Add a New Comment Rich Markup
Jump to the original submission
With the latest Red Hat kernels, system call hooking is not possible. The system call table is effectively protected. The only option is to build a new kernel where capabilities are a separate module rather than built-in. Then it is possible to load Dazuko as intentdend... with LSM rather than syscall hooking. Information about how to this is available here: http://fedoraproject.org/wiki/Docs/CustomKernel
Hello, I also I have the same problem: [root@host dazuko-2.3.3]# <b>./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-`uname -r`</b> checking host system type... Linux checking for make utility... ok (make) checking for C compiler... ok (cc) kernel source in /lib/modules/2.6.20-1.2320.fc5/source... yes kernel build source in /lib/modules/2.6.20-1.2320.fc5/build... yes acquiring Linux kernel code configuration... ok checking if Linux is RSBAC patched... no checking if devfs is enabled... no discovered host system... Linux (2.6.20) checking for System.map file... ok (/boot/System.map-2.6.20-1.2320.fc5) locating sys_call_table... ok (0xc120c560) checking sys_call_table status... read-only (forced) locating do_execve... ok (0xc10641a1) identifying device API... ok inspecting class type... ok (class) inspecting suspend function... ok (suspend2) checking whether __d_path() is exported... no (using local copy) inspecting task_struct structure... ok (using parent) configure: creating Makefile configure: creating library/Makefile configure: creating example_c/Makefile ./configure successful ======================= Configuration summary ======================= module events = ON_OPEN ON_CLOSE ON_EXEC devfs support = no rsbac support = no hooking via syscalls = yes local __d_path() = yes module debug = no library 1.x compatibility = yes [root@host dazuko-2.3.3]# <b>make</b> make -C /lib/modules/2.6.20-1.2320.fc5/build include/linux/version.h include/asm scripts make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686' CHK include/linux/version.h make[1]: `include/asm' is up to date. make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686' make -C /lib/modules/2.6.20-1.2320.fc5/build SUBDIRS="/root/pkg/noarch/dazuko/dazuko-2.3.3" modules make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686' CC [M] /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_core.o CC [M] /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_transport.o CC [M] /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko_linux.o LD [M] /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.o Building modules, stage 2. MODPOST 1 modules CC /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.mod.o LD [M] /root/pkg/noarch/dazuko/dazuko-2.3.3/dazuko.ko make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2320.fc5-i686' touch dummy_rule [root@host dazuko-2.3.3]# <b>make install</b> mkdir -p /lib/modules/2.6.20-1.2320.fc5/extra cp dazuko.ko /lib/modules/2.6.20-1.2320.fc5/extra /sbin/depmod -ae [root@host 2.6.20-1.2320.fc5]# <b>modprobe dazuko</b> FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2320.fc5/extra/dazuko.ko): Operation not permitted I have tryed also from the console but without success. With FC5 the problem was resolved? In that way? Thank you.
I already install from console. and got here: [root@xseries ~]# dmesg Modules linked in: dazuko(U) autofs4 smsc47m1 hwmon i2c_isa sunrpc ipv6 dm_mirror dm_mod video sbs i2c_ec dock container button battery asus_acpi backlight ac lp parport_pc parport ehci_hcd uhci_hcd floppy sg ata_piix libata e1000 serio_raw iTCO_wdt iTCO_vendor_support i6300esb ide_cd i82875p_edac cdrom edac_mc i2c_i801 pcspkr i2c_core ext3 jbd aic7xxx aic79xx scsi_transport_spi sd_mod scsi_mod CPU: 0 EIP: 0060:[<f8afaf84>] Not tainted VLI EFLAGS: 00010287 (2.6.20-1.2312.fc5 #1) EIP is at xp_sys_hook+0x21/0x2cd [dazuko] eax: ff400000 ebx: ee88da3c ecx: c0752624 edx: be20c560 esi: ee88d800 edi: f8afebb8 ebp: f8afe880 esp: c8d68ea8 ds: 007b es: 007b ss: 0068 Process modprobe (pid: 5778, ti=c8d68000 task=c84bf9f0 task.ti=c8d68000) Stack: 00000001 c0454ef5 d57cae98 00000001 c042cac6 ee88da3c f8af7fde ee88d800 ee88da74 ee88da74 