# [solved] unable to boot hardened kernel 3.1

## Veldrin

Dear all,

I am not quite sure, on how I should troubleshoot this problem. So any insight, or trick would help.

The same issue applies for both 3.0 and 3.1 series.

I want to switch from gentoo-sources over to hardened-sources on my notebook, but the hardened kernel does not boot. Even when I copy over the my current working config (gentoo-sources-3.1.4) to hardened-sources (3.1.3) without any change (built is done via genkernel) it does not boot. Does hardened apply some changes, that are not visible via the config?

When I say does not boot, I mean, that I get the grub prompt, hit enter, and then only a cursor appears. no sign of booting, no hard disk (ssd) activity.

Admittedly, I only waited for some 30 second, never longer. (normally the kernel is initialized within 3 seconds, and lines are appearing on screen after 1 (or less) seconds). 

grub is 64-bit efi binary, and as mentioned, it works fine with gentoo sources.

```
root@belshirash ~ # emi

Portage 2.2.0_alpha79 (hardened/linux/amd64/desktop, gcc-4.6.2, glibc-2.14.1-r1, 3.1.4-gentoo x86_64)

=================================================================

System uname: Linux-3.1.4-gentoo-x86_64-Intel-R-_Core-TM-_i7-2620M_CPU_@_2.70GHz-with-gentoo-2.1

Timestamp of tree: Fri, 02 Dec 2011 23:45:01 +0000

app-shells/bash:          4.2_p20

dev-java/java-config:     2.1.11-r3

dev-lang/python:          2.7.2-r3, 3.2.2

dev-util/cmake:           2.8.6-r4

dev-util/pkgconfig:       0.26

sys-apps/baselayout:      2.1

sys-apps/openrc:          0.9.4

sys-apps/sandbox:         2.5

sys-devel/autoconf:       2.13, 2.68

sys-devel/automake:       1.11.1-r1

sys-devel/binutils:       2.22

sys-devel/gcc:            4.6.2

sys-devel/gcc-config:     1.5-r2

sys-devel/libtool:        2.4.2

sys-devel/make:           3.82-r3

sys-kernel/linux-headers: 2.6.39 (virtual/os-headers)

sys-libs/glibc:           2.14.1-r1

Repositories: gentoo kde local

Installed sets: @kde-4.8, @kdeaccessibility-4.8, @kdeadmin-4.8, @kdeartwork-4.8, @kdebase-4.8, @kdeedu-4.8, @kdegames-4.8, @kdegraphics-4.8, @kdelibs-4.8, @kdemultimedia-4.8, @kdenetwork-4.8, @kdepim-4.8, @kdetoys-4.8, @kdeutils-4.8, @system

ACCEPT_KEYWORDS="amd64 ~amd64"

ACCEPT_LICENSE="* -@EULA"

CBUILD="x86_64-pc-linux-gnu"

CFLAGS="-march=native -O2 -pipe -floop-interchange -floop-strip-mine -floop-block"

CHOST="x86_64-pc-linux-gnu"

CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/openvpn/easy-rsa"

CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"

CXXFLAGS="-march=native -O2 -pipe -floop-interchange -floop-strip-mine -floop-block"

DISTDIR="/usr/portage/distfiles"

EMERGE_DEFAULT_OPTS="--misspell-suggestions=n --jobs=3"

FEATURES="assume-digests binpkg-logs distlocks ebuild-locks fixlafiles news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch usersandbox usersync"

FFLAGS=""

GENTOO_MIRRORS="http://sunsite.cnlab-switch.ch/mirror/gentoo/  http://www.ibiblio.org/pub/Linux/distributions/gentoo"

LANG="en_US.UTF-8"

LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--sort-common -Wl,-z,relro -Wl,-z,now"

LINGUAS="en en_US"

MAKEOPTS="-j5 -l11"

PKGDIR="/usr/portage/packages"

PORTAGE_COMPRESS="xz"

PORTAGE_COMPRESS_FLAGS="--extreme"

PORTAGE_CONFIGROOT="/"

PORTAGE_RSYNC_EXTRA_OPTS="--exclude=/.snapshot --exclude=/lost+found"

PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"

PORTAGE_TMPDIR="/var/tmp"

PORTDIR="/usr/portage"

PORTDIR_OVERLAY="/var/lib/layman/kde /usr/local/portage"

SYNC="rsync://blakharaz.schlumberger.soho/gentoo-portage"

USE="X a52 aac acl acpi alsa amd64 bash-completion berkdb bluetooth branding bzip2 cairo caps cli consolekit cracklib crypt cups cxx dbus dri dts dvd emboss encode exif expat fam ffmpeg fftw firefox flac gdbm gdu gif gpm gstreamer handbook hardened iconv icu idn ipv6 jpeg justify kde kerberos lcms ldap libedit libnotify logrotate lzma mad mmx mng modules mp3 mp4 mpeg mpi mudflap multilib mysql ncurses nls nptl nptlonly ogg openexr opengl openmp pam pango pax_kernel pcre pdf png policykit ppds pppd pulseaudio qt3support qt4 sdl semantic-desktop session smp spell sqlite sse sse2 ssl svg sysfs syslog tcpd theora threads tiff truetype udev unicode urandom usb v4l v4l2 vim-syntax vorbis x264 xattr xcb xml xorg xulrunner xv xvid zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" GRUB_PLATFORMS="efi-64 pc" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_US" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="intel vesa v4l v4l2" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"

Unset:  CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND
```

