Mark Hoekstra | 2 Jun 2004 10:45
Picon

Re: Re: Lidsadm cannot read /proc/sys/lids/lock (2.4.26 / lids-1.2.1pre1-2.4.26)

Huagang,

1) lidsadm in /sbin (0.54)

root <at> host:/# ls -la /sbin
-rwx------    1 root     root        53428 Jun  1 11:59 lidsconf*
-rwx------    1 root     root       503643 Jun  1 11:59 lidsadm*

root <at> host:/sbin# ldd lidsconf
        libc.so.6 => /lib/libc.so.6 (0x4001b000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
root <at> host:/sbin# ldd lidsadm 
        not a dynamic executable

2) I put all the terminal types in the lids kernel config as far as I know.

CONFIG_LIDS_ALLOW_SWITCH=y
CONFIG_LIDS_RESTRICT_MODE_SWITCH=y
CONFIG_LIDS_MODE_SWITCH_CONSOLE=y
CONFIG_LIDS_MODE_SWITCH_SERIAL=y
CONFIG_LIDS_MODE_SWITCH_PTY=y

3) Should I run below commands again before rebooting the new kernel?

/sbin/lidsconf -U
/sbin/lidsconf -U BOOT
/sbin/lidsconf -U POSTBOOT
/sbin/lidsconf -U SHUTDOWN

4) I'm testing everything with a Debian virtual Vmware machine Woody 3.0r2 (stable), but I get the same error on a real machine. Both console and ssh give the same "operation not permitted" error when I try to use lidsadm.

I use lidsadm from /sbin (see above), but I will try to update the inode one more time.

Mark

Huagang Xie wrote:
The reason of the problem could be, 1. the command lidsadm is not in /sbin 2. the tty when the lidsadm running on is not the right one. 3. some problem occured when initialing the LIDS which make the inode for lidsadm incorrectly. 4. other reason...? can you check the "lidsadm" is in "/sbin/"? or you used from other directory. huagang On Tue, Jun 01, 2004 at 06:55:54PM -0700, Doug Porter wrote:
Mark Hoekstra <hoeks002 <at> tfi.kpn.com> said: > Each time I get an error like: > SWITCH > LIDS: lidsadm (dev 8:1 inode xyz) pid x ppid y z uid/gid (0/0) on 9vc/1) : Attempt > to read locks sysctl (unathorised program) read: operation not permitted > lidsadm: cannot read /proc/sys/lids/lock". I get the same sometimes, after running a while without apparent problems. The file system permissions on /proc/sys/lids/lock are fine. There are no acls referencing /proc/sys/lids/lock. This happens even without sealing. When I seal the kernel with lidsadm -I, kern.log shows the transition to POSTBOOT state, but lidsconf -L doesn't show any of the rules from /etc/lids/lids.postboot.conf. Some lidsadm commands log the transition to POSTBOOT state without explicitly sealing. And, at least sometimes, when the sysctl and /proc/sys/lids/lock errors start, suddenly I can't issue lidsadm commands from a script that was working seconds before, but lidsadm from the console still works. I'm working around all this by not sealing and by rebooting as needed. Running kernel 2.4.25. Doug -- Doug Porter dougporter <at> fastmail.fm -- http://www.fastmail.fm - Send your email first class ------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X. >From Windows to Linux, servers to mobile, InstallShield X is the one installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ lids-user mailing list lids-user <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lids-user
------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X. >From Windows to Linux, servers to mobile, InstallShield X is the one installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ lids-user mailing list lids-user <at> lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lids-user
Yusuf Wilajati Purna | 2 Jun 2004 14:57
Picon

Re: Re: Lidsadm cannot read /proc/sys/lids/lock (2.4.26 / lids-1.2.1pre1-2.4.26)

Hi,

> 
> 2) I put all the terminal types in the lids kernel config as far as I know.
> 
> CONFIG_LIDS_ALLOW_SWITCH=y
> CONFIG_LIDS_RESTRICT_MODE_SWITCH=y
> CONFIG_LIDS_MODE_SWITCH_CONSOLE=y
> CONFIG_LIDS_MODE_SWITCH_SERIAL=y
> CONFIG_LIDS_MODE_SWITCH_PTY=y
> 

Try with the following configuration and recompile
the kernel:

# CONFIG_LIDS_RESTRICT_MODE_SWITCH is not set

> 3) Should I run below commands again before rebooting the new kernel?
> 
> /sbin/lidsconf -U
> /sbin/lidsconf -U BOOT
> /sbin/lidsconf -U POSTBOOT
> /sbin/lidsconf -U SHUTDOWN
> 

Don't forget to generate the LIDS administration password as well
(/etc/lids/lids.pw), before rebooting the LIDS patched kernel:

/sbin/lidsconf -P

Regards,
purna

--

-- 
Yusuf Wilajati Purna <ywpurna <at> users.sourceforge.net>
1024D/7354A078
Key fingerprint = 7F4F 8433 C65F 3502 BC93  F529 BFDE F939 7354 A078

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
Mark Hoekstra | 2 Jun 2004 16:27
Picon

Re: Re: Lidsadm cannot read /proc/sys/lids/lock (2.4.26 / lids-1.2.1pre1-2.4.26)

Yusuf,

Tried your suggestion and ran "lidsconf <state>" and "lidsconf -P" but 
unfortunately same error.

version: 2.4.26 kernel & lids-1.2.1pre1-2.4.26 & lidstool-0.5.4.

