Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#49512 - [linux-grsec]

Attached to Project: Community Packages
Opened by Hermann Zahnweh (eigengrau) - Monday, 30 May 2016, 09:18 GMT
Last edited by Doug Newgard (Scimmia) - Thursday, 02 June 2016, 17:48 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To No-one
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
After upgrading to linux-grsec 4.5.5.201605211442-1, some (all?) Kernel modules won’t load, including iptables (thus exposing the host).

Additional info:
I’m booting the kernel as a KVM guest using the option «pax_nouderef».

Logs:
Mai 30 09:37:03 eigengrau kernel: Linux version 4.5.5.201605211442-1-grsec (builduser@strcat) (gcc version 6.1.1 20160501 (GCC) ) #1 SMP PREEMPT Mon May 23 19:01:40 EDT 2016
…
Mai 30 09:37:03 eigengrau systemd[1]: systemd-modules-load.service: Main process exited, code=exited, status=1/FAILURE
Mai 30 09:37:03 eigengrau systemd[1]: Failed to start Load Kernel Modules.
Mai 30 09:37:03 eigengrau systemd[1]: systemd-modules-load.service: Unit entered failed state.
Mai 30 09:37:03 eigengrau systemd[1]: systemd-modules-load.service: Failed with result 'exit-code'.
…
Mai 30 09:37:03 eigengrau systemd-modules-load[154]: Failed to lookup alias 'tun': Function not implemented
Mai 30 09:37:03 eigengrau systemd-sysctl[178]: Couldn't write 'fq_codel' to 'net/core/default_qdisc', ignoring: No such file or directory
Mai 30 09:37:03 eigengrau systemd-sysctl[178]: Couldn't write '1' to 'net/ipv6/conf/all/rp_filter', ignoring: No such file or directory
…
Mai 30 09:37:04 eigengrau systemd[1]: Couldn't stat device /dev/net/tun
…
Mai 30 09:37:05 eigengrau iptables-restore[266]: modprobe: FATAL: Module ip_tables not found in directory /lib/modules/4.5.5.201605211442-1-grsec
…
Mai 30 09:37:05 eigengrau ip6tables-restore[262]: modprobe: FATAL: Module ip6_tables not found in directory /lib/modules/4.5.5.201605211442-1-grsec
…
Mai 30 09:37:05 eigengrau openvpn@server[284]: ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
This task depends upon

Closed by  Doug Newgard (Scimmia)
Thursday, 02 June 2016, 17:48 GMT
Reason for closing:  Not a bug
Comment by Hermann Zahnweh (eigengrau) - Monday, 30 May 2016, 09:33 GMT
Sorry, forgot to add a meaningful title; please edit as you see fit.
Comment by Doug Newgard (Scimmia) - Wednesday, 01 June 2016, 00:07 GMT
This sounds like a setup issue. What, exactly, do you have in /usr/lib/modules/?
Comment by Hermann Zahnweh (eigengrau) - Thursday, 02 June 2016, 13:22 GMT
Hi Doug!

> This sounds like a setup issue. What, exactly, do you have in /usr/lib/modules/?

I think this was indeed installation related. After reinstalling the latest grsec package, everything worked until I installed the netatop kernel module. It looks like the issue arose because inserting the netatop module into the current grsec kernel freezes the machine. My guess is that the generated module dependency files hadn’t been properly flushed to disk when the crash first occurred, causing the errors reported.

Loading...