[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200203165621.GA4171@pi3.com.pl>
Date: Mon, 3 Feb 2020 17:56:21 +0100
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: error: incompatible gcc/plugin versions - Centos 8
- gcc-8 and gcc-9 & KSPP
Hi,
You have problem with stackleak and structleak plugins:
./scripts/gcc-plugins/stackleak_plugin.so
cc1: error: fail to initialize plugin
./scripts/gcc-plugins/stackleak_plugin.so
cc1: error: incompatible gcc/plugin versions
cc1: error: incompatible gcc/plugin versions
cc1: error: fail to initialize plugin
./scripts/gcc-plugins/structleak_plugin.so
Thanks,
Adam
On Mon, Feb 03, 2020 at 05:20:32PM +0100, bryn1u85 . wrote:
> Hey everyone,
>
> Im using Centos-8 with kernel-5.5 compiled and try to install lkrg but i
> get issue related to gcc plugin version. Is there any way to fix it somehow
> ?
> I was trying to use gcc-8 and as u can see below gcc-9, still getting the
> same error. :( :(
>
> root@...alhost lkrg-main]# scl enable gcc-toolset-9 bash
> [root@...alhost lkrg-main]# gcc -v
> Using built-in specs.
> COLLECT_GCC=gcc
> COLLECT_LTO_WRAPPER=/opt/rh/gcc-toolset-9/root/usr/libexec/gcc/x86_64-redhat-linux/9/lto-wrapper
> Target: x86_64-redhat-linux
> Configured with: ../configure --enable-bootstrap
> --enable-languages=c,c++,fortran,lto
> --prefix=/opt/rh/gcc-toolset-9/root/usr
> --mandir=/opt/rh/gcc-toolset-9/root/usr/share/man
> --infodir=/opt/rh/gcc-toolset-9/root/usr/share/info --with-bugurl=
> http://bugzilla.redhat.com/bugzilla --enable-shared --enable-threads=posix
> --enable-checking=release --enable-multilib --with-system-zlib
> --enable-__cxa_atexit --disable-libunwind-exceptions
> --enable-gnu-unique-object --enable-linker-build-id
> --with-gcc-major-version-only --with-linker-hash-style=gnu --enable-plugin
> --enable-initfini-array
> --with-isl=/builddir/build/BUILD/gcc-9.1.1-20190605/obj-x86_64-redhat-linux/isl-install
> --disable-libmpx --enable-gnu-indirect-function --with-tune=generic
> --with-arch_32=x86-64 --build=x86_64-redhat-linux
> Thread model: posix
> gcc version 9.1.1 20190605 (Red Hat 9.1.1-2) (GCC)
> [root@...alhost lkrg-main]# ls
> CHANGES INSTALL LICENSE Makefile PATREONS PERFORMANCE scripts src
> [root@...alhost lkrg-main]# make -j8
> make -C /lib/modules/5.5.0/build M=/root/lkrg-main modules
> make[1]: Entering directory '/usr/src/kernels/5.5.0'
> CC [M] /root/lkrg-main/src/modules/ksyms/p_resolve_ksym.o
> CC [M] /root/lkrg-main/src/modules/hashing/p_lkrg_fast_hash.o
> CC [M] /root/lkrg-main/src/modules/comm_channel/p_comm_channel.o
> CC [M] /root/lkrg-main/src/modules/integrity_timer/p_integrity_timer.o
> CC [M] /root/lkrg-main/src/modules/kmod/p_kmod.o
> CC [M] /root/lkrg-main/src/modules/database/CPU.o
> CC [M] /root/lkrg-main/src/modules/database/arch/x86/p_x86_metadata.o
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/ksyms/p_resolve_ksym.o] Error 1
> make[2]: *** Waiting for unfinished jobs....
