u2mfn kernel patch on github?

[Joonas Lehtonen]

Hi,

I'm building my own custom kernel packages for VMs. I'd like to add
the u2mfn module directly to the kernel instead of using the DKMS way.

Is there a patch that I could apply on a vanilla kernel?
(I'd like to add it to the kernel.spec)

I didn't see it in the list here:

https://github.com/QubesOS/qubes-linux-kernel/blob/stable-3.18/series.conf

thanks,
Joonas

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

There is no such patch anywhere, but it shouldn't be hard. You need to
add u2mfn somewhere into kernel sources (drivers/misc?) and add it to
Makefile.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXJHxMAAoJENuP0xzK19csbFYH/jdZBNuI9hhVaed7w9MccQgV
bqpd4zKWXECtkf/y/q4boEnbTU/FvIPQvpFsjUJK68RXVMQwe/VTK6ovNek2bn3n
RB9DT47dWVPf999o7pxS/y88r6L/20sstGILOA1zDix3xWfXWpbrbm/M7QszTrZO
YfraXNlDj5Agb8OcDHIAxYmVo6VLggNBeNXDv+Wcw5pYjWqeIymAG2ZXQ7jd5NrT
FXnBANC5Z2RQJw0UNmUtsKtKYgI0rR8+D0ER/Y8o55omiCTDLrN9HycI4x6baAAX
0sK+RZDAqUFo7vDn8SLxnoI3QVD4XfUGSq6tnZ0KoegE8l0so5bNHyAz1Y5DDIQ=
=hHvV
-----END PGP SIGNATURE-----

[Joonas Lehtonen]

>> I'm building my own custom kernel packages for VMs. I'd like to add
>> the u2mfn module directly to the kernel instead of using the DKMS way.
>
>> Is there a patch that I could apply on a vanilla kernel?
>> (I'd like to add it to the kernel.spec)
>
>> I didn't see it in the list here:
>
>> https://github.com/QubesOS/qubes-linux-kernel/blob/stable-3.18/series.conf
>
> There is no such patch anywhere, but it shouldn't be hard. You need to
> add u2mfn somewhere into kernel sources (drivers/misc?) and add it to
> Makefile.

Ok, since there is no patch, lets see if we can get this to work with DKMS.

I'm building grsec kernels by removing all custom fedora patches from
the SPEC file (patch against the kernel.spec is attached).

After installing the resulting RPM (including devel and header packages)
I install u2mfn by invoking the following command:

dkms install u2mfn/3.1.8 -k 4.4.8-300.grsec.fc23.x86_64

that command is successful, but when I boot the kernel I get the
following error when I try to load the u2mfn Qubes OS module:

modprobe: ERROR: could not insert 'u2mfn': Exec format error
version magic '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload modversions
REFCOUNT GRSEC ' should be '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload
modversions REFCOUNT STACKLEAK_PLUGIN GRSEC
RANDSTRUCT_PLUGIN_AABBCC12345....


I'm not sure why there is a mismatch in the modversions?

Any ideas?

thanks!



https://forums.grsecurity.net/viewtopic.php?f=3&t=4461

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

No idea either... Are you sure you're building u2mfn using the right
headers? I guess it looks for them in /lib/modules/`uname -r`/build.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXJ7XeAAoJENuP0xzK19csBRwH/3H5GloaQ3oq3yM7K2/iC1PF
ZH0N+7Eb1c4kJgeykfTvw+GwMQMRJu690pQEO8TByS7lIBszGsaZS4jbZAj45xMX
w303oTZp2P9zJoeeMxdMyWK1oHwzzCSYaMR109s6/V7ydckJ4p6Z710ePCuhLU/H
5a4TtV9ZjS9uWXPGMuIWVHPiAT8JF8nidpTUGFtyvNgS8EmNjD+Qi8+63I1aTZIH
wd3eA0ljtOdckn0v+sfiqGN/9QuxNCY0YDRjW1tpTFp8g9oYlu6irf55v4whU4K0
OCjbaF0FeyY7oA+hpSScY6CtVlIXgp2WmAdPw3ZD6ktN9v1pOae7UXl68d4Sf2c=
=5hwe
-----END PGP SIGNATURE-----

