Jump to content

Syscall init_module returns error


Recommended Posts

Hi, 

Eset realtime is off on my debian12.

When i use sudo systemctl status efs : (enabled and active but errors)

oaeventd[1670]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
oaeventd[1670]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
A

 

I already test to : sudo apt-get install linux-headers-`uname -r` but im already on the last version

What can I do ?

Link to comment
Share on other sites

version of linux header linux-headers-6.1.0-20-amd64 is already the newest version (6.1.85-1).
 

Link to comment
Share on other sites

  • Administrators

This is caused by a change in the latest kernel. We are working on an update which will take some time. As a workaround, you can rollback to kernel 6.1.0-18-amd64.

P_EFSU-4276

Link to comment
Share on other sites

eset_rtp: loading out-of-tree module taints kernel.
The module is not part of the standard Linux kernel (out-of-tree), which leads to the "tainting" of the kernel. This information is recorded in the kernel log to indicate that the kernel has reached states not anticipated by the developers.

eset_rtp: module verification failed: signature and/or required key missing - tainting kernel
The module could not be verified because either a digital signature is missing or the key needed for verifying the signature is absent. This results in further tainting of the kernel, as it points to a security or trust issue.

eset_rtp: cannot find 64-bit syscall table
The module is unable to find the 64-bit syscall table, suggesting there are issues with the module's integration into the kernel, possibly due to changes in kernel addressing or security settings like KASLR, which complicate the localization of critical kernel structures.

 

Link to comment
Share on other sites

  • 3 weeks later...

It doesn't work even with  6.1.0-12-amd64 (#1 SMP PREEMPT_DYNAMIC Debian 6.1.52-1 (2023-09-07) x86_64 GNU/Linux). Same error:

 eset_rtp: cannot find 64-bit syscall table

Link to comment
Share on other sites

  • Administrators
2 hours ago, Albert Edwards said:

It doesn't work even with  6.1.0-12-amd64 (#1 SMP PREEMPT_DYNAMIC Debian 6.1.52-1 (2023-09-07) x86_64 GNU/Linux). Same error:

 eset_rtp: cannot find 64-bit syscall table

Please raise a support ticket then. Downgrade to kernel 6.1.0-18-amd64 was confirmed to work around the issue so I assume that it should work with kernel 6.1.0-12-amd64 too.

Link to comment
Share on other sites

Hi.

Is this same case for Ubuntu?

Running 22.04

Quote

Linux MYSERVER 5.15.0-106-generic #116-Ubuntu SMP Wed Apr 17 09:17:56 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

Quote

May  8 08:23:53 MYSERVER systemd[1]: Starting ESET Server Security...
May  8 08:23:55 MYSERVER kernel: [ 1147.304611] eset_rtp: cannot find 64-bit syscall table
May  8 08:23:55 MYSERVER oaeventd[7749]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
May  8 08:23:55 MYSERVER oaeventd[7749]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
May  8 08:23:55 MYSERVER systemd[1]: Started ESET Server Security.

 

Link to comment
Share on other sites

Same problem with Ubuntu 22.04.4 Kernel 5.15.0-106

But work with Ubuntu 22.04.4 Kernel 6.5.0-28

Link to comment
Share on other sites

21 hours ago, Marcos said:

Please raise a support ticket then. Downgrade to kernel 6.1.0-18-amd64 was confirmed to work around the issue so I assume that it should work with kernel 6.1.0-12-amd64 too.

I tried it, got same error. 

Link to comment
Share on other sites

  • Administrators

Please raise a support ticket as further investigation will be needed.

Link to comment
Share on other sites

Install Ubuntu 22.04

Update it fully.

Install EFS, EFS not working.

This is how you can replicate it and collect every log you need without delays from customers.

Link to comment
Share on other sites

Same with:

5.15.0-107-generic #117-Ubuntu SMP Fri Apr 26 12:26:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

May 14 09:28:37 check_start.sh[4216]: Skipping BTF generation for /var/opt/eset/efs/ewap/eset_wap/eset_wap.ko due to unavailability of vmlinux
May 14 09:28:40 kernel: [   42.982151] eset_rtp: loading out-of-tree module taints kernel.
May 14 09:28:40 kernel: [   42.982240] eset_rtp: module verification failed: signature and/or required key missing - tainting kernel
May 14 09:28:40 kernel: [   43.004337] eset_rtp: cannot find 64-bit syscall table
May 14 09:28:40 oaeventd[4264]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
May 14 09:28:40 oaeventd[4264]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
May 14 09:28:41 systemd[1]: Started ESET Server Security.

 

Link to comment
Share on other sites

if it can help.

I've 2 update the Ubuntu Server 22.04.4 Kernel 5.15.0-106 to the Kernel 6.5.0-28.

But I still have the same error.

I've copied the 2 files in /lib/modules/6.5.0-28-generic/eset/efs from the good server to the bad and now it's work fine.

Link to comment
Share on other sites

Posted (edited)

OK, afaik the new Endpoint Antivirus Version 10.3., which hopefully will solve this issue, is scheduled for tomorrow,
I did not want to wait as I as well have some ESET Server Security installations out there.
So here is what I did on my Ubuntu 22.04.4 systems  (regardless, whether Endpoint Antivirus, or Server Security)
1. I poked around with some very new kernel versions, which led to dependency problems. If you did so as well, regard to
https://askubuntu.com/questions/1253247/how-to-fix-or-remove-a-broken-kernel-ubuntu-20-04
which works pretty well to repair this.
2. Get the 6.3 kernel with wget, which is known to work
3. Install it (sudo dpkg -i *.deb). It will work flawless for a well updated system.
4. the kernel is compiled with gcc-12, so gcc-12 is needed to sign it.

Quote

After reboot, the eea (efs) service will take a wile to start.
Hope, this helps.

Edited by derbärtigeFrytz
Link to comment
Share on other sites

Well that 10.3 is not for servers I believe.....

Looks like some more waiting :)

I just updated Linux box, did not play around with experimental kernels and stuff...

Link to comment
Share on other sites

On 5/8/2024 at 5:20 AM, Jean-Paul said:

But work with Ubuntu 22.04.4 Kernel 6.5.0-28

Confirmed : work with 6.5.0-28 ( but NOT with 6.5.0-35 last released )

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...