Hello,
When I'm using the rsbac_auth_enable_login kernel parameter, the boot produces a kernel Oops.
This is the latest kernel 6.18.36 and commit 4cc69f2.
Here is an extract of the boot log :
[ 2.602556] 0000000041|rsbac_do_init(): reading FD attributes from root dev [ 4.368789] 0000000042|rsbac_init_rc(): Initializing RSBAC: RC subsystem [ 4.383903] 0000000043|rsbac_init_auth(): Initializing RSBAC: AUTH subsystem [ 5.232209] 0000000044|rsbac_do_init(): auth_enable_login is set: setting auth_may_setuid for /bin/login [ 5.232269] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 5.232273] #PF: supervisor instruction fetch in kernel mode [ 5.232276] #PF: error_code(0x0010) - not-present page [ 5.232280] PGD 0 P4D 0 [ 5.232286] Oops: Oops: 0010 [#1] SMP PTI [ 5.232295] CPU: 1 UID: 0 PID: 273 Comm: rsbac_initd Not tainted 6.18.36-rsbac #1 PREEMPT_{RT,(full)} [ 5.232302] Hardware name: HP HP Z240 Tower Workstation/802F, BIOS N51 Ver. 01.92 07/04/2024 [ 5.232306] RIP: 0010:0x0 [ 5.232318] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 5.232320] RSP: 0018:ffffcade8165bdd0 EFLAGS: 00010206 [ 5.232325] RAX: 0000000000000000 RBX: ffff8981c267cc30 RCX: 000000000000037d [ 5.232328] RDX: 0000000000000000 RSI: ffff8981c267cc30 RDI: ffff8981c9877778 [ 5.232330] RBP: ffff8981c267c960 R08: 000000006e69676f R09: 0000000000000000 [ 5.232333] R10: ffff8981c267cc30 R11: ffff8981c9877778 R12: ffffcade8165be70 [ 5.232335] R13: 0000000000000000 R14: ffffcade8165bde0 R15: ffff8981c9877778 [ 5.232338] FS: 0000000000000000(0000) GS:ffff8986567b4000(0000) knlGS:0000000000000000 [ 5.232341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.232344] CR2: ffffffffffffffd6 CR3: 0000000148836005 CR4: 00000000003706f0 [ 5.232355] Call Trace: [ 5.232359] <TASK> [ 5.232361] __lookup_slow+0xa3/0x150 [ 5.232412] rsbac_initd+0x1794/0x1b90 [ 5.232444] ? __pfx_rsbac_initd+0x10/0x10 [ 5.232453] kthread+0xfc/0x240 [ 5.232474] ? __pfx_kthread+0x10/0x10 [ 5.232482] ret_from_fork+0x238/0x270 [ 5.232511] ? __pfx_kthread+0x10/0x10 [ 5.232518] ret_from_fork_asm+0x1a/0x30 [ 5.232528] </TASK> [ 5.232529] Modules linked in: ext4 crc16 mbcache jbd2 sd_mod hid_generic usbhid hid xhci_pci xhci_hcd ahci iTCO_wdt libahci intel_pmc_bxt iTCO_vendor_support watchdog libata psmouse e1000e usbcore scsi_mod serio_raw i2c_i801 i2c_smbus usb_common scsi_common video wmi [ 5.232571] CR2: 0000000000000000 [ 5.232577] ---[ end trace 0000000000000000 ]--- [ 5.232579] RIP: 0010:0x0 [ 5.232584] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 5.232586] RSP: 0018:ffffcade8165bdd0 EFLAGS: 00010206 [ 5.232589] RAX: 0000000000000000 RBX: ffff8981c267cc30 RCX: 000000000000037d [ 5.232592] RDX: 0000000000000000 RSI: ffff8981c267cc30 RDI: ffff8981c9877778 [ 5.232594] RBP: ffff8981c267c960 R08: 000000006e69676f R09: 0000000000000000 [ 5.232596] R10: ffff8981c267cc30 R11: ffff8981c9877778 R12: ffffcade8165be70 [ 5.232598] R13: 0000000000000000 R14: ffffcade8165bde0 R15: ffff8981c9877778 [ 5.232601] FS: 0000000000000000(0000) GS:ffff8986567b4000(0000) knlGS:0000000000000000 [ 5.232603] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.232605] CR2: ffffffffffffffd6 CR3: 0000000148836005 CR4: 00000000003706f0 [ 5.232608] note: rsbac_initd[273] exited with irqs disabled
This happens both in softmode and secure mode.
Terence Gomez
Hi!
Am 26.06.26 um 16:59 schrieb Terence Gomez:
When I'm using the rsbac_auth_enable_login kernel parameter, the boot produces a kernel Oops.