c0434b6e f8afe8c8 c064efbd f8afe88c 00000000 0003dced 00000690 d2fcb540 00000e70 cc6b1440 00000000 00000000 00000000 00000000 Call Trace: [<c0454ef5>] __vunmap+0xcf/0xe3 [<c042cac6>] init_waitqueue_head+0x12/0x20 [<f8af7fde>] dazuko_init+0x6f/0x90 [dazuko] [<c0434b6e>] sys_init_module+0x144e/0x1587 [<c0403dc8>] syscall_call+0x7/0xb ======================= Code: 9f 8d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 ec af f8 EIP: [<f8afaf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:c8d68ea8 And my clamd, got error like this: clamd daemon 0.88.7 (OS: linux-gnu, ARCH: i386, CPU: i386) Log file size limited to 1048576 bytes. Running as user root (UID 0, GID 0) Reading databases from /var/lib/clamav Protecting against 91759 viruses. Unix socket file /var/run/clamd.clamd/clamd.sock Setting connection queue length to 15 Archive: Archived file size limit set to 10485760 bytes. Archive: Recursion level limit set to 8. Archive: Files limit set to 1000. Archive: Compression ratio limit set to 250. Archive support enabled. Archive: RAR support disabled. Portable Executable support enabled. Mail files support enabled. Mail: Recursion level limit set to 64. OLE2 support enabled. HTML support enabled. Self checking every 1800 seconds. ERROR: Clamuko: Can't register with Dazuko Before use last version dazuko, there is no error "Can't register with Dazuko". It's work fine.
I managed to get a copy of Fedora Core 5 and 6. The new version seems to work ok. However, I also got the errors you reported the first time I tried it from within an x-terminal. But when I tried it from the console it worked perfectly. I then later tried it from within an x-terminal and it also worked perfectly. Can you try it within a console?
[root@xseries dazuko-2.3.3]# grep sys_call_table /proc/kallsyms [root@xseries dazuko-2.3.3]# grep sys_close /proc/kallsyms c045f096 T sys_close And after use dazuko_shift.tgz, here the result: [root@xseries dazuko-2.3.3]# make clean rm -f .*.cmd .cmd .o dazuko.ko dazuko.mod.c dummy_rule [root@xseries dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r` checking host system type... Linux checking for make utility... ok (make) checking for C compiler... ok (cc) kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes acquiring Linux kernel code configuration... ok checking if Linux is RSBAC patched... no checking if devfs is enabled... no discovered host system... Linux (2.6.20) checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5) locating sys_call_table... ok (0xc120c560) checking sys_call_table status... read-only (forced) locating do_execve... ok (0xc1063fa7) locating sys_close... ok (0xc105f096) identifying device API... ok inspecting class type... ok (class) inspecting suspend function... ok (suspend2) checking whether __d_path() is exported... no (using local copy) inspecting task_struct structure... ok (using parent) configure: creating Makefile configure: creating library/Makefile configure: creating example_c/Makefile ./configure successful ======================= Configuration summary ======================= module events = ON_OPEN ON_CLOSE ON_EXEC devfs support = no rsbac support = no hooking via syscalls = yes local __d_path() = yes module debug = no library 1.x compatibility = yes [root@xseries dazuko-2.3.3]# make make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CHK include/linux/version.h make[1]: `include/asm' is up to date. make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CC [M] /usr/local/src/dazuko-2.3.3/dazuko_core.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_transport.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_linux.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.o Building modules, stage 2. MODPOST 1 modules CC /usr/local/src/dazuko-2.3.3/dazuko.mod.