From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1LMqTK-0000lo-FU for garchives@archives.gentoo.org; Tue, 13 Jan 2009 21:06:50 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 4F43CE05D5; Tue, 13 Jan 2009 21:06:49 +0000 (UTC) Received: from mail-bw0-f21.google.com (mail-bw0-f21.google.com [209.85.218.21]) by pigeon.gentoo.org (Postfix) with ESMTP id CCC22E05D5 for ; Tue, 13 Jan 2009 21:06:48 +0000 (UTC) Received: by bwz14 with SMTP id 14so713254bwz.10 for ; Tue, 13 Jan 2009 13:06:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=jYNrt8HBMNnACuNfFptuT9cVzZzY5h1I4Dff7DG5T9A=; b=LvVSdiAFBxkiLiQaW0MmTL0OVBwp94RZ7IipXklHFrLhJwg2W9X1Kf9TyZqulSk/ms IL1cZwaPkhny8hOgMhJuTrucY15ElncPB7nXHz/lC8DU8hxKtS6NgPXtTzR9k03rtGZq yO4wWngq2PQuDqqfv6Ao4TrSLape9C4GBqWKg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=d1ORk3VLTP5Ea3Hu0JKaMiGi+F2aCoYQYVUlVCuavsQR2LVMFkth1n7qhpW8T1CqA5 UV7pQNedAr8IuwZXI/AiNDZIDa1MQsMEZ+x/wdk3mvBbVyimV6nTJmuzz+3rVlvrk2c+ o/Vcm9pJzDrxCY2+neXp4VB9Cx2te58k44zk0= Received: by 10.181.147.3 with SMTP id z3mr11525108bkn.71.1231880807970; Tue, 13 Jan 2009 13:06:47 -0800 (PST) Received: by 10.181.16.3 with HTTP; Tue, 13 Jan 2009 13:06:47 -0800 (PST) Message-ID: <49bf44f10901131306x3c6f9a41y5d0fdcefa3df4528@mail.gmail.com> Date: Tue, 13 Jan 2009 13:06:47 -0800 From: Grant To: gentoo-hardened@lists.gentoo.org Subject: Re: [gentoo-hardened] Which hardened kernel feature disables wine? In-Reply-To: <496CF942.8020202@gentoo.org> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <49bf44f10901131100t41a192d8n1d83ba116be42ce2@mail.gmail.com> <1231877371.14355.33.camel@hangover> <496CF942.8020202@gentoo.org> X-Archives-Salt: 2420854d-ad60-433a-a570-67d79482cc0e X-Archives-Hash: c157bccc1d2fb12a1349f1fed7b601c9 >>> I'm using the grsecurity "Gentoo (workstation)" setting in my hardened >>> kernel, but trying to use wine I get this: >>> >>> err:heap:HEAP_GetPtr Invalid heap (nil)! >>> err:heap:HEAP_GetPtr Invalid heap (nil)! >>> err:module:attach_process_dlls "KERNEL32.dll" failed to initialize, aborting >>> err:module:LdrInitializeThunk Main exe initialization for >>> L"C:\\windows\\system32\\wineboot.exe" failed, status c0000005 >>> >>> If I remove grsecurity from the kernel, wine works fine. Does anyone >>> know how to fix this or which grsecurity option I can disable to >>> enable wine? >> >> >> You don't want to go into the kernel and start disabling features as >> that would be the wrong fix. No reason to downgrade system wide security >> for one app. You want to use paxctl -flags /path/to/wine-loader >> >> Personally I'm lazy and would just do. >> paxctl -permsx $(qlist -oe wine) >> >> >> > > This one should do the trick: > > paxctl -m /usr/bin/wine-preloader Thanks everyone, that worked great. Is there a way to get a list of files which have been operated on by paxctl? I didn't see anything in man paxctl. - Grant