This is the latest kernel 6.18.36 and commit 4cc69f2.
Just pushed 6.18.37 and a commit with extra checks in that code.
Amon.
Hello,
On 6/29/26 10:18, Amon Ott wrote:
Just pushed 6.18.37 and a commit with extra checks in that code.
With the version 6.18.37-1.5.6-2 (commit c52d0ba), I still have the Oops, but the instruction in rsbac_initd in the call trace is not the same :
[ 4.113907] 0000000042|rsbac_do_init(): reading FD attributes from root dev [ 4.266821] 0000000043|rsbac_init_rc(): Initializing RSBAC: RC subsystem [ 4.277732] 0000000044|rsbac_init_auth(): Initializing RSBAC: AUTH subsystem [ 4.292802] 0000000045|rsbac_do_init(): auth_enable_login is set: setting auth_may_setuid for /bin/login [ 4.292847] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 4.292851] #PF: supervisor instruction fetch in kernel mode [ 4.292855] #PF: error_code(0x0010) - not-present page [ 4.292859] PGD 0 P4D 0 [ 4.292866] Oops: Oops: 0010 [#1] SMP PTI [ 4.292875] CPU: 1 UID: 0 PID: 272 Comm: rsbac_initd Not tainted 6.18.37-rsbac #1 PREEMPT_{RT,(full)} [ 4.292884] Hardware name: HP HP Z240 Tower Workstation/802F, BIOS N51 Ver. 01.92 07/04/2024 [ 4.292888] RIP: 0010:0x0 [ 4.292898] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 4.292901] RSP: 0018:ffffd39f4165fdd0 EFLAGS: 00010206 [ 4.292908] RAX: 0000000000000000 RBX: ffff8b6d851fbe10 RCX: 0000000000000061 [ 4.292912] RDX: 0000000000000000 RSI: ffff8b6d851fbe10 RDI: ffff8b6d899fae58 [ 4.292916] RBP: ffff8b6d851fb000 R08: 000000006e69676f R09: 0000000000000000 [ 4.292920] R10: ffff8b6d851fbe10 R11: ffff8b6d899fae58 R12: ffffd39f4165fe70 [ 4.292924] R13: 0000000000000000 R14: ffffd39f4165fde0 R15: ffff8b6d899fae58 [ 4.292928] FS: 0000000000000000(0000) GS:ffff8b71ee8b4000(0000) knlGS:0000000000000000 [ 4.292933] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.292937] CR2: ffffffffffffffd6 CR3: 00000002b8436002 CR4: 00000000003706f0 [ 4.292942] Call Trace: [ 4.292945] <TASK> [ 4.292948] __lookup_slow+0xa3/0x150 [ 4.292964] rsbac_initd+0x19ff/0x1c20 [ 4.292979] ? __pfx_rsbac_initd+0x10/0x10 [ 4.292988] kthread+0xfc/0x240 [ 4.292998] ? __pfx_kthread+0x10/0x10 [ 4.293008] ret_from_fork+0x238/0x270 [ 4.293018] ? __pfx_kthread+0x10/0x10 [ 4.293026] ret_from_fork_asm+0x1a/0x30 [ 4.293041] </TASK> [ 4.293044] Modules linked in: ext4 crc16 mbcache jbd2 sd_mod hid_generic usbhid hid xhci_pci ahci xhci_hcd iTCO_wdt libahci intel_pmc_bxt iTCO_vendor_support watchdog libata psmouse e1000e usbcore scsi_mod serio_raw i2c_i801 i2c_smbus usb_common scsi_common video wmi [ 4.293091] CR2: 0000000000000000 [ 4.293101] ---[ end trace 0000000000000000 ]--- [ 4.293105] RIP: 0010:0x0 [ 4.293111] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 4.293114] RSP: 0018:ffffd39f4165fdd0 EFLAGS: 00010206 [ 4.293119] RAX: 0000000000000000 RBX: ffff8b6d851fbe10 RCX: 0000000000000061 [ 4.293122] RDX: 0000000000000000 RSI: ffff8b6d851fbe10 RDI: ffff8b6d899fae58 [ 4.293125] RBP: ffff8b6d851fb000 R08: 000000006e69676f R09: 0000000000000000 [ 4.293128] R10: ffff8b6d851fbe10 R11: ffff8b6d899fae58 R12: ffffd39f4165fe70 [ 4.293132] R13: 0000000000000000 R14: ffffd39f4165fde0 R15: ffff8b6d899fae58 [ 4.293135] FS: 0000000000000000(0000) GS:ffff8b71ee8b4000(0000) knlGS:0000000000000000 [ 4.293139] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.293143] CR2: ffffffffffffffd6 CR3: 00000002b8436002 CR4: 00000000003706f0 [ 4.293147] note: rsbac_initd[273] exited with irqs disabled