[Joonas Lehtonen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

>> dkms install u2mfn/3.1.8 -k 4.4.8-300.grsec.fc23.x86_64
>
>> that command is successful, but when I boot the kernel I get the
>> following error when I try to load the u2mfn Qubes OS module:
>
>> modprobe: ERROR: could not insert 'u2mfn': Exec format error
>> version magic '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload
>> modversions REFCOUNT GRSEC ' should be
>> '4.4.8-300.grsec.fc23.x86_64 SMP mod_unload modversions REFCOUNT
>> STACKLEAK_PLUGIN GRSEC RANDSTRUCT_PLUGIN_AABBCC12345....
>
>
>> I'm not sure why there is a mismatch in the modversions?
>
> No idea either... Are you sure you're building u2mfn using the
> right headers? I guess it looks for them in /lib/modules/`uname
> -r`/build.

Yes I removed all other kernel packages (just to be sure) and only my
custom kernel headers are installed:

rpm -qa|grep kernel-
kernel-tools-libs-4.4.8-300.fc23.x86_64
kernel-core-4.4.8-300.grsec.fc23.x86_64
kernel-modules-4.4.8-300.grsec.fc23.x86_64
kernel-modules-extra-4.4.8-300.grsec.fc23.x86_64
kernel-headers-4.4.8-300.grsec.fc23.x86_64
kernel-devel-4.4.8-300.grsec.fc23.x86_64
qubes-kernel-vm-support-3.1.8-1.fc23.x86_64

ls -1 /lib/modules
4.1.13-9.pvops.qubes.x86_64
4.4.8-300.grsec.fc23.x86_64


/lib/modules/4.4.8-300.grsec.fc23.x86_64/build
is a link to
/usr/src/kernels/4.4.8-300.grsec.fc23.x86_64

I was also wondering if I need the patch that is used as a source file
in the SPEC file (kbuild-AFTER_LINK.patch), but if I use it the kernel
does not boot anymore.

What else could I check?

thanks!
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXJ9InAAoJENGIB/ssoMC2mR4P/0aSvHttwhGPz+XaNZEcNrPO
Ge0OlKf/BmWtM6HeHCOTN3+CsBl99rTA2DXw4rpAVxbPzj+dF0HqRkhlzb9pi90U
nWwI9Zn7qT010hX+2BEF3l4yfcDi/8eRQhns0CFLwMqiy2wBOCipf1Jf59WK0T4O
Sa+ohPBCjkCPsBMaSvJ80454tOxBUVga4KkVXSv1tbLu8VTKIMtV0aB9ZKw4a4Hq
8Gsq7FpxC4YLCtwByG5w+n8aOiQ7pOBFBvRKajXk1rr57eAsd3sfKI9X6pkOCn2V
b4h+4UmDDhC5liNQHcKem5Sll8F7QhcpnaRGeQqEwYY2mUlOGU3hAUhy2aT6hEpW
IZeZRcVdDWRx99+uSwJ4NHYMR4uspdeYcNCf7J1KJ1u1yj0huLB+rNClr+puJtXc
JVWqimSjnA9lXgHOqRQH1HVn+bvltwDMW1glu0BX6IXKBbJiqSBHS1iWcPo5Z8LL
6yJuTNzOQ4i+ndcxEF1qG+P4+NQ2bJ9Pwd9UZlz86nQ/Cu+lfu98p35hK4LXKXIz
qF3QpriE84o0rQmgITxg34e2yv3mw/q7z9bUwW6oyuIRUUd9klyoaBcZGvCLbpmx
xU/H2X+MzYJSNw8vExMxpyW2f7QOs03tv66E0A0tIPFreU36zR6697yfs7JZGgCD
eKasb5kExUpI826lHVgh
=L7mh
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Maybe something about kernel configuration? Is .config present in kernel
sources?