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.ko make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' touch dummy_rule [root@xseries dazuko-2.3.3]# make install mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra /sbin/depmod -ae [root@xseries dazuko-2.3.3]# modprobe dazuko Segmentation fault [root@xseries dazuko-2.3.3]# Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Oops: 0000 [#1] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: CPU: 0 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP: 0060:[<f8afdf84>] Not tainted VLI Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EFLAGS: 00010287 (2.6.20-1.2307.fc5 #1) Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: eax: ff400000 ebx: c8dffa3c ecx: c0752624 edx: be20c560 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: esi: c8dff800 edi: f8b01bb8 ebp: f8b01880 esp: e96dcea8 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: ds: 007b es: 007b ss: 0068 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000) Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: 00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Call Trace: Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0454ef5>] __vunmap+0xcf/0xe3 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c042cac6>] init_waitqueue_head+0x12/0x20 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0434b6e>] sys_init_module+0x144e/0x1587 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0403dc8>] syscall_call+0x7/0xb Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: ======================= Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Oops: 0000 [#1] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: CPU: 0 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP: 0060:[<f8afdf84>] Not tainted VLI Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EFLAGS: 00010287 (2.6.20-1.2307.fc5 #1) Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: eax: ff400000 ebx: c8dffa3c ecx: c0752624 edx: be20c560 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: esi: c8dff800 edi: f8b01bb8 ebp: f8b01880 esp: e96dcea8 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: ds: 007b es: 007b ss: 0068 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000) Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: 00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Call Trace: Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0454ef5>] __vunmap+0xcf/0xe3 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c042cac6>] init_waitqueue_head+0x12/0x20 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko] Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0434b6e>] sys_init_module+0x144e/0x1587 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: [<c0403dc8>] syscall_call+0x7/0xb Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: ======================= Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8 Message from syslogd@xseries at Thu Apr 12 08:50:51 2007 ... xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8 And here /var/log/messages: Apr 12 08:50:51 xseries kernel: BUG: unable to handle kernel paging request at virtual address be20c578 Apr 12 08:50:51 xseries kernel: printing eip:Apr 12 08:50:51 xseries kernel: f8afdf84 Apr 12 08:50:51 xseries kernel: *pde = 00000000Apr 12 08:50:51 xseries kernel: Oops: 0000 [#1] Apr 12 08:50:51 xseries kernel: last sysfs file: /block/sda/sda1/size Apr 12 08:50:51 xseries kernel: Modules linked in: dazuko(U) autofs4 smsc47m1 hwmon i2c_isa sunrpc ipv6 dm_mirror dm_mod video sbs i2c_ec dock container button battery asus_acpi backlight ac lp parport_pc parport floppy ehci_hcd uhci_hcd sg e1000 ata_piix libata serio_raw ide_cd i2c_i801 cdrom i2c_core i82875p_edac iTCO_wdt edac_mc iTCO_vendor_support i6300esb pcspkr ext3 jbd aic7xxx aic79xx scsi_transport_spi sd_mod scsi_mod Apr 12 08:50:51 xseries kernel: CPU: 0 Apr 12 08:50:51 xseries kernel: EIP: 0060:[<f8afdf84>] Not tainted VLI Apr 12 08:50:51 xseries kernel: EFLAGS: 00010287 (2.6.20-1.2307.fc5 #1) Apr 12 08:50:51 xseries kernel: EIP is at xp_sys_hook+0x21/0x2cd [dazuko] Apr 12 08:50:51 xseries kernel: eax: ff400000 ebx: c8dffa3c ecx: c0752624 edx: be20c560 Apr 12 08:50:51 xseries kernel: esi: c8dff800 edi: f8b01bb8 ebp: f8b01880 esp: e96dcea8 Apr 12 08:50:51 xseries kernel: ds: 007b es: 007b ss: 0068 Apr 12 08:50:51 xseries kernel: Process modprobe (pid: 31350, ti=e96dc000 task=f77c88b0 task.ti=e96dc000) Apr 12 08:50:51 xseries kernel: Stack: 00000001 c0454ef5 c25e27d8 00000001 c042cac6 c8dffa3c f8afafde c8dff800 Apr 12 08:50:51 xseries