Gentoo Hardening: Part 4: PaX, RBAC and ClamAV [Updated 2018]

Grsecurity and Xorg

If we enable the “Disable privileged I/O” feature in the hardened kernel and reboot, we can’t start X server. That’s because Xorg uses privileged I/O operations. We might receive an error like this:

# startx
xf86EnableIOPorts: failed to set IOPL for I/O (Operation not permitted)

If we would like to use Xorg, we must enable privileged I/O operations. That disables the “Disable privileged I/O” option in the hardened Linux kernel.

But if we want to have privileged I/O operations disabled, and use Xorg, we can apply a patch to the xorg-server, which can be obtained here. We can apply a custom patch in Gentoo by using the epatch_user function, which applies patches found in /etc/portage/patches/<category>/<package>[-<version>[-revision>]] to the source code of the package [8].

# mkdir -p /etc/portage/patches/x11-base/xorg-server
# cd /etc/portage/patches/x11-base/xorg-server
# wget <a href="https://raw.github.com/N8Fear/hvb-overlay/master/x11-base/xorg-server/files/xorg-nohwaccess.patch">https://raw.github.com/N8Fear/hvb-overlay/master/x11-base/xorg-server/files/xorg-nohwaccess.patch</a>
# emerge xorg-server

When we activate the xorg-server, the /etc/portage/patches/x11-base/xorg-server patch will automatically be applied. Notice the line “Applying user patches from /etc/portage/patches//x11-base/xorg-server?” The next lines say that the xorg-nohwaccess.patch was applied, which was exactly the patch we downloaded from Github.

>>> Emerging (1 of 1) x11-base/xorg-server-1.13.4
* xorg-server-1.13.4.tar.bz2 SHA256 SHA512 WHIRLPOOL size ;-) ... [ ok ]
>>> Unpacking source...
>>> Unpacking xorg-server-1.13.4.tar.bz2 to /var/tmp/portage/x11-base/xorg-server-1.13.4/work
>>> Source unpacked in /var/tmp/portage/x11-base/xorg-server-1.13.4/work
>>> Preparing source in /var/tmp/portage/x11-base/xorg-server-1.13.4/work/xorg-server-1.13.4 ...
* Applying xorg-server-1.12-disable-acpi.patch ...
* Applying xorg-server-1.13-ia64-asm.patch ...
* Applying user patches from /etc/portage/patches//x11-base/xorg-server ...
* xorg-nohwaccess.patch ...
* Done with patching

After reactivating the system, we can rebuild the kernel and enable the “Disable privileged I/O” option. Then copy the newly built kernel to the /boot partition and restart the system. Xorg should then start without problems.

PaX Internals

When (Read more...)