Add a New Comment Rich Markup
Please be aware that using syscall hooking with Linux 2.6 was a quick (and dirty) workaround to bypass the LSM problems. However, I highly recommend using LSM rather then syscall hooking for Linux 2.6 (even if this means compiling your own kernel with Capabilities as a module). Recently some effort has begun from Red Hat to try and work together with the Dazuko project to find a solution for this problem.
syscall hooks work with debian kernel 2.6.18 . in debian 2.6.18 i can use "capability" and "SELinux" together with dazuko when using syscall hooks . in vanilla 2.6.22.6 , fedora 2.6.22.5 + 2.6.22.4 this does not work .
got the same failure i guess there's somewhat changed with syscalls in kernel 2.6.22 , so it's no longer allowed or possible to do these syscall hooks somewhere i read syscalls are somewhat different protected in 2.6.22 than in kernels before (or at least since 2.6.22.x if not already in 2.6.22 vanilla kernel) 2.6.21 "worked" with syscall-hooking , but even in 2.6.21 there's a problem : there seems still need for lsm-hooking when doing syscall hooks , at least the errors are the same as when trying to modprobe dazuko when both selinux+capability are loaded i thought syscalls would offer possibility to use selinux and capability together with dazuko ... by the way , around kernel 2.6.16.1 there was "lsm stacker" at sourceforge around ... this was said to allow stacking of more lsm modules than regularly possible ... i'm not that firm to kernel-programming , but maybe some of you could port that coding up to 2.6.22 or later 2.6.23 kernel series ? (well... nice to think about : selinux + apparmor + capability + dazuko in parallel ;-) .. i tried to get rsbac running , but did not achieve to get it initialized even using the prepatched kernels ... kernel programming/patching is really different from usual programming i see ... )
In /var/log/messages there should be more detailed information about why "insmod" failed.
Hello, i try to use dazuko under fedora core 7. i use the dazuko 2.3.3 source [root@localhost dazuko-2.3.3]# ./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-2.6.2 System.map-2.6.21-1.3194.fc7 System.map-2.6.22.1-41.fc7 [root@localhost dazuko-2.3.3]# ./configure --enable-syscalls --sct-readonly --mapfile=/boot/System.map-2.6.22.1-41.fc7 checking host system type... Linux checking for make utility... ok (make) checking for C compiler... ok (cc) kernel source in /lib/modules/2.6.22.1-41.fc7/source... yes kernel build source in /lib/modules/2.6.22.1-41.fc7/build... yes acquiring Linux kernel code configuration... ok checking if Linux is RSBAC patched... no checking if devfs is enabled... no discovered host system... Linux (2.6.22) checking for System.map file... ok (/boot/System.map-2.6.22.1-41.fc7) locating sys_call_table... ok (0xc1213580) checking sys_call_table status... read-only (forced) locating do_execve... ok (0xc107dae2) identifying device API... ok inspecting class type... ok (class) inspecting suspend function... ok (suspend2) checking whether __d_path() is exported... no (using local copy, dangerous) inspecting task_struct structure... ok (using parent) configure: creating Makefile configure: creating library/Makefile configure: creating example_c/Makefile ./configure successful ======================= Configuration summary ======================= module events = ON_OPEN ON_CLOSE ON_EXEC devfs support = no rsbac support = no hooking via syscalls = yes local __d_path() = yes (WARNING: dangerous for SMP kernels, see README.linux26) module debug = no library 1.x compatibility = yes [root@localhost dazuko-2.3.3]# make test make -C /lib/modules/2.6.22.1-41.fc7/build include/linux/version.h include/asm scripts make[1]: Entering directory `/usr/src/kernels/2.6.22.1-41.fc7-i686' CHK include/linux/version.h make[1]: »include/asm« ist bereits aktualisiert. make[1]: Leaving directory `/usr/src/kernels/2.6.22.1-41.fc7-i686' make -C /lib/modules/2.6.22.1-41.fc7/build SUBDIRS="/var/tmp/dazuko-2.3.3" modules make[1]: Entering directory `/usr/src/kernels/2.6.22.1-41.fc7-i686' CC [M] /var/tmp/dazuko-2.3.3/dazuko_core.o CC [M] /var/tmp/dazuko-2.3.3/dazuko_transport.o CC [M] /var/tmp/dazuko-2.3.3/dazuko_linux.o LD [M] /var/tmp/dazuko-2.3.3/dazuko.o Building modules, stage 2. MODPOST 1 modules CC /var/tmp/dazuko-2.3.3/dazuko.mod.o LD [M] /var/tmp/dazuko-2.3.3/dazuko.ko make[1]: Leaving directory `/usr/src/kernels/2.6.22.1-41.fc7-i686' touch dummy_rule /sbin/insmod ./dazuko.ko insmod: error inserting './dazuko.ko': -1 Operation not permitted make: * [test] Error 1 Can you help me ?
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 3 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.12