kernel: c8dffa74 c8dffa74 c0434b6e f8b018c8 c064ef6d f8b0188c 00000000 0003dc9e Apr 12 08:50:51 xseries kernel: 00000690 e5216ea0 00000e70 d92166c0 00000000 00000000 00000000 00000000 Apr 12 08:50:51 xseries kernel: Call Trace: Apr 12 08:50:51 xseries kernel: [<c0454ef5>] __vunmap+0xcf/0xe3 Apr 12 08:50:51 xseries kernel: [<c042cac6>] init_waitqueue_head+0x12/0x20Apr 12 08:50:51 xseries kernel: [<f8afafde>] dazuko_init+0x6f/0x90 [dazuko] Apr 12 08:50:51 xseries kernel: [<c0434b6e>] sys_init_module+0x144e/0x1587Apr 12 08:50:51 xseries kernel: [<c0403dc8>] syscall_call+0x7/0xb Apr 12 08:50:51 xseries kernel: ======================= Apr 12 08:50:51 xseries kernel: Code: 6f 5d a4 c7 31 c0 5a 5b 5e c3 53 b8 96 f0 45 c0 83 ec 14 3d 96 f0 05 c1 ba 60 c5 20 c1 74 0c b8 00 00 40 ff 8d 14 85 60 c5 20 c1 <81> 7a 18 96 f0 45 c0 0f 85 88 02 00 00 85 d2 89 15 40 1c b0 f8 Apr 12 08:50:51 xseries kernel: EIP: [<f8afdf84>] xp_sys_hook+0x21/0x2cd [dazuko] SS:ESP 0068:e96dcea8 And this: [root@xseries dazuko-2.3.3]# grep sys_call_table /proc/kallsyms f8b01c40 b sys_call_table [dazuko] [root@xseries dazuko-2.3.3]# grep sys_close /proc/kallsyms c045f096 T sys_close f8b01c5c b original_sys_close [dazuko] c045f096 u sys_close [dazuko] f8afd420 t linux_dazuko_sys_close [dazuko]
I have attached a new version of "configure" and "dazuko_linux.c". https://savannah.nongnu.org/support/download.php?file_id=12465 Can you try this version? It seems that the kernel symbols have been shifted upon load. Hopefully this new version will accomodate for that.
Could you provide the results of: $ grep sys_call_table /proc/kallsyms and $ grep sys_close /proc/kallsyms
[root@xseries dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r` checking host system type... Linux checking for make utility... ok (make) checking for C compiler... ok (cc) kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes acquiring Linux kernel code configuration... ok checking if Linux is RSBAC patched... no checking if devfs is enabled... no discovered host system... Linux (2.6.20) checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5) locating sys_call_table... ok (0xc120c560) checking sys_call_table status... read-only (forced) locating do_execve... ok (0xc1063fa7) identifying device API... ok inspecting class type... ok (class) inspecting suspend function... ok (suspend2) checking whether __d_path() is exported... no (using local copy) inspecting task_struct structure... ok (using parent) configure: creating Makefile configure: creating library/Makefile configure: creating example_c/Makefile ./configure successful ======================= Configuration summary ======================= module events = ON_OPEN ON_CLOSE ON_EXEC devfs support = no rsbac support = no hooking via syscalls = yes local __d_path() = yes module debug = no library 1.x compatibility = yes [root@xseries dazuko-2.3.3]# make make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CHK include/linux/version.h make[1]: `include/asm' is up to date. make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CC [M] /usr/local/src/dazuko-2.3.3/dazuko_core.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_transport.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_linux.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.o Building modules, stage 2. MODPOST 1 modules CC /usr/local/src/dazuko-2.3.3/dazuko.mod.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.ko make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' touch dummy_rule [root@xseries dazuko-2.3.3]# make install mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra /sbin/depmod -ae [root@xseries dazuko-2.3.3]# modprobe dazuko FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted [root@xseries dazuko-2.3.3]# tail /var/log/messages ... Apr 11 15:49:58 xseries kernel: p[__NR_close] = c120c558 Apr 11 15:49:58 xseries kernel: sys_close = c045f096 Apr 11 15:49:58 xseries kernel: dazuko: panic (sys_call_table == NULL) [root@xseries dazuko-2.3.3]# grep sys_close /boot/System.map-2.6.20-1.2307.fc5 c105f096 T sys_close c1287d00 r __ksymtab_sys_close c128d7c8 r __kcrctab_sys_close c1292e43 r __kstrtab_sys_close