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXKQIPAAoJENuP0xzK19csRjcIAIWc/Z4vCoN7M/k50iS7cZx6
L+FRWDzNyI7EIF3vvfIU/OK+fkjq1XKvCseOLtd+b0Bhvq1UKqdvj17PPuDr1px3
3alCKez33ifLLoZENryrZkPwfD19zGEiltty+pnAN6nOr08FjVzvz18XVuTqnvj5
bF2ipW96pi1msLWtGG49GzInpdohIB4hsxqBg1aJCg9WNTDbf6JsRz5A4/HYW378
hhHM7KwQV0Zzr4PzNd4wYRy05GPCx0AFdI7WfoYn1U+eW84Nq+jyzgRX//ebH34F
GoVG8hEniBb/lpjDbxs+9LFbwUKGiGmPH3Uk/PLCyd7xiSYsT6NCWyGWSjihUAM=
=2Pwd
-----END PGP SIGNATURE-----

[Joonas Lehtonen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

(I'm resending this since it does not show up on the qubes-devel
mailing list archive.)

>> What else could I check?
>
> Maybe something about kernel configuration? Is .config present in
> kernel sources?

yes the config is present:
/usr/src/kernels/4.4.8-300.grsec.fc23.x86_64/.config

and matches the content of:
/boot/config-4.4.8-300.grsec.fc23.x86_64

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXLPYIAAoJENGIB/ssoMC2DmEQAKh3zOXfLJRCN1kk1QWR1Oeb
esPGezfO8g32suE0YZHcJ3FQ3Uf8omF8QnuboE+WTwI7jS+HahKovUDtkqFh9iGF
eMKW0nJn6SbJ/Af5OEjSqVSzfC7o64enGkSZBScqPainaPJWyQl/RABIGjeJi7b1
bICZrEAK5Nmfkz+0VpcNAlysLyUPUcxXV0QL8EqiStfX/3W/cofbC0GFxtOiBy6C
To8b0pl6riocyR8C+5VZ6pwUu07XSwg1bgKoJZMeT/iVq0SDnOT3Oiv7Nu6cOnpL
I08t+WQtjmEkW+SpRYr5RyIbJdu8uxfGT72be93Xk8arJYhtO7ad1J9GZEngDFyg
ju2wO2AdxTqv2cLVwbvh6RVpftziYvuEUQJj7eRZv2h/siPPr+oO4wHozEEbIDPs
soWKHMOnEWBBr8paCKuL6mej8ZN1JBjlZwYcSVz9R22OGjbknzKl2uXhv4w+c0g6
WvcrfI/Rps8YSaTKu1jGKXcxphimwIv+udHc6CeM1bntOdczqgqaWEMeAGjk3Hbr
n385yquNFnm/V4JgHgbyzG4DlOqufRyist+tjbtIwa18gW4C7uSC2vfytLReS1jo
CJ2i2WOv6vVugfKaejDLqwzYaTMi1ebcg3TzK3AzQ2Mt9ostEUE0WvGFSuHVwCPx
DaDU9US3VluYWzw+OAAv
=6qPI
-----END PGP SIGNATURE-----

[Joonas Lehtonen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

yes it is present:

/usr/src/kernels/4.4.8-300.grsec.fc23.x86_64/.config

and matches the content of:
/boot/config-4.4.8-300.grsec.fc23.x86_64

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJXKgqkAAoJENGIB/ssoMC2CXoQAKTZL/UbZzfl6Dtu2O7UXGXF
sk/s1gYB+MXbu0Hd4Ox77YWkZYxpQSjb/KVOy/sCT8B+U9fU/i4PV+6z0natVYkg
ohlCSrHWZIe3X1KMeVFDwovbnYDo/bedaLiuOs8sEcKRy499Ss+iCrqYzwrNp3/1
QovR6OuNmJxMRtk5EjNuK5E5vv3USWO2MdhhHB1yXpNSzyYb6sQxqJrFQcDUjsLj
5pWM50yrCKz/h5xldgZyUR3QUdMxBfZnhZEHPHWWkSsLIQgsCi2ZlRZqQZ4JRlf/
cBKP+9cBqxota2BpOaFom8zZPDY4AmsgEv7bOf3yO4RtNtpfFyVlX5mHchkdjoEe
vk1z1zNOr1Ie7bAKC0phvjFJquMIpbQyJ4OFvABiBG+ccl0VSnapm4wHQksxnGo5
xc1faXD+JQ6utP2e8WLjb4MmXe2qdYkz/Dc31dOPA4zXLIAYNO0W9ijTf7zZb9Ng
/b6v3SdMxVz9YDzluY32AKfS5Urmx99llpBPU69HPzJP8BVqtKbRtRp3lc6l37em
v7Iqtkmt0qU79cJ3QZZsA2Rf22bDVft7WYWTmF3I40PpaD73G/GV58jmrsDbjTnm
6xudXc4gRtvI53dDm5b/3dZrtZokAOZR91kl4u3H4pvTJK+uB4oFyxwHlLN9LHoW
DOJetxoH7XeVeVj+JNmu
=NeTD
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

