General background:

Sorry, I don't understand the general background.

the rootkit interface disabled

Which rootkit interface?

Please provide steps to reproduce, expected result and actual result.

In T409#6836, @Patrick wrote:

General background:

Sorry, I don't understand the general background.

The general background is that ~10 minutes after contacting my own coutry's intelligence agency about another country's intelligence agency I recieved a DoS from tor's control port (whonix-gw on Qubes vanilla kernel) to whonix-ws (using grsecurity). After talking to Peter (pde) at the EFF about the logs, which showed searching for some magic sequence (similar to SYNful ACK, but different), my Qubes machine was wiped overnight.

the rootkit interface disabled

Which rootkit interface?

"rootkit interface" is a sarcastic reference to CONFIG_MODULES, since that is what it serves as.

---

Please provide steps to reproduce, expected result and actual result.

Sorry, I was wrong. It wasn't a problem with CONFIG_MODULES, I simply hadn't tested every combination (kernel recompilation fatigue).

The actual problem was not having DUMMY. I think perhaps there should be a specific error message for that case.

I also noticed that when either ipv6 is disabled or some tables that whonix-gw doesn't use but does flush aren't in the kernel, the firewall script fails. I think the firewall script ought to use sysctl to check whether related sysfs entries exist and continue (not fail) if they don't exist.

We currently don't have a maintainer dedicated to grsecurity. The only way for now to make this happen is suggesting a patch.

I also noticed that when either ipv6 is disabled or some tables that whonix-gw doesn't use but does flush aren't in the kernel, the firewall script fails. I think the firewall script ought to use sysctl to check whether related sysfs entries exist and continue (not fail) if they don't exist.

It works good enough for us for now. Should be posted in separate issue. Patches are happily considered.