mainDazuko - Support: sr #105969, Problem to use dazuko under fedora...


sr #105969: Problem to use dazuko under fedora core 7

Submitter:  None
Submitted:  Mon 13 Aug 2007 02:34:43 PM UTC
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Wed 26 Sep 2007 02:14:22 PM UTC, comment #4: 

Please be aware that using syscall hooking with Linux 2.6 was a quick (and dirty) workaround to bypass the LSM problems. However, I highly recommend using LSM rather then syscall hooking for Linux 2.6 (even if this means compiling your own kernel with Capabilities as a module).

Recently some effort has begun from Red Hat to try and work together with the Dazuko project to find a solution for this problem.

John Ogness <ogman>
Group administrator
Thu 13 Sep 2007 12:01:40 PM UTC, comment #3: 

syscall hooks work with debian kernel 2.6.18 .

in debian 2.6.18 i can use "capability" and "SELinux" together with dazuko when using syscall hooks .

in vanilla , fedora + this does not work .

T.-C. <zqguaq>
Fri 07 Sep 2007 12:16:27 AM UTC, comment #2: 

got the same failure

i guess there's somewhat changed with syscalls in kernel 2.6.22 , so it's no longer allowed or possible to do these syscall hooks

somewhere i read syscalls are somewhat different protected in 2.6.22 than in kernels before (or at least since 2.6.22.x if not already in 2.6.22 vanilla kernel)

2.6.21 "worked" with syscall-hooking , but even in 2.6.21 there's a problem : there seems still need for lsm-hooking when doing syscall hooks , at least the errors are the same as when trying to modprobe dazuko when both selinux+capability are loaded

i thought syscalls would offer possibility to use selinux and capability together with dazuko ...

by the way , around kernel there was "lsm stacker" at sourceforge around ... this was said to allow stacking of more lsm modules than regularly possible ... i'm not that firm to kernel-programming , but maybe some of you could port that coding up to 2.6.22 or later 2.6.23 kernel series ?

(well... nice to think about : selinux + apparmor + capability + dazuko in parallel ;-) .. i tried to get rsbac running , but did not achieve to get it initialized even using the prepatched kernels ... kernel programming/patching is really different from usual programming i see ... )

T.-C. <zqguaq>
Tue 14 Aug 2007 09:57:41 AM UTC, comment #1: 

In /var/log/messages there should be more detailed information about why "insmod" failed.

John Ogness <ogman>
Group administrator
Mon 13 Aug 2007 02:34:43 PM UTC, original submission:  


i try to use dazuko under fedora core 7.

i use the dazuko 2.3.3 source

[root@localhost dazuko-2.3.3]# ./configure --enable-syscalls --sct-readonly --mapfile=/boot/
[root@localhost dazuko-2.3.3]# ./configure --enable-syscalls --sct-readonly --mapfile=/boot/
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/ yes
kernel build source in /lib/modules/ yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.22)
checking for file... ok (/boot/
locating sys_call_table... ok (0xc1213580)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc107dae2)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy, dangerous)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

 Configuration summary

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes (WARNING: dangerous for SMP kernels, see README.linux26)
module debug = no
library 1.x compatibility = yes

[root@localhost dazuko-2.3.3]# make test
make -C /lib/modules/ include/linux/version.h include/asm scripts
make[1]: Entering directory `/usr/src/kernels/'
  CHK     include/linux/version.h
make[1]: »include/asm« ist bereits aktualisiert.
make[1]: Leaving directory `/usr/src/kernels/'
make -C /lib/modules/ SUBDIRS="/var/tmp/dazuko-2.3.3" modules
make[1]: Entering directory `/usr/src/kernels/'
  CC [M]  /var/tmp/dazuko-2.3.3/dazuko_core.o
  CC [M]  /var/tmp/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /var/tmp/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /var/tmp/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /var/tmp/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /var/tmp/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/usr/src/kernels/'
touch dummy_rule
/sbin/insmod ./dazuko.ko
insmod: error inserting './dazuko.ko': -1 Operation not permitted
make: * [test] Error 1

Can you help me ?



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #13658:  comp.txt added by None (704B - message/disposition-notification - A simple ./configure dont work)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by zqguaq (Posted a comment)
  • -email is unavailable- added by ogman (Posted a comment)

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-19 ogman Assigned toogman None
    2007-08-14 ogman Assigned toNone ogman
    2007-08-13 None Attached File- Added comp.txt, #13658

    Back to the top

    Powered by Savane 3.12