Here is a new version of "dazuko_linux.c" that includes some minor debugging: https://savannah.nongnu.org/support/download.php?file_id=12463 Can you recompile the module with this version and try it? I'm interested in the extra output. It should look something like this (visible in "/var/log/messages" or with the command "dmesg"): dazuko: unloaded, version=2.3.3 p[__NR_close] = ffffffff80165a6f sys_close = ffffffff80165a6f dazuko: loaded, version=2.3.3 I am also interested in the results of running: $ grep sys_close /boot/System.map-2.6.20-1.2307.fc5
Here the kernel version: [root@localhost dazuko-2.3.3]# uname -r 2.6.20-1.2307.fc5 And the output of configure script: [root@localhost dazuko-2.3.3]# ./configure --sct-readonly --enable-syscalls --mapfile=/boot/System.map-`uname -r` checking host system type... Linux checking for make utility... ok (make) checking for C compiler... ok (cc) kernel source in /lib/modules/2.6.20-1.2307.fc5/source... yes kernel build source in /lib/modules/2.6.20-1.2307.fc5/build... yes acquiring Linux kernel code configuration... ok checking if Linux is RSBAC patched... no checking if devfs is enabled... no discovered host system... Linux (2.6.20) checking for System.map file... ok (/boot/System.map-2.6.20-1.2307.fc5) locating sys_call_table... ok (0xc120c560) checking sys_call_table status... read-only (forced) locating do_execve... ok (0xc1063fa7) identifying device API... ok inspecting class type... ok (class) inspecting suspend function... ok (suspend2) checking whether __d_path() is exported... no (using local copy) inspecting task_struct structure... ok (using parent) configure: creating Makefile configure: creating library/Makefile configure: creating example_c/Makefile ./configure successful ======================= Configuration summary ======================= module events = ON_OPEN ON_CLOSE ON_EXEC devfs support = no rsbac support = no hooking via syscalls = yes local __d_path() = yes module debug = no library 1.x compatibility = yes [root@localhost dazuko-2.3.3]# make make -C /lib/modules/2.6.20-1.2307.fc5/build include/linux/version.h include/asm scripts make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CHK include/linux/version.h make[1]: `include/asm' is up to date. make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' make -C /lib/modules/2.6.20-1.2307.fc5/build SUBDIRS="/usr/local/src/dazuko-2.3.3" modules make[1]: Entering directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' CC [M] /usr/local/src/dazuko-2.3.3/dazuko_core.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_transport.o CC [M] /usr/local/src/dazuko-2.3.3/dazuko_linux.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.o Building modules, stage 2. MODPOST 1 modules CC /usr/local/src/dazuko-2.3.3/dazuko.mod.o LD [M] /usr/local/src/dazuko-2.3.3/dazuko.ko make[1]: Leaving directory `/usr/src/kernels/2.6.20-1.2307.fc5-i686' touch dummy_rule [root@localhost dazuko-2.3.3]# make install mkdir -p /lib/modules/2.6.20-1.2307.fc5/extra cp dazuko.ko /lib/modules/2.6.20-1.2307.fc5/extra /sbin/depmod -ae [root@localhost dazuko-2.3.3]# modprobe dazuko FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted And here the sys_call_table output: [root@localhost dazuko-2.3.3]# grep sys_call_table /boot/System.map-2.6.20-1.2307.fc5 c120c560 R sys_call_table
Providing the output from the "configure" script might be helpful. The "panic" message means that Dazuko was unable to locate the syscall_table (which is required if you are using --enable-syscalls). Could you post the output of running: $ grep sys_call_table /boot/System.map-2.6.20-1.2307.fc5 This problem may also occur if the System.map file does not match the running kernel.
As usual i use this to compile dazuko: ./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-2.6.20-1.2307.fc5 And try to load, getting this error message: [root@localhost ~]# modprobe dazuko FATAL: Error inserting dazuko (/lib/modules/2.6.20-1.2307.fc5/extra/dazuko.ko): Operation not permitted And from /var/log/messages, got this: Apr 11 13:07:41 localhost kernel: dazuko: panic (sys_call_table == NULL) Any solution?
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12