Error:

LIDS: lidsadm (dev 8:1 inode 81621) pid 225 ppid 207 uid/gid (0/0) on 
(vc/1) : Attempt to read locks sysctl (unauthorised program)
LIDS: lidsadm (dev 8:1 inode 81621) pid 306 ppid 305 uid/gid (0/0) on 
(ttyp) : Attempt to read locks sysctl (unauthorised program)  - logging 
disabled for (60)s

Mark

Yusuf Wilajati Purna wrote:

> Hi,
>
>>
>> 2) I put all the terminal types in the lids kernel config as far as I 
>> know.
>>
>> CONFIG_LIDS_ALLOW_SWITCH=y
>> CONFIG_LIDS_RESTRICT_MODE_SWITCH=y
>> CONFIG_LIDS_MODE_SWITCH_CONSOLE=y
>> CONFIG_LIDS_MODE_SWITCH_SERIAL=y
>> CONFIG_LIDS_MODE_SWITCH_PTY=y
>>
>
> Try with the following configuration and recompile
> the kernel:
>
> # CONFIG_LIDS_RESTRICT_MODE_SWITCH is not set
>
>
>> 3) Should I run below commands again before rebooting the new kernel?
>>
>> /sbin/lidsconf -U
>> /sbin/lidsconf -U BOOT
>> /sbin/lidsconf -U POSTBOOT
>> /sbin/lidsconf -U SHUTDOWN
>>
>
> Don't forget to generate the LIDS administration password as well
> (/etc/lids/lids.pw), before rebooting the LIDS patched kernel:
>
> /sbin/lidsconf -P
>
>
> Regards,
> purna
>
>
>

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
Yusuf Wilajati Purna | 2 Jun 2004 19:26
Picon

Re: Re: Lidsadm cannot read /proc/sys/lids/lock (2.4.26 / lids-1.2.1pre1-2.4.26)

Hi,

Mark Hoekstra wrote:
> Yusuf,
> 
> Tried your suggestion and ran "lidsconf <state>" and "lidsconf -P" but 
> unfortunately same error.
> 
> version: 2.4.26 kernel & lids-1.2.1pre1-2.4.26 & lidstool-0.5.4.
> 
> Error:
> 
> LIDS: lidsadm (dev 8:1 inode 81621) pid 225 ppid 207 uid/gid (0/0) on 
> (vc/1) : Attempt to read locks sysctl (unauthorised program)
> LIDS: lidsadm (dev 8:1 inode 81621) pid 306 ppid 305 uid/gid (0/0) on 
> (ttyp) : Attempt to read locks sysctl (unauthorised program)  - logging 
> disabled for (60)s
> 

Any message such as

LIDS : /etc/lids/lids.pw not found

when the kernel is booting?

Are you using initrd or something like that, that
changes the root file system (using pivot_root, etc)
when the kernel has finished booting?

In short, when a LIDS patched kernel is booting, as soon as
the root file system (/) is mounted, LIDS will try to find
/sbin/lidsadm and memorize its dev/inode number. If LIDS cannot
find the command it will give you the "not found" message above.

After the kernel has finished booting, if you run 'lidsadm'
with a different dev/inode number from the one LIDS has
memorized before, you will get an error such as your error message
above.

Regards,
purna

--

-- 
Yusuf Wilajati Purna <ywpurna <at> users.sourceforge.net>
1024D/7354A078
Key fingerprint = 7F4F 8433 C65F 3502 BC93  F529 BFDE F939 7354 A078

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
Mark Hoekstra | 3 Jun 2004 09:45
Picon

Re: Re: Lidsadm cannot read /proc/sys/lids/lock (2.4.26 / lids-1.2.1pre1-2.4.26)

Yusuf,

You're saying the initrd is the cause for this behaviour? That might 
explain alot because I tested 2.4.26 all this time with an initrd 
enabled kernel package (make-kpgk etc, etc) and never really tested a 
statically compiled kernel.

With 2.6.x however, which has also the initrd option enabled, I define 
LIDS as a module (because it's possible) and it works right away. Your 
answer leads me to the conclusion that LIDS for 2.4.x does not work (out 
of the box) with initrd's and only works with statically configured 
kernels. Correct? The fact that 2.4.x LIDS enabled kernel's don't work 
with initrd is  somewhere documented on www.lids.org?

Anyway, not making a modular kernel is not an option for me, since I try 
to make it work it for several servers with different kinds of hardware 
and I need the initrd so I'm glad they made it modular ;-)

I think I'll use >= 2.6.6 kernels with LIDS for testing purposes from 
now on ;-)

Mark

> Any message such as
>
> LIDS : /etc/lids/lids.pw not found
>
> when the kernel is booting?
>
> Are you using initrd or something like that, that
> changes the root file system (using pivot_root, etc)
> when the kernel has finished booting?
>
> In short, when a LIDS patched kernel is booting, as soon as
> the root file system (/) is mounted, LIDS will try to find
> /sbin/lidsadm and memorize its dev/inode number. If LIDS cannot
> find the command it will give you the "not found" message above.
>
> After the kernel has finished booting, if you run 'lidsadm'
> with a different dev/inode number from the one LIDS has
> memorized before, you will get an error such as your error message
> above.
>
> Regards,
> purna
>
>
>
>

-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504

Gmane