No idea what is wrong...

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXLTuUAAoJENuP0xzK19csG58IAJjs4ZbfRfno6HRWe8inw1Dl
8/V4kXMLgxioAfE52t6N/q2vcdiua+S7RErnAOunlDLU5dEpeSnAIcA6jcTK5r83
Gg1MoiL1K89KEnH3Zb4dtOljIi40AfIUotX+P9NihRvnlOP7O2m79Ly99T+T0WQU
5FUj2EJpNIOO21jCIRU9n2vvAw9iWA36TUXjmG0BbD7/zM0KbRbOgmEWM9XNf0uf
vN6XpnNNUG8IyQYI0CRu+Ti8HfACDTqb8r3cqeYO4ESQtmCn9PyMxFcx4Nz14/T9
ozFjQaXZUPk8tRATkeEVK3j60PEZO9ikp5FvmXNsBS3GrQyDECFsrX2Quj8mGLw=
=yyvF
-----END PGP SIGNATURE-----

[Joonas Lehtonen]

Marek Marczykowski-Górecki:

> On Fri, Apr 29, 2016 at 11:23:56PM +0000, Joonas Lehtonen wrote:
>>> Hi,
>>>
>>> I'm building my own custom kernel packages for VMs. I'd like to
>>> add the u2mfn module directly to the kernel instead of using
>>> the DKMS way.
>>>
>>> Is there a patch that I could apply on a vanilla kernel? (I'd
>>> like to add it to the kernel.spec)
>>>
>>> I didn't see it in the list here:
>>>
>>> https://github.com/QubesOS/qubes-linux-kernel/blob/stable-3.18/series.conf
>
>>>
There is no such patch anywhere, but it shouldn't be hard. You need to
> add u2mfn somewhere into kernel sources (drivers/misc?) and add it
> to Makefile.

Hi Marek,

since I'm quite sure that everything would just work if the u2mfn
module would be part of the kernel.spec:

Would you mind releasing the u2mfn module as a kernel patch?
(ideally with a GPG signature)

thanks!
Joonas

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Seriously, if you really want, take u2mfn dir from here:
https://github.com/QubesOS/qubes-linux-utils/tree/master/kernel-modules/u2mfn

And place in kernel sources wherever you like. Then add it to Makefile
in that directory like this:
obj-m += u2mfn/

Code in that (and every other qubes) repository is of course signed.

I'm not going to maintain a patch (spend a time on it on each new kernel
version) when DKMS way works equally well and requires no work at all on
kernel upgrades.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXOH+cAAoJENuP0xzK19cseF8IAIRUk5Wel/jxnUyTAwLjHWBd
kFFchsE2tODmII3QFp+FESAAc7UneOXe/OXHVhl1NkCscqSVgDeYwGKCEDk5uDkQ
+BOqOyH8VekDSKniAYSbEJWsbnbPND/nvdg4wApt1g66YalZlwswwPnSr8dlkd7r
ANM15iq9MxvJaS/8F9x774VQR0inN53g7YkMOen5SiCvgG5Gk6Kb+AwX7gka+ir/
cRkG36u1WzJgftPUiFAQ1alWrZDNiL/tBrYdzIGOiQanVR65eIViPOXys4HTzJ4Q
sMECEdVm5ULNxVQC/i1gTGP1hscj4JNeM1CkV6Vg/+vt7iK99L+X3lZS/KOG1cI=
=5m5o
-----END PGP SIGNATURE-----