| View previous topic :: View next topic |
| Author |
Message |
causality
Apprentice
Joined: 03 Jun 2006
Posts: 156
|
 Posted: Tue Apr 07, 2009 7:18 pm Post subject: CTRL,ALT Keys Lock xorg1.5 with Gentoo-Hardened[resolved] |
 |
|
** Please note that this is related to the use of x11-drivers/nvidia-drivers and probably would not have happened otherwise. I accidentally omitted this from my original post. Thanks to Hopeless (see below) for bringing this to my attention. **
I have already solved this and wanted to post my experience in the hope that others do not have to spend the time troubleshooting that I just did. That is, each failed attempt to fix this hardlocked the machine and required a reboot so that took longer than it otherwise would. This is one of those issues that no one else seems to have documented (at least, I couldn't find anything), so I thought I would do that here.
I updated my system with the usual "emerge --update --deep world". This pulled in the recently-stable xorg-1.5.3. I then followed the instructions found here: http://www.gentoo.org/proj/en/desktop/x/x11/xorg-server-1.5-upgrade-guide.xml. So far so good.
The first thing I found is that running "startx" hard-locked the system. By that I mean it was completely unresponsive, neither CTRL-ALT-BACKSPACE nor CTRL-ALT-DEL were effective and I could not switch to a console terminal so I had to press the computer's reset switch. Thankfully it logged this event, which I found in /var/log/grsec.log. It seems that /usr/bin/Xorg was getting killed off. This was easily remedied by lifting the mprotect() restriction on the Xorg binary:
| Code: | | localhost ~ # paxctl -m /usr/bin/Xorg |
After doing that, X started up successfully and loaded my KDE environment as normal. This is where I found something very strange. Any time I press the CTRL key, or the ALT key, or tried to make a + character by pressing SHIFT and the "+/=" key, the screen would go black and the machine would hardlock again. This happened 100% of the time, no exceptions. As I could find no one else who had this problem, and I missed a clue in my logs, I had to use good old trial-and-error methods.
What I found was that having xorg-server compiled with SSP is what caused this odd behavior. I still primarily use the gcc-3.4.6 compiler on this Hardened system. I do have the gcc-4.3.2 compiler but it is still marked as "unstable" via ~x86 keyword so I only use it when I encounter a package that cannot be compiled with the older GCC, which is rare.
Unfortunately it was not until I already solved this issue that I noticed this output from SSP in my logs:
| Code: | | Apr 7 13:37:00 localhost X: stack smashing attack in function XkbHandleActions - terminated |
Noticing that early on would have saved me some time. Ah, well. I'll have to remember that next time. 
This is the GCC configuration that caused these lockups because it included SSP:
| Code: | localhost ~ # gcc-config -l
[1] i686-pc-linux-gnu-3.4.6 *
[2] i686-pc-linux-gnu-3.4.6-hardenednopie
[3] i686-pc-linux-gnu-3.4.6-hardenednopiessp
[4] i686-pc-linux-gnu-3.4.6-hardenednossp
[5] i686-pc-linux-gnu-3.4.6-vanilla
[6] i686-pc-linux-gnu-4.3.2
[7] i686-pc-linux-gnu-4.3.2-hardenednopie
[8] i686-pc-linux-gnu-4.3.2-vanilla
localhost ~ # |
To have a stable xorg-1.5.3 that won't lock up when I press the CTRL or ALT keys or certian SHIFT combinations, I used the "nossp" configuration:
| Code: | localhost ~ # gcc-config 4
* Switching native-compiler to i686-pc-linux-gnu-3.4.6-hardenednossp ...
>>> Regenerating /etc/ld.so.cache... [ ok ]
* If you intend to use the gcc from the new profile in an already
* running shell, please remember to do:
* # source /etc/profile
localhost ~ # source /etc/profile
localhost ~ # gcc-config -l
[1] i686-pc-linux-gnu-3.4.6
[2] i686-pc-linux-gnu-3.4.6-hardenednopie
[3] i686-pc-linux-gnu-3.4.6-hardenednopiessp
[4] i686-pc-linux-gnu-3.4.6-hardenednossp *
[5] i686-pc-linux-gnu-3.4.6-vanilla
[6] i686-pc-linux-gnu-4.3.2
[7] i686-pc-linux-gnu-4.3.2-hardenednopie
[8] i686-pc-linux-gnu-4.3.2-vanilla
|
Then I just had to recompile xorg-server:
| Code: | | localhost ~ # emerge --oneshot xorg-server |
And change the GCC configuration back to my default:
| Code: | localhost ~ # gcc-config 1
* Switching native-compiler to i686-pc-linux-gnu-3.4.6 ...
