be20c560
esi: ee88d800   edi: f8afebb8   ebp: f8afe880   esp: c8d68ea8
ds: 007b   es: 007b   ss: 0068
Process modprobe (pid: 5778, ti=c8d68000 task=c84bf9f0 task.ti=c8d68000)
Stack: 00000001 c0454ef5 d57cae98 00000001 c042cac6 ee88da3c f8af7fde ee88d800
       ee88da74 ee88da74 c0434b6e f8afe8c8 c064efbd f8afe88c 00000000 0003dced
       00000690 d2fcb540 00000e70 cc6b1440 00000000 00000000 00000000 00000000
Call Trace:
 [<c0454ef5>] __vunmap+0xcf/0xe3
 [<c042cac6>] init_waitqueue_head+0x12/0x20
 [<f8af7fde>] dazuko_init+0x6f/0x90 [dazuko]
 [<c0434b6e>] sys_init_module+0x144e/0x1587
 [<c0403dc8>] syscall_call+0x7/0xb
 =======================
Code: 9f 8d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 ec af f8
EIP: [<f8afaf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:c8d68ea8
 
And my clamd, got error like this:
clamd daemon 0.88.7 (OS: linux-gnu, ARCH: i386, CPU: i386)
Log file size limited to 1048576 bytes.
Running as user root (UID 0, GID 0)
Reading databases from /var/lib/clamav
Protecting against 91759 viruses.
Unix socket file /var/run/clamd.clamd/clamd.sock
Setting connection queue length to 15
Archive: Archived file size limit set to 10485760 bytes.
Archive: Recursion level limit set to 8.
Archive: Files limit set to 1000.
Archive: Compression ratio limit set to 250.
Archive support enabled.
Archive: RAR support disabled.
Portable Executable support enabled.
Mail files support enabled.
Mail: Recursion level limit set to 64.
OLE2 support enabled.
HTML support enabled.
Self checking every 1800 seconds.
ERROR: Clamuko: Can't register with Dazuko

Before use last version dazuko, there is no error "Can't register with Dazuko". It's work fine.

Anonymous
Thu 12 Apr 2007 07:51:54 AM UTC, comment #8: 

I managed to get a copy of Fedora Core 5 and 6. The new version seems to work ok.

However, I also got the errors you reported the first time I tried it from within an x-terminal. But when I tried it from the console it worked perfectly. I then later tried it from within an x-terminal and it also worked perfectly.

Can you try it within a console?

John Ogness <ogman>
Group administrator
Thu 12 Apr 2007 01:55:32 AM UTC, comment #7: 

[root@xseries dazuko-2.3.3]# grep sys_call_table /proc/kallsyms
[root@xseries dazuko-2.3.3]# grep sys_close /proc/kallsyms
c045f096 T sys_close


And after use dazuko_shift.tgz, here the result:

[root@xseries dazuko-2.3.3]# make clean
rm -f .*.cmd .cmd .o dazuko.ko dazuko.mod.c dummy_rule
[root@xseries dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r`
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes
kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.20)
checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5)
locating sys_call_table... ok (0xc120c560)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc1063fa7)
locating sys_close... ok (0xc105f096)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

=======================
 Configuration summary
=======================

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes
module debug = no
library 1.x compatibility = yes

[root@xseries dazuko-2.3.3]# make
make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CHK     include/linux/version.h
make[1]: `include/asm' is up to date.
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_core.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /usr/local/src/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
touch dummy_rule
[root@xseries dazuko-2.3.3]# make install
mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra
cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra
/sbin/depmod -ae
[root@xseries dazuko-2.3.3]# modprobe dazuko
Segmentation fault
[root@xseries dazuko-2.3.3]#
Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Oops: 0000 [#1]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: CPU:    0

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP:    0060:[<f8afdf84>]    Not tainted VLI

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EFLAGS: 00010287   (2.6.20-1.2307.fc5 #1)

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: eax: ff400000   ebx: c8dffa3c   ecx: c0752624   edx: be20c560

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: esi: c8dff800   edi: f8b01bb8   ebp: f8b01880   esp: e96dcea8

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: ds: 007b   es: 007b   ss: 0068

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000)

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:        c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:        00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Call Trace:

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0454ef5>] __vunmap+0xcf/0xe3

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c042cac6>] init_waitqueue_head+0x12/0x20

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0434b6e>] sys_init_module+0x144e/0x1587

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0403dc8>] syscall_call+0x7/0xb

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  =======================

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Oops: 0000 [#1]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: CPU:    0

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP:    0060:[<f8afdf84>]    Not tainted VLI