> cc1: error: incompatible gcc/plugin versions
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/hashing/p_lkrg_fast_hash.o] Error 1
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> CC [M]
> /root/lkrg-main/src/modules/database/arch/x86/p_switch_idt/p_switch_idt.o
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/integrity_timer/p_integrity_timer.o] Error 1
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/kmod/p_kmod.o] Error 1
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/comm_channel/p_comm_channel.o] Error 1
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/database/arch/x86/p_x86_metadata.o] Error 1
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/database/CPU.o] Error 1
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/stackleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/structleak_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/latent_entropy_plugin.so
> cc1: error: incompatible gcc/plugin versions
> cc1: error: fail to initialize plugin
> ./scripts/gcc-plugins/randomize_layout_plugin.so
> make[2]: *** [scripts/Makefile.build:265:
> /root/lkrg-main/src/modules/database/arch/x86/p_switch_idt/p_switch_idt.o]
> Error 1
> make[1]: *** [Makefile:1693: /root/lkrg-main] Error 2
> make[1]: Leaving directory '/usr/src/kernels/5.5.0'
> make: *** [Makefile:93: all] Error 2
> [root@...alhost lkrg-main]#
>
> Im using either KSPP kernel security options. Probably it cases those
> problems. Based on kernel version 5.3 everything works well included KSPP
> and LKRG togother. Since i use 5.5 kernel, issues get started.
>
> I have enabled those KSPP options in kernel-5.5:
>
> root@...alhost lkrg-main]#
> /root/kconfig-hardened-check/kconfig-hardened-check.py -c
> /boot/config-5.5.0
> [+] Trying to detect architecture in "/boot/config-5.5.0"...
> [+] Detected architecture: X86_64
> [+] Checking "/boot/config-5.5.0" against hardening preferences...
> option name | desired val | decision |
> reason | check result
> =========================================================================================================================
> CONFIG_BUG | y |defconfig |
> self_protection | OK
> CONFIG_STRICT_KERNEL_RWX | y |defconfig |
> self_protection | OK
> CONFIG_STACKPROTECTOR_STRONG | y |defconfig |
> self_protection | OK
> CONFIG_SLUB_DEBUG | y |defconfig |
> self_protection | OK
> CONFIG_STRICT_MODULE_RWX | y |defconfig |
> self_protection | OK
> CONFIG_MICROCODE | y |defconfig |
> self_protection | OK
> CONFIG_RETPOLINE | y |defconfig |
> self_protection | OK
> CONFIG_X86_SMAP | y |defconfig |
> self_protection | OK
> CONFIG_X86_UMIP | y |defconfig |
> self_protection | OK
> CONFIG_IOMMU_SUPPORT | y |defconfig |
> self_protection | OK
> CONFIG_SYN_COOKIES | y |defconfig |
> self_protection | OK
> CONFIG_PAGE_TABLE_ISOLATION | y |defconfig |
> self_protection | OK
> CONFIG_RANDOMIZE_MEMORY | y |defconfig |
> self_protection | OK
> CONFIG_INTEL_IOMMU | y |defconfig |
> self_protection | OK
> CONFIG_AMD_IOMMU | y |defconfig |
> self_protection | OK
> CONFIG_VMAP_STACK | y |defconfig |
> self_protection | OK
> CONFIG_RANDOMIZE_BASE | y |defconfig |
> self_protection | OK
> CONFIG_THREAD_INFO_IN_TASK | y |defconfig |
> self_protection | OK
> CONFIG_BUG_ON_DATA_CORRUPTION | y | kspp |
> self_protection | OK
> CONFIG_DEBUG_WX | y | kspp |
> self_protection | OK
> CONFIG_SCHED_STACK_END_CHECK | y | kspp |
> self_protection | OK
> CONFIG_SLAB_FREELIST_HARDENED | y | kspp |
> self_protection | OK
> CONFIG_SLAB_FREELIST_RANDOM | y | kspp |
> self_protection | OK
> CONFIG_SHUFFLE_PAGE_ALLOCATOR | y | kspp |
> self_protection | OK
> CONFIG_FORTIFY_SOURCE | y | kspp |
> self_protection | OK