V.

----------

## Hu

Yes, hardened applies many changes that are not configurable.  They are scattered all over the kernel source, and would require a great many extra Kconfig entries to describe in detail.

My first guess is that it is because you are using an EFI-based boot.  In order to get no output at all, something must go wrong very early in the boot, and failure to handle boot from EFI is a possible explanation.

What command line options do you pass to your kernel?  If you build an allnoconfig hardened kernel, does that get farther?  I expect such a kernel will panic in the end due to missing drivers, but it would be interesting to see if it can get anywhere at all.

Although I doubt this will help, can you try other hardened kernels, such as the latest hardened 2.6.38 and 2.6.39?

----------

## Veldrin

Thanks for the insights.

The notebook is pretty new, and had not run anything older than 3.0 on it. But I'll give it a try.

But first, I'd will do a allnoconfig.

As for the boot option, see below. IIRC I already tried to remove any non essential part (i.e the last tweaks), but I could try to strip them even more.

```
menuentry "3.1.3-hardened-1 - Divemaster Edition" --class gentoo --class gnu-linux --class gnu --class os {

        load_video

        set gfxpayload=keep

        insmod gzio

        insmod part_gpt

        insmod fat

        set root='(hd0,gpt1)'

        linux /efi/linux-3.1.3-hardened-1 ro crypt_root=/dev/sda3 root_keydev=/dev/sda1 root_key=/efi/root.gpg real_root=/dev/mapper/root real_rootflags=relatime,autodefrag,discard,ssd,subvol=gentoo mce vbe crypt_swap=/dev/sda2 swap_keydev=/dev/sda1 swap_key=/efi/swap.gpg real_resume=/dev/mapper/swap threadirqs pcie_aspm=force i915.lvds_downclock=1 clocksource=acpi_pm i915.i915_enable_rc6=1 i915.i915_enable_fbc=1 scandelay=0

        initrd /efi/initrd-3.1.3-hardened-1

}
```

I should be back in half an hour with the first results.

V.

----------

## Veldrin

Ok, I skipped the allnoconfig test, and went straight to defconfig test for 3.1.3 and 2.6.39-r8.

The results remain the same: black screen, steady cursor, no boot

stripping the kernel options (i.e removing anything except root and dmcrypt parts) showed slightly more output from grub, but still no booting kernel.

I also bumped into the Blog entry from Diego which basically states, that efi and hardened (at least pax) are not really compatible. I'll have a look, if can get grub to boot from

----------

## Hu

You said you copied over your sys-kernel/gentoo-sources configuration.  I expect that you then received default values for any GRsecurity options, which may be default enabled in some cases.  Diego's post states that KERNEXEC is incompatible with EFI, at least in the versions he tried.  Try disabling all configurable hardened features.  If that works, turn them back on piecemeal.  You could also look for the latest PaX patches upstream, since one of the comments in the blog you linked indicates that the EFI/PaX compatibility is a work in progress.

----------

## Veldrin

I forgot to mention, that PaX and grsec are completely disabled.

I try something else: patching the gentoo kernel with pax (and leave out grsec).

And maybe (if i get the time) I'll have a look gentoo-hardened on irc. 

V.

----------

## Veldrin

OK, grsec (or at least the additional patches in the hardened set) seems to be the bad guy.

applying the pax patchset over gentoo-sources-3.1.4 results in a bootable kernel (incl active pax).

Hu, thanks for being my pain in the ass to investigate a little further. 

V.

----------

## Veldrin

hmm, it seems that the update made in the past week fixed my issue. both patch set (pax only, and grsec+pax) now for flawlessly.

V.

----------