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EFLAGS: 00010287   (2.6.20-1.2307.fc5 #1)

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: eax: ff400000   ebx: c8dffa3c   ecx: c0752624   edx: be20c560

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: esi: c8dff800   edi: f8b01bb8   ebp: f8b01880   esp: e96dcea8

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: ds: 007b   es: 007b   ss: 0068

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000)

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800 

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:        c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e 

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:        00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000 

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Call Trace:

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0454ef5>] __vunmap+0xcf/0xe3

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c042cac6>] init_waitqueue_head+0x12/0x20

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko]

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0434b6e>] sys_init_module+0x144e/0x1587

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  [<c0403dc8>] syscall_call+0x7/0xb

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel:  =======================

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8 

Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ...
xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8


And here /var/log/messages:
Apr 12 08:50:51 xseries kernel: BUG: unable to handle kernel paging request at virtual address be20c578
Apr 12 08:50:51 xseries kernel:  printing eip:Apr 12 08:50:51 xseries kernel: f8afdf84
Apr 12 08:50:51 xseries kernel: *pde = 00000000Apr 12 08:50:51 xseries kernel: Oops: 0000 [#1]
Apr 12 08:50:51 xseries kernel: last sysfs file: /block/sda/sda1/size
Apr 12 08:50:51 xseries kernel: Modules linked in: dazuko(U) autofs4 smsc47m1 hwmon i2c_isa sunrpc ipv6 dm_mirror dm_mod video sbs i2c_ec dock container button battery asus_acpi backlight ac lp parport_pc parport floppy ehci_hcd uhci_hcd sg e1000 ata_piix libata serio_raw ide_cd i2c_i801 cdrom i2c_core i82875p_edac iTCO_wdt edac_mc iTCO_vendor_support i6300esb pcspkr ext3 jbd aic7xxx aic79xx scsi_transport_spi sd_mod scsi_mod
Apr 12 08:50:51 xseries kernel: CPU:    0
Apr 12 08:50:51 xseries kernel: EIP:    0060:[<f8afdf84>]    Not tainted VLI
Apr 12 08:50:51 xseries kernel: EFLAGS: 00010287   (2.6.20-1.2307.fc5 #1)
Apr 12 08:50:51 xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko]
Apr 12 08:50:51 xseries kernel: eax: ff400000   ebx: c8dffa3c   ecx: c0752624   edx: be20c560
Apr 12 08:50:51 xseries kernel: esi: c8dff800   edi: f8b01bb8   ebp: f8b01880   esp: e96dcea8
Apr 12 08:50:51 xseries kernel: ds: 007b   es: 007b   ss: 0068
Apr 12 08:50:51 xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000)
Apr 12 08:50:51 xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800
Apr 12 08:50:51 xseries kernel:        c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e
Apr 12 08:50:51 xseries kernel:        00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000
Apr 12 08:50:51 xseries kernel: Call Trace:
Apr 12 08:50:51 xseries kernel:  [<c0454ef5>] __vunmap+0xcf/0xe3
Apr 12 08:50:51 xseries kernel:  [<c042cac6>] init_waitqueue_head+0x12/0x20Apr 12 08:50:51 xseries kernel:  [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko]
Apr 12 08:50:51 xseries kernel:  [<c0434b6e>] sys_init_module+0x144e/0x1587Apr 12 08:50:51 xseries kernel:  [<c0403dc8>] syscall_call+0x7/0xb
Apr 12 08:50:51 xseries kernel:  =======================
Apr 12 08:50:51 xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8 
Apr 12 08:50:51 xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8


And this:
[root@xseries dazuko-2.3.3]# grep sys_call_table /proc/kallsyms
f8b01c40 b sys_call_table       [dazuko]
[root@xseries dazuko-2.3.3]# grep sys_close /proc/kallsyms
c045f096 T sys_close
f8b01c5c b original_sys_close   [dazuko]
c045f096 u sys_close    [dazuko]
f8afd420 t linux_dazuko_sys_close       [dazuko]

Anonymous
Wed 11 Apr 2007 02:42:57 PM UTC, comment #6: 

I have attached a new version of "configure" and "dazuko_linux.c".

https://savannah.nongnu.org/support/download.php?file_id=12465

Can you try this version? It seems that the kernel symbols have been shifted upon load. Hopefully this new version will accomodate for that.

