From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ghislain Hachey To: development@lists.ipfire.org Subject: Re: LuaJIT Panic on IPFire Date: Wed, 30 Jul 2014 15:37:57 +0800 Message-ID: <53D8A0D5.40408@gmail.com> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3019268158726861333==" List-Id: --===============3019268158726861333== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On 7/29/14, 18:00, development-request(a)lists.ipfire.org wrote: >> I am trying to achieve something here I don't know if this is >> >supported. I've built a custom addon for ntopng, a traffic monitoring >> >tool which makes use of LuaJIT for its web UI scripting language >> >(which is great for embedded devices). When starting the service on my >> >home IPFire I quickly get the following error message. >> > >> >PANIC: unprotected error in call to Lua API (runtime code generation >> >failed, restricted kernel?) >> > >> >Which leads me to think that a JIT is not supported in the kernel >> >configuration of IPFire, or am I way off? This is a tool I'd really >> >like to get working on my IPFire, any ideas? > Check the kernel log. If PaX mprotect has stopped the execution it will > be logged > and in most cases the protection can disabled for single binaries with > paxctl. > > Arne Thanks Arne, That seem to have fixed the problem. I found the following in logs: # grep -nir "pax" messages 311236:Jul 27 16:17:00 shockwave kernel: PAX: From 192.168.3.116:=20 execution attempt in: , 4eb62000-4ec2a000 4eb62000 311237:Jul 27 16:17:00 shockwave kernel: PAX: terminating task:=20 /usr/local/bin/ntopng(ntopng):23772, uid/euid: 1001/1001, PC: 4eb69f89,=20 SP: 4ac2af70 311238:Jul 27 16:17:00 shockwave kernel: PAX: bytes at PC: c7 05 bc a2=20 c0 4e 01 00 00 00 8b 7a f8 8b 7f 08 81 7f 1c ff 311239:Jul 27 16:17:00 shockwave kernel: PAX: bytes at SP-4: 080f92b1=20 4ec0a1c0 4ebcce00 4ebcce08 4ec0b328 4ebfcbf0 00000001 4ebfcbe0 4ec0a1f0=20 00000000 081a0e8c 0815d816 080e7ccd 4ec0a1c0 00000000 00000000 00000000=20 0819f2e4 0b076cd8 081a0e8c 080800b0 and I disabled mprotect with: # paxctl -m /usr/local/bin/ntopng Also, while I was familiarizing myself with grsecurity I noticed that other u= tilities such as pspax, execstack, scanelf and dumpelf are not available in I= PFire. Is there a particular reason for this? Regards, =20 -- GH --===============3019268158726861333==--