# hardened-sources-2.6.28-r9 (in virtualbox)

## pjp

Any generalized input on figuring out why a kernel isn't booting?

I got a gentoo-sources-2.6.29 going without issues, just to make sure.  I've been trying to go through the various sections to make sure they're comparably configured other than the hardened options, but haven't found anything yet (still filtering).

Being in virtualbox, I can't easily copy the the screen data as it locks up without allowing copy/paste.

The boot sequence fails right before it starts to access the hard drive.  There is output about the IDE, and it not being 100% compatible, and using "NOHz" timer.  These messages seem to appear the same with the gentoo-sources kernel, so I'm at a loss.  

Was hoping this type of issue had a "common solution" or there might have been other known problems with the hardened kernel.

I'll try and get better details next week when I get back to work.

Thanks for any input.

----------

## pappy_mcfae

Without looking at your kernel .confg and the information required to work with it, it's impossible to know what is going on. Please post your current kernel .config, the results of lspci -n and cat /proc/cpuinfo and I'll see what I can see. Actually post both the working and non-working .configs via pastebin.com *see sig for link*

Blessed be!

Pappy

----------

## pjp

Thanks.  No access from work, so it won't be until tomorrow evening.

----------

## pappy_mcfae

No problem.

Blessed be!

Pappy

----------

## pjp

An update.  I had been removing various parts of the kernel as I determined them to be unnecessary.  After removing IPv6, I was able to successfully boot to the hardened kernel, but it wasn't stable.  Attempts to reboot failed at the same area as originally reported, except for infrequent successes.

I then removed EFI (thought I had already removed it) and the successful boots into the hardened kernel happen more frequently now (I'm hesitant to say "all the time").  Attempts to scp out of the virtual environment crash the running OS, but the copies appear to succeed.

Some additional items I noticed: Output from the last compile of my current "most successful" running hardened kernel:

```
MODPOST vmlinux.o

WARNING: modpost: Found 3883 section mismatch(es).

To see full details build your kernel with:

'make CNFIG_DEBUG_SECTION_MISMATCH=y'
```

I couldn't find CONFIG_ACPI_SYSTEM via 'make menuconfig' so I'm wondering if it is supposed to be there? 

```
> grep ACPI_SYS config_2.6.2*

config_2.6.28-hardened-r9:CONFIG_ACPI_SYSFS_POWER=y

config_2.6.28-hardened-r9:CONFIG_ACPI_SYSTEM=y

config_2.6.29-gentoo-r5:CONFIG_ACPI_SYSFS_POWER=y
```

Here's a diff of my current "reliably" booting hardened kernel compared to the prior version (removed CONFIG_EFI only via menuconfig).  I'm confused as to why the current config suddenly added "CONFIG_PAX_KERNEXEC=y" as I haven't gone anywhere near hardened settings, and I didn't enable anything either. 

```
> diff config_2.6.28-hardened-r9.prev config_2.6.28-hardened-r9

4c4

< # Mon Jul 20 06:37:46 2009

---

> # Mon Jul 20 10:39:42 2009

211d210

< CONFIG_X86_F00F_BUG=y

274c273

< CONFIG_EFI=y

---

> # CONFIG_EFI is not set

1282d1280

< # CONFIG_FB_EFI is not set

1578d1575

< # CONFIG_EFI_VARS is not set

1968a1966

> CONFIG_PAX_KERNEXEC=y
```

Current 2.6.28-hardened-r9 config:  http://pastebin.com/m262ad4f4

Current 2.6.29-gentoo-r5 config: http://pastebin.com/dd0b5232

To confirm it was running as hardened: 

```
 09:51:09 up 2 min,  1 user,  load average: 0.53, 0.40, 0.16

Linux hrd-tst1 2.6.28-hardened-r9 #11 Mon Jul 20 06:44:53 MDT 2009 i686 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux
```

Thanks!

----------

## pappy_mcfae

I've got your .configs. Now if I could get the results of lspci -n and cat /proc/cpuinfo as well as your /etc/fstab file and I'll go from there.

Blessed be!