John Ogness <ogman>
Group administrator
Wed 11 Apr 2007 12:32:28 PM UTC, comment #5: 

Could you provide the results of:

$ grep sys_call_table /proc/kallsyms

and

$ grep sys_close /proc/kallsyms

John Ogness <ogman>
Group administrator
Wed 11 Apr 2007 08:53:04 AM UTC, comment #4: 

[root@xseries dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r`
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes
kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.20)
checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5)
locating sys_call_table... ok (0xc120c560)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc1063fa7)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

=======================
 Configuration summary
=======================

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes
module debug = no
library 1.x compatibility = yes


[root@xseries dazuko-2.3.3]# make
make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CHK     include/linux/version.h
make[1]: `include/asm' is up to date.
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_core.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /usr/local/src/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
touch dummy_rule


[root@xseries dazuko-2.3.3]# make install
mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra
cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra
/sbin/depmod -ae
[root@xseries dazuko-2.3.3]# modprobe dazuko
FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted


[root@xseries dazuko-2.3.3]# tail /var/log/messages
...
Apr 11 15:49:58 xseries kernel: p[__NR_close] = c120c558
Apr 11 15:49:58 xseries kernel: sys_close = c045f096
Apr 11 15:49:58 xseries kernel: dazuko: panic (sys_call_table == NULL)

[root@xseries dazuko-2.3.3]# grep sys_close /boot/System.map-2.6.20-1.2307.fc5
c105f096 T sys_close
c1287d00 r __ksymtab_sys_close
c128d7c8 r __kcrctab_sys_close
c1292e43 r __kstrtab_sys_close





Anonymous
Wed 11 Apr 2007 07:54:04 AM UTC, comment #3: 

Here is a new version of "dazuko_linux.c" that includes some minor debugging:

https://savannah.nongnu.org/support/download.php?file_id=12463

Can you recompile the module with this version and try it? I'm interested in the extra output. It should look something like this (visible in "/var/log/messages" or with the command "dmesg"):

dazuko: unloaded, version=2.3.3
p[__NR_close] = ffffffff80165a6f
sys_close = ffffffff80165a6f
dazuko: loaded, version=2.3.3

I am also interested in the results of running:

$ grep sys_close /boot/System.map-2.6.20-1.2307.fc5


John Ogness <ogman>
Group administrator
Wed 11 Apr 2007 07:14:26 AM UTC, comment #2: 

Here the kernel version:

[root@localhost dazuko-2.3.3]# uname -r
2.6.20-1.2307.fc5

And the output of configure script:

[root@localhost dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r`
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes
kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.20)
checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5)
locating sys_call_table... ok (0xc120c560)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc1063fa7)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

=======================
 Configuration summary
=======================

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes
module debug = no
library 1.x compatibility = yes

[root@localhost dazuko-2.3.3]# make
make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CHK     include/linux/version.h
make[1]: `include/asm' is up to date.
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules
make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_core.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /usr/local/src/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /usr/local/src/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /usr/local/src/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686'
touch dummy_rule

[root@localhost dazuko-2.3.3]# make install
mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra
cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra
/sbin/depmod -ae

[root@localhost dazuko-2.3.3]# modprobe dazuko
FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted


And here the sys_call_table output:

[root@localhost dazuko-2.3.3]# grep sys_call_table /boot/System.map-2.6.20-1.2307.fc5
c120c560 R sys_call_table

Anonymous
Wed 11 Apr 2007 06:26:57 AM UTC, comment #1: 

Providing the output from the "configure" script might be helpful.

The "panic" message means that Dazuko was unable to locate the syscall_table (which is required if you are using --enable-syscalls).

Could you post the output of running:

$ grep sys_call_table /boot/System.map-2.6.20-1.2307.fc5

This problem may also occur if the System.map file does not match the running kernel.

John Ogness <ogman>
Group administrator
Wed 11 Apr 2007 06:10:48 AM UTC, original submission:  

As usual i use this to compile dazuko:

./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-2.6.20-1.2307.fc5

And try to load, getting this error message:

[root@localhost ~]# modprobe dazuko
FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted

And from /var/log/messages, got this:

Apr 11 13:07:41 localhost kernel: dazuko: panic (sys_call_table == NULL)

Any solution?

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #12465:  dazuko_shift.tgz added by ogman (23KiB - application/x-gtar)
file #12463:  dazuko_linux.c.gz added by ogman (13KiB - application/gzip - debug sys_call_table symbols)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by lucapsg (Posted a comment)
  • -email is unavailable- added by ogman (Posted a comment)
  •  

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-19 ogman Assigned toogman None
    2007-04-11 ogman Attached File- Added dazuko_shift.tgz, #12465
    2007-04-11 ogman Attached File- Added dazuko_linux.c.gz, #12463
    2007-04-11 ogman Assigned toNone ogman

    Back to the top

    Powered by Savane 3.13-c54d.
    Corresponding source code