> CONFIG_GCC_PLUGINS | y | kspp |
> self_protection | OK
> CONFIG_GCC_PLUGIN_RANDSTRUCT | y | kspp |
> self_protection | OK
> CONFIG_GCC_PLUGIN_LATENT_ENTROPY | y | kspp |
> self_protection | OK
> CONFIG_DEBUG_LIST | y | kspp |
> self_protection | OK
> CONFIG_DEBUG_SG | y | kspp |
> self_protection | OK
> CONFIG_DEBUG_CREDENTIALS | y | kspp |
> self_protection | OK
> CONFIG_DEBUG_NOTIFIERS | y | kspp |
> self_protection | OK
> CONFIG_HARDENED_USERCOPY | y | kspp |
> self_protection | OK
> CONFIG_HARDENED_USERCOPY_FALLBACK | is not set | kspp |
> self_protection | OK
> CONFIG_MODULE_SIG | y | kspp |
> self_protection | OK
> CONFIG_MODULE_SIG_ALL | y | kspp |
> self_protection | OK
> CONFIG_MODULE_SIG_SHA512 | y | kspp |
> self_protection | OK
> CONFIG_MODULE_SIG_FORCE | y | kspp |
> self_protection | FAIL: "is not set"
> CONFIG_DEFAULT_MMAP_MIN_ADDR | 65536 | kspp |
> self_protection | OK
> CONFIG_REFCOUNT_FULL | y | kspp |
> self_protection | FAIL: not found
> CONFIG_INIT_STACK_ALL | y | clipos |
> self_protection | OK: CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL "y"
> CONFIG_INIT_ON_ALLOC_DEFAULT_ON | y | clipos |
> self_protection | OK
> CONFIG_INIT_ON_FREE_DEFAULT_ON | y | clipos |
> self_protection | OK: CONFIG_PAGE_POISONING "y"
> CONFIG_SECURITY_DMESG_RESTRICT | y | clipos |
> self_protection | OK
> CONFIG_DEBUG_VIRTUAL | y | clipos |
> self_protection | FAIL: "is not set"
> CONFIG_STATIC_USERMODEHELPER | y | clipos |
> self_protection | FAIL: "is not set"
> CONFIG_SLAB_MERGE_DEFAULT | is not set | clipos |
> self_protection | OK
> CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE | is not set | clipos |
> self_protection | OK
> CONFIG_GCC_PLUGIN_STACKLEAK | y | clipos |
> self_protection | OK
> CONFIG_STACKLEAK_METRICS | is not set | clipos |
> self_protection | OK
> CONFIG_STACKLEAK_RUNTIME_DISABLE | is not set | clipos |
> self_protection | OK
> CONFIG_RANDOM_TRUST_CPU | is not set | clipos |
> self_protection | OK
> CONFIG_INTEL_IOMMU_SVM | y | clipos |
> self_protection | FAIL: "is not set"
> CONFIG_INTEL_IOMMU_DEFAULT_ON | y | clipos |
> self_protection | FAIL: "is not set"
> CONFIG_SLUB_DEBUG_ON | y | my |
> self_protection | OK
> CONFIG_RESET_ATTACK_MITIGATION | y | my |
> self_protection | OK
> CONFIG_AMD_IOMMU_V2 | y | my |
> self_protection | OK
> CONFIG_SECURITY | y |defconfig |
> security_policy | OK
> CONFIG_SECURITY_WRITABLE_HOOKS | is not set |defconfig |
> security_policy | OK: not found
> CONFIG_SECURITY_YAMA | y | kspp |
> security_policy | OK
> CONFIG_SECURITY_LOADPIN | y | my |
> security_policy | FAIL: "is not set"
> CONFIG_SECURITY_LOCKDOWN_LSM | y | my |
> security_policy | FAIL: "is not set"
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY | y | my |
> security_policy | FAIL: not found
> CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY| y | my |
> security_policy | FAIL: not found
> CONFIG_SECURITY_SAFESETID | y | my |
> security_policy | FAIL: "is not set"
> CONFIG_SECCOMP | y |defconfig |
> cut_attack_surface | OK
> CONFIG_SECCOMP_FILTER | y |defconfig |
> cut_attack_surface | OK
> CONFIG_STRICT_DEVMEM | y |defconfig |
> cut_attack_surface | OK
> CONFIG_MODULES | is not set | kspp |
> cut_attack_surface | FAIL: "y"
> CONFIG_DEVMEM | is not set | kspp |
> cut_attack_surface | FAIL: "y"
> CONFIG_IO_STRICT_DEVMEM | y | kspp |
> cut_attack_surface | FAIL: "is not set"
> CONFIG_ACPI_CUSTOM_METHOD | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_COMPAT_BRK | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_DEVKMEM | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_COMPAT_VDSO | is not set | kspp |
> cut_attack_surface | OK: not found
