| View previous topic :: View next topic |
| Author |
Message |
serafean
n00b
Joined: 11 Apr 2016
Posts: 21
|
 Posted: Wed Feb 22, 2017 6:08 pm Post subject: hardened-sources on the desktop |
 |
|
Hi,
Not sure if this belongs to "security" or "desktop", move as appropriate.
I'm trying to run hardened-sources on the desktop (KDE and Kodi). The box boots to console OK, but ntp and GUI applications are a problematic.
NTP:
| Code: | | grsec: use of CAP_NET_ADMIN in chroot denied for /usr/sbin/ntpd[ntpd:952] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/ntpd[ntpd:926] uid/euid:0/0 gid/egid:0/0 |
I googled, and am a bit lost where the chroot comes from...
GUI apps:
First off, I had to disable CONFIG_GRKERNSEC_SYSFS_RESTRICT because for some reason GL apps (like kwin) need to access /sys/dev/char/226:0/device/uevent.
Now all KDE applications have logs in the kernel log : | Code: | | grsec: denied RWX mmap of <anonymous mapping> by /usr/bin/konsole[konsole:1825] uid/euid:1002/1002 gid/egid:1002/1002, parent /usr/bin/kdeinit5[kdeinit5:1701] uid/euid:1002/1002 gid/egid:1002/1002 |
Kodi has the same : | Code: | | denied RWX mmap of <anonymous mapping> by /usr/lib64/kodi/kodi.bin[kodi.bin:2336] uid/euid:1001/1001 gid/egid:1001/1001, parent /usr/bin/kodi[kodi:2300] uid/euid:1001/1001 gid/egid:1001/1001 |
Kodi starts and runs more or less OK (with a crazy memory leak). KDE is unusable.
Anyone able to give me any pointers for a workable "hardened" desktop?
Thanks. |
|
| Back to top |
|
 |
enZom
n00b
Joined: 13 Nov 2015
Posts: 30
Location: In a sandbox
|
| Posted: Sun Mar 26, 2017 5:26 pm Post subject: |
|
|
What you wanna look into is paxctl. Paxctl controls grsecurity's protections.
Imo read up on paxctl first, it's disabling the protections. -> man paxctl or just type paxctl and checkout the options.
paxctl -c /usr/bin/kodi
paxctl -C /usr/bin/kodi
paxctl -m /usr/bin/kodi
yada yada |
|
| Back to top |
|
|
ntnn
n00b
Joined: 20 Mar 2017
Posts: 10
|
|
| Back to top |
|
|
enZom
n00b
Joined: 13 Nov 2015
Posts: 30
Location: In a sandbox
|
| Posted: Mon Mar 27, 2017 5:47 pm Post subject: |
|
|
thx for the linkage, I didn't realize there was any info around for this. |
|
| Back to top |
|
|
|
Networking & Security
