OK, any pointers as to what the heck I'm doing wrong?

On my test machine, I just updated the grsec kernel and php (kernel is 30.3 and php is 4.3.11.-7) on rh9

I wanted to check that gd was working -- it didn't seem to be. Then I found that the actual culprit was the grsec kernel. When I run the php file that calls gd functions, I get:



(other php files work fine)

Now I don't want to chpax -spmr httpd, but I tried to do it anyway, and got the kind of error message I associate with trying to use chpax when grsec isn't loaded: "Text file in use"

Then I thought "Hang on -- gradm is now installed. I wonder if that has anything to do with this?"

But "gradm -anything-except-help" gives me a "Could not open dev/gradm" error.

So, what's changed? What am I doing wrong?

Thanks,

Faris.

Do you have this device:

/dev/grsec (gradm needs that)

What version of gradm are you running?

gradm --version

And which kernel:

uname -a

Yup - /dev/grsec exists:



But, for example:




Gradm os 2.1.4:




Kernel is 2.4.30-3




These are all installed via a "yum update" along with php 4.3.11-7.

Faris.

p.s. this is all under RedHat 9 under vmware5.

OK, theres a bug in that version. We'll put out an update shortly. The minor number is wrong on the /dev/grsec device in that version, which is why gradm thinks it doesn't exist.

Regardless, this isn't whats causing the httpd PAX log entires. None of the RBAC rules are loaded unless you enable them, so its not gradm thats causing the problem. Its in one of the libraries, we're tracking it down now to see if a simple chpax will solve the problem.

Try this in the short term, try chpax -emrpsx on your libgd libraries.

rm /dev/grsec
mknod -m 0622 /dev/grsec c 1 12

That should fix the minor number and allow you to run gradm. To see if its working, try this:

gradm -S

Also, if you have never set a password gradm, you will need to run this:

gradm -P

Thanks Mike. I'll give it a go.

But what exactly am I doing here? (changing the minor number, obviously, but what it that/what is this about?)



Faris.

Thats a special device (/dev/grsec) and for gradm to work, the device has to be configured correctly. gradm uses that device to communicate with the kernel (to change the ACLs, read the status, etc.)

Hmm. Errm.....

gradm -S doesn't give an error. Just nothing.

I did a gradm -P and set a password.

Then I did a gradm -a admin then entered the above password and got the following:

"You are using incompatible versions of gradm and grsecurity.
Please update both versions to the ones available on the website.
Make sure your gradm has been compiled for the kernel you are currently running."


chpax -e(etc) on
/usr/lib/libgd.so.1
/usr/lib/libgd.so.1.8
/usr/lib/libgd.so.1.8.4

Didn't help. I still get the PAX error. But I didn't get the "text file in use" error, so at least we have got over that hurdle

Did I do this on the right files?

Faris.

Also, forgot to ask, which version of php is installed on your system?

Sorry mike. I didn't see your reply until now.

Everything seems to work fine with the latest everything installed.

Faris.