Pappy

----------

## pjp

Sorry 'bout that.

lspci -n:

```
00:00.0 0600: 8086:1237 (rev 02)

00:01.0 0601: 8086:7000

00:01.1 0101: 8086:7111 (rev 01)

00:02.0 0300: 80ee:beef

00:03.0 0200: 1022:2000 (rev 40)

00:04.0 0880: 80ee:cafe

00:06.0 0c03: 106b:003f

00:07.0 0680: 8086:7113 (rev 08)

00:0b.0 0c03: 8086:265c
```

cpuinfo:

```
processor   : 0

vendor_id   : AuthenticAMD

cpu family   : 15

model      : 47

model name   : AMD Athlon(tm) 64 Processor 3000+

stepping   : 2

cpu MHz      : 1793.019

cache size   : 512 KB

fdiv_bug   : no

hlt_bug      : no

f00f_bug   : no

coma_bug   : no

fpu      : yes

fpu_exception   : yes

cpuid level   : 1

wp      : yes

flags      : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt lm 3dnowext 3dnow pni lahf_lm

bogomips   : 3586.03

clflush size   : 64

power management: ts fid vid ttp tm stc
```

fstab:

```
# /etc/fstab: static file system information.

#

# noatime turns off atimes for increased performance (atimes normally aren't 

# needed; notail increases performance of ReiserFS (at the expense of storage 

# efficiency).  It's safe to drop the noatime options if you want and to 

# switch between notail / tail freely.

#

# The root filesystem should have a pass number of either 0 or 1.

# All other filesystems should have a pass number of 0 or greater than 1.

#

# See the manpage fstab(5) for more information.

#

# <fs>         <mountpoint>   <type>      <opts>      <dump/pass>

# NOTE: If your BOOT partition is ReiserFS, add the notail option to opts.

#/dev/BOOT/      /boot      ext2      noauto,noatime   1 2

/dev/hda1      /      ext2      noatime      0 1

/dev/hda2      none      swap      sw      0 0

/dev/cdrom      /mnt/cdrom   auto      noauto,ro   0 0

#/dev/fd0      /mnt/floppy   auto      noauto      0 0

# glibc 2.2 and above expects tmpfs to be mounted at /dev/shm for 

# POSIX shared memory (shm_open, shm_unlink).

# (tmpfs is a dynamically expandable/shrinkable ramdisk, and will

#  use almost no memory if not populated with files)

shm         /dev/shm   tmpfs      nodev,nosuid,noexec   0 0
```

The virtual image survived being paused overnight.  Restored this AM, and worked for a while.  I was able to ssh to another server and exit without problems.  A while later (hour+ ?) scp to the same server caused it to hang.  Just in case that's useful.  Handful of more boots to the hardened kernel work (though it seems slower, assuming that could be the hardened components working).

----------

## pappy_mcfae

Wow, what an incredibly spartan lspci -n. Double check to make sure your ISA devices are turned on since none of them came through. If you have none, then don't worry about it.

I set up the hardened kernel first by using one of my seeds. There were lots of issues with your .config, and when I see that, it's a lot quicker to just start from scratch. If things work out good from the outset, I'll just mirror the settings I used to the gentoo-sources .config, and you'll be set to go.

Note, this is a Woody Allen kernel; as insecure as they come. My hardened seeds come without hardened security turned on. It's up to you to set your security comfort level.

Click here for your new .config. Compile as is.

For the best results, please do the following:

1) Move your .config file out of your kernel source directory (/usr/src/linux-2.6.28-hardened-r9 ).

2) Issue the command make mrproper. This is a destructive step. It returns the source to pristine condition. Unmoved .config files will be deleted!

3) Copy my .config into your source directory.

4) Issue the command make && make modules_install.

5) Install the kernel as you normally would, and reboot.

6) Once it boots, please post /var/log/dmesg so I can see how things loaded.

If things are a go for this kernel, just let me know, and I'll set up the gentoo-sources kernel in much the same way.

Blessed be!

Pappy

----------

## pjp

 *pappy_mcfae wrote:*   

> Wow, what an incredibly spartan lspci -n. Double check to make sure your ISA devices are turned on since none of them came through. If you have none, then don't worry about it.

  OK, will take a look.  I thought it seemed sparse, but its been a while since I've looked at that on my main system.

 *pappy_mcfae wrote:*   

> There were lots of issues with your .config, and when I see that, it's a lot quicker to just start from scratch.

  Is this something you see just by browsing, or is there a tool you run to review?  Just curious.

The config was the default from the kernel.  I obviously modified it to remove what appeared unnecessary and to match the working gentoo config.

 *pappy_mcfae wrote:*   

> Note, this is a Woody Allen kernel; as insecure as they come. My hardened seeds come without hardened security turned on. It's up to you to set your security comfort level.

  OK.  I know nothing about it, so that'll just expand the learning experience.