Also, with this kernel, when the boot goes on (without auth_enable_login), I repeatedly get this warning, which was not there before :
WARNING: CPU: 0 PID: 632 at fs/namespace.c:1396 mntput_no_expire+0x1a2/0x290 Modules linked in: binfmt_misc nls_ascii intel_rapl_msr nls_cp437 vfat fat jc42 intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp snd_hda_intel kvm_intel snd_soc_avs kvm snd_soc_hda_codec snd_hda_ext_core hp_bioscfg snd_hda_codec irqbypass snd_hda_core firmware_attributes_class ghash_clmulni_intel snd_intel_dspcfg aesni_intel snd_intel_sdw_acpi rapl snd_hwdep hp_wmi intel_cstate snd_soc_core sparse_keymap intel_uncore platform_profile snd_compress rfkill wmi_bmof ee1004 snd_pcm_dmaengine snd_pcsp snd_pcm snd_timer snd soundcore intel_pmc_core pmt_telemetry pmt_discovery pmt_class tpm_infineon intel_pmc_ssram_telemetry joydev intel_vsec acpi_pad evdev button ie31200_edac intel_pch_thermal sg drm efi_pstore configfs nfnetlink efivarfs autofs4 ext4 crc16 mbcache jbd2 sd_mod hid_generic usbhid hid ahci libahci xhci_pci xhci_hcd libata iTCO_wdt intel_pmc_bxt psmouse iTCO_vendor_support watchdog usbcore e1000e scsi_mod serio_raw i2c_i801 i2c_smbus usb_common scsi_common video wmi CPU: 0 UID: 0 PID: 632 Comm: (touch) Tainted: G W 6.18.37-rsbac #1 PREEMPT_{RT,(full)} Tainted: [W]=WARN Hardware name: HP HP Z240 Tower Workstation/802F, BIOS N51 Ver. 01.92 07/04/2024 RIP: 0010:mntput_no_expire+0x1a2/0x290 Code: 48 8b 35 59 97 08 01 b9 01 00 00 00 bf 00 20 00 00 48 c7 c2 00 bd 1f 90 e8 0b 8c c0 ff e9 af fe ff ff 48 8d 6b 40 eb b6 79 02 <0f> 0b e8 87 61 cb ff 48 c7 c7 90 e7 00 90 83 05 39 c2 80 01 01 e8 RSP: 0018:ffffcb2e00c4fe38 EFLAGS: 00010286 RAX: 00000000ffffffff RBX: ffff8a1620ed3b00 RCX: 0000000000000004 RDX: 0000000000000004 RSI: 0000000000000004 RDI: ffffffff8f88b820 RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000001 R10: 0000000000000000 R11: ffff8a1a1b21cdc0 R12: ffff8a16037d3600 R13: ffff8a1620ed3b00 R14: ffff8a1620c8d000 R15: ffff8a1620ed3b20 FS: 00007fdd894445c0(0000) GS:ffff8a1a8a534000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3de5da85d0 CR3: 000000010510c005 CR4: 00000000003726f0 Call Trace: <TASK> path_umount+0x98/0xe0 __x64_sys_umount+0x7d/0x90 do_syscall_64+0x86/0x7e0 ? __x64_sys_readlink+0x1e/0x30 ? do_syscall_64+0xbe/0x7e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fdd89f8d257 Code: 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 89 3b 0d 00 f7 d8 64 89 02 b8 RSP: 002b:00007fff5b490118 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007fdd8a425277 RCX: 00007fdd89f8d257 RDX: 00007fdd89f7bc47 RSI: 0000000000000002 RDI: 00007fdd8a425277 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fff5b490260 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdd8a6c0209 R13: 0000000000000000 R14: 0000000000000000 R15: 00007fff5b490450 </TASK>
Terence Gomez
Am 30.06.26 um 15:34 schrieb Terence Gomez:
On 6/29/26 10:18, Amon Ott wrote:
Just pushed 6.18.37 and a commit with extra checks in that code.
With the version 6.18.37-1.5.6-2 (commit c52d0ba), I still have the Oops, but the instruction in rsbac_initd in the call trace is not the same :
Please retry with the commit I have just pushed, tag rsbac-6.18.37-1.5.6-5
This should fix both delayed init and rsbac_auth_enable_login
Amon.
