{"id":1012,"date":"2011-05-11T18:46:49","date_gmt":"2011-05-11T13:16:49","guid":{"rendered":"http:\/\/judepereira.com\/blog\/?p=1012"},"modified":"2011-07-06T11:11:17","modified_gmt":"2011-07-06T05:41:17","slug":"howto-grsecurity-nouveau-compiz-seg-fault","status":"publish","type":"post","link":"https:\/\/judepereira.com\/blog\/howto-grsecurity-nouveau-compiz-seg-fault\/","title":{"rendered":"[howto] grsecurity + NOUVEAU + Compiz + Seg Fault"},"content":{"rendered":"<p>Assuming that you have a grsec + PaX enabled kernel, you would realise that the nvidia-drivers are a bad choice. Quite a few applications will fail(the ones that use libGLcore.so). Use the nouveau driver for your card, as it&#8217;s pretty much stable and works with good 3D acceleration.<\/p>\n<p><a href=\"https:\/\/i0.wp.com\/judepereira.com\/blog\/wp-content\/uploads\/crun-gr.png\" class=\"highslide-image\" onclick=\"return hs.expand(this);\"><img data-recalc-dims=\"1\" decoding=\"async\" data-attachment-id=\"1023\" data-permalink=\"https:\/\/judepereira.com\/blog\/howto-grsecurity-nouveau-compiz-seg-fault\/crun-gr\/\" data-orig-file=\"https:\/\/i0.wp.com\/judepereira.com\/blog\/wp-content\/uploads\/crun-gr.png?fit=%2C&amp;ssl=1\" data-orig-size=\"\" data-comments-opened=\"1\" data-image-meta=\"[]\" data-image-title=\"compiz under NOUVEAU + PaX\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/i0.wp.com\/judepereira.com\/blog\/wp-content\/uploads\/crun-gr.png?fit=300%2C300&amp;ssl=1\" data-large-file=\"https:\/\/i0.wp.com\/judepereira.com\/blog\/wp-content\/uploads\/crun-gr.png?fit=1024%2C1024&amp;ssl=1\" src=\"https:\/\/i0.wp.com\/judepereira.com\/blog\/wp-content\/uploads\/crun-gr.png\" alt=\"compiz under NOUVEAU + PaX\" title=\"compiz under NOUVEAU + PaX\" class=\"aligncenter size-full wp-image-1023\" \/><\/a><\/p>\n<p>To get compiz working NOUVEAU under hardened linux, first enable the kernel DRM module for nouveau. Follow this link: <a href=\"http:\/\/www.gentoo.org\/doc\/en\/xorg-config.xml\">The X Server Configuration HOWTO<\/a><\/p>\n<p>Build the kernel, and install it. Edit the VIDEO_CARDS variable in your make.conf to say only nouveau, nothing more, nothing less.<\/p>\n<p>Unmask the following packages: media-libs\/mesa, x11-libs\/pixman, x11-drivers\/xf86-video-nouveau, x11-base\/xorg-drivers, x11-base\/xorg-server, x11-libs\/libdrm, x11-drivers\/xf86-input-evdev, x11-drivers\/xf86-input-keyboard, x11-drivers\/xf86-input-mouse<\/p>\n<p>Install the above packages, make sure you&#8217;ve done a emerge -C nvidia-drivers nvidia-settings prior to the merge.<\/p>\n<p>Reboot the system, it should all work out of the box, compiz will fail with a segmentation fault, look into your logs. You&#8217;ll see something like the following:<\/p>\n<pre>\r\n2011-05-11T17:22:24.760922+05:08 halcyon-82 kernel: [ 2026.893377] grsec: denied\r\n resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for \/usr\/b\r\nin\/compiz[compiz:20146] uid\/euid:1000\/1000 gid\/egid:1000\/1000, parent \/bin\/bash[\r\nbash:11847] uid\/euid:1000\/1000 gid\/egid:1000\/1000\r\n\r\n2011-05-11T17:26:07.848848+05:08 halcyon-82 kernel: [ 2249.981362] compiz[20378]\r\n: segfault at ffffffffffffffff ip 00000284c5f39fa1 sp 0000039c50e0ee00 error 6 i\r\nn nouveau_dri.so[284c5cc3000+38b000]\r\n<\/pre>\n<p>Simply disable pax for compiz and emerald, do the following as root:<br \/>\n[sourcecode lang=bash]<br \/>\n# paxctl -zm \/usr\/bin\/compiz<br \/>\n# paxctl -zm \/usr\/bin\/emerald<br \/>\n[\/sourcecode]<\/p>\n<p>Now, start compiz as usual and your all set.<br \/>\nOn a side note, flash player will show a similar issue too, so disable PaX for that too.<\/p>\n<p><strong>WARNING: Disabling PaX for compiz, emerald and flash is a security risk.