Will try first thing in the AM.  Thanks for your help.

----------

## pappy_mcfae

 *pjp wrote:*   

>  *pappy_mcfae wrote:*   Wow, what an incredibly spartan lspci -n. Double check to make sure your ISA devices are turned on since none of them came through. If you have none, then don't worry about it.  OK, will take a look.  I thought it seemed sparse, but its been a while since I've looked at that on my main system.

 

It almost looks as spartan as my old P-II.

 *Quote:*   

>  Is this something you see just by browsing, or is there a tool you run to review?  Just curious.

 

Lots of experience. In general, there are some devices which by their existence tell me that there may be other issues. When I see them enabled, I tend to prefer to start fresh. 

Fair CPU scheduling is one of them. When I see it, and other devices that aren't displayed in lspci -n, that's a big warning sign to me. Also, the ATA/ATAPI/MFM/RLL drivers turned on with the SATA drivers is another sign.

 *Quote:*   

> The config was the default from the kernel.  I obviously modified it to remove what appeared unnecessary and to match the working gentoo config.

 

That's really the best way to do it. Use the settings from the working kernel to make the other work as well.

 *Quote:*   

>  *pappy_mcfae wrote:*   Note, this is a Woody Allen kernel; as insecure as they come. My hardened seeds come without hardened security turned on. It's up to you to set your security comfort level.  OK.  I know nothing about it, so that'll just expand the learning experience.

 

That's what I like to read! Learning is the best thing to do with one's life...as a matter of fact, it's really the only thing.

 *Quote:*   

> Will try first thing in the AM.  Thanks for your help.

 

You're most welcome.

Blessed be!

Pappy

----------

## pjp

No luck with booting the kernel.

Moved the config, ran mrproper, put in the new config, booted with it, and it stops after khelper.  VB reports it as "running" (as opposed to a hard crash).  

I haven't had an opportunity to pursue lspci output yet if that is critical.

Here's what I could capture (manually trasncribed if there are any typos):

```
SLUB: Genslabs=12, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1

Calibrating delay loop (skipped), value calculated using timer freqeuncy.. 3580.40 BogoMIPS (lpj=1790200)

Mount-cache hash table entries: 512

CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (64 bytes/line)

CPU: L2 Cache: 512K (64 bytes/line)

Intel machine check architecture supported.

Intel machine check reporting enabled on CPU#0

Checking 'hlt' instruction... OK.

SMP alternatives: switching to UP code

Freeing SMP alternatives: 16k freed

ACPI: Core revision 20080926

ACPI: setting ELCR to 0200 (from 0e00)

weird, boot PCU (#0) not lsitedby the BIOS.

SMP motherboard not detected.

APIC calibration not consistent with PM Timer: 104ms instead of 1000ms

APIC delta adjusted to PM-Timer: 6280222 (6553605)

SMP disabled

Brought up 1 CPUs

Total of 1 processors activated (3580.40 BogoMIPS).

khelper used greatest stack depth: 7200 bytes left
```

----------

## bbgermany

Hi,

check out this config. Its running on VBox 3.0.2 Windows host. SELinux is enabled in enforcing mode on the guest.

http://www2.bitch-at-me.com/config-vbox-hardened

bb

----------

## pappy_mcfae

Does it come back with a kernel panic? If not, change the settings under Processor type and features, turn off SMP, and retry. Since it is only a single core CPU, that is most likely the issue. Please let me know if that works.

Blessed be!

Pappy

----------

## pjp

I went ahead and disabled/changed the following and it worked.  I recompiled with the Opteron Proc and that worked too.  I'll try adding Machine Check & restoring High mem to 4G.  Thanks.

Proc type & feat

            - SMP

            - Proc family (586)

            - Machine Check

            - High mem (off)

Networking Options

            - IPv6

File systems

            - NFS[/code]

----------

## pjp

 *bbgermany wrote:*   

> Hi,
> 
> check out this config. Its running on VBox 3.0.2 Windows host. SELinux is enabled in enforcing mode on the guest.
> 
> http://www2.bitch-at-me.com/config-vbox-hardened
> ...

  Thanks, I'll take a look.  I'm not sure if I'm using SELinux policies yet though.

----------

## pappy_mcfae

Glad you're up and running.

Blessed be!

Pappy

----------

## pjp

Had a bad night or I would've posted last night.

Recompiled with Machine Check & High mem (4G) and it worked too, so looks like it was SMP.

Now to see if I can figure out what the differences are.

Thanks again.

----------