On 6/30/26 19:15, Amon Ott wrote:
Please retry with the commit I have just pushed, tag rsbac-6.18.37-1.5.6-5
This should fix both delayed init and rsbac_auth_enable_login
On tag rsbac-6.18.37-1.5.6-5, the warnings indeed disappeared, but there still is the init oops with rsbac_auth_enable_login on yet another instruction :
[ 4.217323] 0000000042|rsbac_do_init(): reading FD attributes from root dev [ 4.382786] 0000000043|rsbac_init_rc(): Initializing RSBAC: RC subsystem [ 4.393378] 0000000044|rsbac_init_auth(): Initializing RSBAC: AUTH subsystem [ 4.408752] 0000000045|rsbac_do_init(): auth_enable_login is set: setting auth_may_setuid for /bin/login [ 4.408797] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 4.408801] #PF: supervisor instruction fetch in kernel mode [ 4.408805] #PF: error_code(0x0010) - not-present page [ 4.408810] PGD 0 P4D 0 [ 4.408816] Oops: Oops: 0010 [#1] SMP PTI [ 4.408825] CPU: 1 UID: 0 PID: 272 Comm: rsbac_initd Not tainted 6.18.37-rsbac #1 PREEMPT_{RT,(full)} [ 4.408834] Hardware name: HP HP Z240 Tower Workstation/802F, BIOS N51 Ver. 01.92 07/04/2024 [ 4.408838] RIP: 0010:0x0 [ 4.408848] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 4.408852] RSP: 0018:ffffcc60c15f7dd0 EFLAGS: 00010206 [ 4.408858] RAX: 0000000000000000 RBX: ffff8bdd4208f960 RCX: 0000000000000048 [ 4.408862] RDX: 0000000000000000 RSI: ffff8bdd4208f960 RDI: ffff8bdd60da44d8 [ 4.408866] RBP: ffff8bdd40611690 R08: 000000006e69676f R09: 0000000000000000 [ 4.408871] R10: ffff8bdd4208f960 R11: 0000000000110011 R12: ffffcc60c15f7e70 [ 4.408875] R13: 0000000000000000 R14: ffffcc60c15f7de0 R15: ffff8bdd60da44d8 [ 4.408879] FS: 0000000000000000(0000) GS:ffff8be1b59b4000(0000) knlGS:0000000000000000 [ 4.408884] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.408888] CR2: ffffffffffffffd6 CR3: 0000000390e36006 CR4: 00000000003706f0 [ 4.408893] Call Trace: [ 4.408896] <TASK> [ 4.408899] __lookup_slow+0xa3/0x150 [ 4.408915] rsbac_initd+0x1adc/0x1c70 [ 4.408929] ? __pfx_rsbac_initd+0x10/0x10 [ 4.408939] kthread+0xfc/0x240 [ 4.408949] ? __pfx_kthread+0x10/0x10 [ 4.408959] ret_from_fork+0x238/0x270 [ 4.408969] ? __pfx_kthread+0x10/0x10 [ 4.408977] ret_from_fork_asm+0x1a/0x30 [ 4.408993] </TASK> [ 4.408995] Modules linked in: ext4 crc16 mbcache jbd2 sd_mod hid_generic usbhid hid xhci_pci ahci xhci_hcd iTCO_wdt libahci intel_pmc_bxt iTCO_vendor_support watchdog libata psmouse e1000e usbcore scsi_mod serio_raw i2c_i801 i2c_smbus usb_common scsi_common video wmi [ 4.409042] CR2: 0000000000000000 [ 4.409047] ---[ end trace 0000000000000000 ]--- [ 4.409050] RIP: 0010:0x0 [ 4.409056] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 4.409059] RSP: 0018:ffffcc60c15f7dd0 EFLAGS: 00010206 [ 4.409063] RAX: 0000000000000000 RBX: ffff8bdd4208f960 RCX: 0000000000000048 [ 4.409066] RDX: 0000000000000000 RSI: ffff8bdd4208f960 RDI: ffff8bdd60da44d8 [ 4.409069] RBP: ffff8bdd40611690 R08: 000000006e69676f R09: 0000000000000000 [ 4.409073] R10: ffff8bdd4208f960 R11: 0000000000110011 R12: ffffcc60c15f7e70 [ 4.409076] R13: 0000000000000000 R14: ffffcc60c15f7de0 R15: ffff8bdd60da44d8 [ 4.409079] FS: 0000000000000000(0000) GS:ffff8be1b59b4000(0000) knlGS:0000000000000000 [ 4.409083] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.409087] CR2: ffffffffffffffd6 CR3: 0000000390e36006 CR4: 00000000003706f0 [ 4.409091] note: rsbac_initd[272] exited with irqs disabled
Terence Gomez
Am 01.07.26 um 10:28 schrieb Terence Gomez:
On 6/30/26 19:15, Amon Ott wrote:
Please retry with the commit I have just pushed, tag rsbac-6.18.37-1.5.6-5
This should fix both delayed init and rsbac_auth_enable_login
On tag rsbac-6.18.37-1.5.6-5, the warnings indeed disappeared, but there still is the init oops with rsbac_auth_enable_login on yet another instruction :
Since I cannot find any unchecked pointer in the related code, would you mind retrying with rsbac_debug_stack kernel parameter? This is quite verbose and allows to see, if the NULL deref really is in this code area.