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Assuming that you have a grsec + PaX enabled kernel, you would realise that the nvidia-drivers are a bad choice. Quite a few applications will fail(the ones that use libGLcore.so). Use the nouveau driver for your card, as it&#8217;s pretty much stable and works with good 3D acceleration. To get compiz working NOUVEAU under hardened [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[11,10],"tags":[227,229,228,232,230,233,234,235,231],"class_list":["post-1012","post","type-post","status-publish","format-standard","hentry","category-gen-sab-fed","category-linux","tag-compiz","tag-grsec","tag-grsecurity","tag-hardened-gentoo","tag-nouveau","tag-nouveau-3d","tag-pax","tag-paxctl","tag-rlimit"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pqtyx-gk","jetpack-related-posts":[{"id":289,"url":"https:\/\/judepereira.com\/blog\/sabayon-four-oh\/","url_meta":{"origin":1012,"position":0},"title":"Sabayon fOuR oH","author":"Jude Pereira","date":"June 16, 2009","format":false,"excerpt":"Based on Gentoo, Sabayon 4.1, tells me: Great performance with less RAM(though you need like 1GB RAM for it to work well enough). Package Management System is absolutely fantastic, with it's new \"Entropy\". Totally the perfect distribution. A fine distribution for the newbie or the expert. This is what a\u2026","rel":"","context":"In &quot;gnu linux&quot;","block_context":{"text":"gnu linux","link":"https:\/\/judepereira.com\/blog\/category\/linux\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":64,"url":"https:\/\/judepereira.com\/blog\/faunos-shadow\/","url_meta":{"origin":1012,"position":1},"title":"FaunOS Shadow","author":"Jude Pereira","date":"January 20, 2009","format":false,"excerpt":"It's a distribution based totally on Arch Linux... specialized for USB Portable installs and can also be used as primary OS has over 600 packages pre-installed (I know... it reminds you of Fedora and me too!). So that's to say that it comes with definitely all the packages you would\u2026","rel":"","context":"In &quot;gnu linux&quot;","block_context":{"text":"gnu linux","link":"https:\/\/judepereira.com\/blog\/category\/linux\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":893,"url":"https:\/\/judepereira.com\/blog\/coloured-varlogmessages-at-tty12\/","url_meta":{"origin":1012,"position":2},"title":"Coloured \/var\/log\/messages at tty12","author":"Jude Pereira","date":"April 26, 2011","format":false,"excerpt":"Reading logs could never become any more easier, at just a keystroke, you have your logs displayed where you want, in some fancy colour. They look great too. TTY's can be accessed by pressing Alt + Ctrl + F[1 - 12] simultaneously. In the following, you'll get a decent, colourized\u2026","rel":"","context":"In &quot;another snippet | code&quot;","block_context":{"text":"another snippet | code","link":"https:\/\/judepereira.com\/blog\/category\/code\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":694,"url":"https:\/\/judepereira.com\/blog\/visual-basic-6-revisited-linux-wine\/","url_meta":{"origin":1012,"position":3},"title":"visual basic 6 revisited &#8211; linux &#8211; wine","author":"Jude Pereira","date":"August 5, 2010","format":false,"excerpt":"Earlier this year, I had written an article on running Visual Basic 6 on linux under wine, this is an update for it, the prior one is deprecated Getting Visual Basic 6 to work on linux is pretty easy, not much trouble, all the basic things work, as of what\u2026","rel":"","context":"In &quot;another snippet | code&quot;","block_context":{"text":"another snippet | code","link":"https:\/\/judepereira.com\/blog\/category\/code\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/posts\/1012","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/comments?post=1012"}],"version-history":[{"count":11,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/posts\/1012\/revisions"}],"predecessor-version":[{"id":1179,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/posts\/1012\/revisions\/1179"}],"wp:attachment":[{"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/media?parent=1012"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/categories?post=1012"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/judepereira.com\/blog\/wp-json\/wp\/v2\/tags?post=1012"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}