>>> Regenerating /etc/ld.so.cache... [ ok ]
* If you intend to use the gcc from the new profile in an already
* running shell, please remember to do:
* # source /etc/profile
localhost ~ # source /etc/profile
localhost ~ # gcc-config -l
[1] i686-pc-linux-gnu-3.4.6 *
[2] i686-pc-linux-gnu-3.4.6-hardenednopie
[3] i686-pc-linux-gnu-3.4.6-hardenednopiessp
[4] i686-pc-linux-gnu-3.4.6-hardenednossp
[5] i686-pc-linux-gnu-3.4.6-vanilla
[6] i686-pc-linux-gnu-4.3.2
[7] i686-pc-linux-gnu-4.3.2-hardenednopie
[8] i686-pc-linux-gnu-4.3.2-vanilla
localhost ~ # |
Now that xorg-server has been compiled without SSP (from the above, note that PIE does work) and has had the mprotect() restriction lifted from the /usr/bin/Xorg binary, X and KDE are both quite stable and I have had no further problems. I hope this helps someone or at least saves them some time.
Last edited by causality on Tue Apr 07, 2009 9:12 pm; edited 1 time in total |
|
| Back to top |
|
 |
Sadako
Advocate
Joined: 05 Aug 2004
Posts: 3744
Location: sleeping in the bathtub
|
| Posted: Tue Apr 07, 2009 8:53 pm Post subject: |
|
|
I don't think you've actually solved this issue, just worked around it.
I've been running xorg under hardened gentoo for years, compiled with ssp, and I've never needed to disable mprotect on xorg, or anything else related.
Are you by any chance using binary ati or nvidia drivers or something?
_________________
"You have to invite me in" |
|
| Back to top |
|
|
causality
Apprentice
Joined: 03 Jun 2006
Posts: 156
|
| Posted: Tue Apr 07, 2009 9:10 pm Post subject: |
|
|
Sorry I should have specified. Yes I am using the binary NVIDIA drivers, as in x11-drivers/nvidia-drivers. I know that this issue probably would not have happened had I been using the "nv" or "vesa" drivers. I've edited my original post to include this information.
My feeling about that is that I'd greatly prefer to use the open-source "nv" driver, and I will do so the moment it supports full 3D acceleration. Until then, it doesn't make much sense to me to pay for a decent video card and then be unable to use its full capabilities. That nvidia-driver is in fact the only binary/proprietary software on this machine. |
|
| Back to top |
|
|
kallamej
Administrator
Joined: 27 Jun 2003
Posts: 4775
Location: Gothenburg, Sweden
|
| Posted: Thu Apr 09, 2009 3:45 pm Post subject: |
|
|
| causality wrote: | | Sorry I should have specified. Yes I am using the binary NVIDIA drivers, as in x11-drivers/nvidia-drivers. I know that this issue probably would not have happened had I been using the "nv" or "vesa" drivers. I've edited my original post to include this information. |
I've had the same problem with the nv driver (as the legacy drivers doesn't work with xorg-server-1.5.3). I couldn't find anything about the stack smash in my logs, though, only Xorg segfaulting. See also this bug for reference.
_________________
Please read our FAQ Forum, it answers many of your questions.
irc: #gentoo-forums on irc.freenode.net |
|
| Back to top |
|
|
ial
Apprentice
Joined: 27 Dec 2008
Posts: 159
Location: Warsaw (Warszawa)
|
| Posted: Thu Apr 09, 2009 7:22 pm Post subject: |
|
|
| I must report EXACTLY the same issue however I do not use neither NVidia card nor any binary dirver! I use the 'intel' driver and also trouble shot "SSP attact" in my debug log on Alt/Ctrl/Shft keys hit... Interesting is this does not happen when 'Xorg' is run instead of 'startx'. Please, HELP since just recompiling xorg-server without SSP has not helped in my hardened system case! Where to look for the very cause of the problem? When 'Xorg' is run and afterwards terminated with Alt+Ctrl+Backspace the following strange message comes out on the console: error setting MTRR (base = 0xd0000000, size = 0x03000000, type = 1) Invalid argument (22) |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Desktop Environments