BTW, just pushed some more unrelated commits with new interceptions.
Amon.
On 7/1/26 12:25, Amon Ott wrote:
Am 01.07.26 um 10:28 schrieb Terence Gomez:
On 6/30/26 19:15, Amon Ott wrote:
Please retry with the commit I have just pushed, tag rsbac-6.18.37-1.5.6-5
This should fix both delayed init and rsbac_auth_enable_login
On tag rsbac-6.18.37-1.5.6-5, the warnings indeed disappeared, but there still is the init oops with rsbac_auth_enable_login on yet another instruction :
Since I cannot find any unchecked pointer in the related code, would you mind retrying with rsbac_debug_stack kernel parameter? This is quite verbose and allows to see, if the NULL deref really is in this code area.
I booted with rsbac_debug_stack, and I think nothing wrong is shown. I attach the log so you can check.
Terence Gomez
On 7/1/26 15:27, Terence Gomez wrote:
On 7/1/26 12:25, Amon Ott wrote:
Am 01.07.26 um 10:28 schrieb Terence Gomez:
On 6/30/26 19:15, Amon Ott wrote:
Please retry with the commit I have just pushed, tag rsbac-6.18.37-1.5.6-5
This should fix both delayed init and rsbac_auth_enable_login
On tag rsbac-6.18.37-1.5.6-5, the warnings indeed disappeared, but there still is the init oops with rsbac_auth_enable_login on yet another instruction :
Since I cannot find any unchecked pointer in the related code, would you mind retrying with rsbac_debug_stack kernel parameter? This is quite verbose and allows to see, if the NULL deref really is in this code area.
I booted with rsbac_debug_stack, and I think nothing wrong is shown. I attach the log so you can check.
Terence Gomez
Hi,
I have tried again with the pushes of today (6.18.38-1.5.6 commit 4faaa25), and there still is the oops with rsbac_auth_enable_login. I attached the logs. Maybe this is not related, but I'm using a Debian 13.5 so the /usr-merge is effective. Perhaps /bin/login being a symlink to /usr/bin/login messes with the checks ?
Terence Gomez
Hi!
Am 06.07.26 um 11:25 schrieb Terence Gomez:
Maybe this is not related, but I'm using a Debian 13.5 so the /usr-merge is effective. Perhaps /bin/login being a symlink to /usr/bin/login messes with the checks ?
Good catch! The code was missing an explicit check that /bin really is a directory. Pushed a fix, hope that really helps. Lookup at that stage is pretty low level, so I am not going to implement symlink support for this convenience parameter.
Amon.
On 7/6/26 15:28, Amon Ott wrote:
Am 06.07.26 um 11:25 schrieb Terence Gomez:
Maybe this is not related, but I'm using a Debian 13.5 so the /usr-merge is effective. Perhaps /bin/login being a symlink to /usr/bin/login messes with the checks ?
Good catch! The code was missing an explicit check that /bin really is a directory. Pushed a fix, hope that really helps. Lookup at that stage is pretty low level, so I am not going to implement symlink support for this convenience parameter.
Ok, this was the problem.
I do now have the "/bin is no directory" message in the logs, but the system boots correctly.
Terence Gomez
Am 07.07.26 um 10:18 schrieb Terence Gomez:
On 7/6/26 15:28, Amon Ott wrote:
Am 06.07.26 um 11:25 schrieb Terence Gomez:
Maybe this is not related, but I'm using a Debian 13.5 so the /usr- merge is effective. Perhaps /bin/login being a symlink to /usr/bin/ login messes with the checks ?
Good catch! The code was missing an explicit check that /bin really is a directory. Pushed a fix, hope that really helps. Lookup at that stage is pretty low level, so I am not going to implement symlink support for this convenience parameter.
Ok, this was the problem.
I do now have the "/bin is no directory" message in the logs, but the system boots correctly.
Good that we finally got it fixed. Thank you for your persistent testing support!
Amon.
-
Amon Ott -
Terence Gomez