> CONFIG_BINFMT_MISC | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_INET_DIAG | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_KEXEC | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_PROC_KCORE | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_LEGACY_PTYS | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_HIBERNATION | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_LEGACY_VSYSCALL_NONE | y | kspp |
> cut_attack_surface | OK
> CONFIG_IA32_EMULATION | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_X86_X32 | is not set | kspp |
> cut_attack_surface | OK
> CONFIG_MODIFY_LDT_SYSCALL | is not set | kspp |
> cut_attack_surface | FAIL: "y"
> CONFIG_X86_PTDUMP | is not set |grsecurity|
> cut_attack_surface | OK
> CONFIG_ZSMALLOC_STAT | is not set |grsecurity|
> cut_attack_surface | OK
> CONFIG_PAGE_OWNER | is not set |grsecurity|
> cut_attack_surface | OK
> CONFIG_DEBUG_KMEMLEAK | is not set |grsecurity|
> cut_attack_surface | OK
> CONFIG_BINFMT_AOUT | is not set |grsecurity|
> cut_attack_surface | OK: not found
> CONFIG_KPROBES | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_UPROBES | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_GENERIC_TRACER | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_PROC_VMCORE | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_PROC_PAGE_MONITOR | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_USELIB | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_CHECKPOINT_RESTORE | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_USERFAULTFD | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_HWPOISON_INJECT | is not set |grsecurity|
> cut_attack_surface | FAIL: "m"
> CONFIG_MEM_SOFT_DIRTY | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_DEVPORT | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_DEBUG_FS | is not set |grsecurity|
> cut_attack_surface | FAIL: "y"
> CONFIG_NOTIFIER_ERROR_INJECTION | is not set |grsecurity|
> cut_attack_surface | OK
> CONFIG_ACPI_TABLE_UPGRADE | is not set | lockdown |
> cut_attack_surface | FAIL: "y"
> CONFIG_ACPI_APEI_EINJ | is not set | lockdown |
> cut_attack_surface | FAIL: "m"
> CONFIG_PROFILING | is not set | lockdown |
> cut_attack_surface | FAIL: "y"
> CONFIG_BPF_SYSCALL | is not set | lockdown |
> cut_attack_surface | FAIL: "y"
> CONFIG_MMIOTRACE_TEST | is not set | lockdown |
> cut_attack_surface | OK: not found
> CONFIG_KSM | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_KALLSYMS | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_X86_VSYSCALL_EMULATION | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_MAGIC_SYSRQ | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_KEXEC_FILE | is not set | clipos |
> cut_attack_surface | OK
> CONFIG_USER_NS | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_LDISC_AUTOLOAD | is not set | clipos |
> cut_attack_surface | FAIL: "y"
> CONFIG_MMIOTRACE | is not set | my |
> cut_attack_surface | OK
> CONFIG_LIVEPATCH | is not set | my |
> cut_attack_surface | OK
> CONFIG_IP_DCCP | is not set | my |
> cut_attack_surface | FAIL: "m"
> CONFIG_IP_SCTP | is not set | my |
> cut_attack_surface | FAIL: "m"
> CONFIG_FTRACE | is not set | my |
> cut_attack_surface | FAIL: "y"
> CONFIG_BPF_JIT | is not set | my |
> cut_attack_surface | FAIL: "y"
> CONFIG_VIDEO_VIVID | is not set | my |
> cut_attack_surface | OK: not found
> CONFIG_ARCH_MMAP_RND_BITS | 32 | clipos
> |userspace_hardening | FAIL: "28"
>
> [+] config check is finished: 'OK' - 81 / 'FAIL' - 42
> [root@...alhost lkrg-main]#
>
> Which from those options could case problem with lkrg compile.
> I would be really grateful for help. Thanks a lot !
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
