Syscall init_module returns error

[TomDib 0]

Hi, 

Eset realtime is off on my debian12.

When i use sudo systemctl status efs : (enabled and active but errors)

oaeventd[1670]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
oaeventd[1670]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
A

 

I already test to : sudo apt-get install linux-headers-`uname -r` but im already on the last version

What can I do ?

[TomDib 0]

version of linux header : linux-headers-6.1.0-20-amd64 is already the newest version (6.1.85-1).
 

[GabrielEset 1]

Same problem on my Debian 12.5.

[Marcos 5,308]

This is caused by a change in the latest kernel. We are working on an update which will take some time. As a workaround, you can rollback to kernel 6.1.0-18-amd64.

P_EFSU-4276

[cpa 0]

eset_rtp: loading out-of-tree module taints kernel.
The module is not part of the standard Linux kernel (out-of-tree), which leads to the "tainting" of the kernel. This information is recorded in the kernel log to indicate that the kernel has reached states not anticipated by the developers.

eset_rtp: module verification failed: signature and/or required key missing - tainting kernel
The module could not be verified because either a digital signature is missing or the key needed for verifying the signature is absent. This results in further tainting of the kernel, as it points to a security or trust issue.

eset_rtp: cannot find 64-bit syscall table
The module is unable to find the 64-bit syscall table, suggesting there are issues with the module's integration into the kernel, possibly due to changes in kernel addressing or security settings like KASLR, which complicate the localization of critical kernel structures.

 

[Albert Edwards 0]

It doesn't work even with  6.1.0-12-amd64 (#1 SMP PREEMPT_DYNAMIC Debian 6.1.52-1 (2023-09-07) x86_64 GNU/Linux). Same error:

 eset_rtp: cannot find 64-bit syscall table

[Marcos 5,308]

2 hours ago, Albert Edwards said:

It doesn't work even with  6.1.0-12-amd64 (#1 SMP PREEMPT_DYNAMIC Debian 6.1.52-1 (2023-09-07) x86_64 GNU/Linux). Same error:

 eset_rtp: cannot find 64-bit syscall table

Please raise a support ticket then. Downgrade to kernel 6.1.0-18-amd64 was confirmed to work around the issue so I assume that it should work with kernel 6.1.0-12-amd64 too.

[Gregecslo 8]

Hi.

Is this same case for Ubuntu?

Running 22.04

Quote

Linux MYSERVER 5.15.0-106-generic #116-Ubuntu SMP Wed Apr 17 09:17:56 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

Quote

May  8 08:23:53 MYSERVER systemd[1]: Starting ESET Server Security...
May  8 08:23:55 MYSERVER kernel: [ 1147.304611] eset_rtp: cannot find 64-bit syscall table
May  8 08:23:55 MYSERVER oaeventd[7749]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
May  8 08:23:55 MYSERVER oaeventd[7749]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
May  8 08:23:55 MYSERVER systemd[1]: Started ESET Server Security.

 

[Jean-Paul 2]

Same problem with Ubuntu 22.04.4 Kernel 5.15.0-106

But work with Ubuntu 22.04.4 Kernel 6.5.0-28

[Albert Edwards 0]

21 hours ago, Marcos said:

Please raise a support ticket then. Downgrade to kernel 6.1.0-18-amd64 was confirmed to work around the issue so I assume that it should work with kernel 6.1.0-12-amd64 too.

I tried it, got same error. 

[Gregecslo 8]

@Marcos Care to comment?

We use supported Ubuntu OS 22.04 and from last week we are unable to use RTP.

[Marcos 5,308]

Please raise a support ticket as further investigation will be needed.

[Gregecslo 8]

Install Ubuntu 22.04

Update it fully.

Install EFS, EFS not working.

This is how you can replicate it and collect every log you need without delays from customers.

[Gregecslo 8]

Same with:

5.15.0-107-generic #117-Ubuntu SMP Fri Apr 26 12:26:49 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

May 14 09:28:37 check_start.sh[4216]: Skipping BTF generation for /var/opt/eset/efs/ewap/eset_wap/eset_wap.ko due to unavailability of vmlinux
May 14 09:28:40 kernel: [   42.982151] eset_rtp: loading out-of-tree module taints kernel.
May 14 09:28:40 kernel: [   42.982240] eset_rtp: module verification failed: signature and/or required key missing - tainting kernel
May 14 09:28:40 kernel: [   43.004337] eset_rtp: cannot find 64-bit syscall table
May 14 09:28:40 oaeventd[4264]: ESET Server Security Error: Syscall init_module returns error: No such file or directory
May 14 09:28:40 oaeventd[4264]: ESET Server Security Error: Initialization of system handler for on-access scan has failed. Please update your OS and restart your computer, then check system logs.
May 14 09:28:41 systemd[1]: Started ESET Server Security.

 

[Gregecslo 8]

@Albert Edwards @Jean-Paul @cpa @GabrielEset @TomDib

Have you got any response from tech support?

[Jean-Paul 2]

if it can help.

I've 2 update the Ubuntu Server 22.04.4 Kernel 5.15.0-106 to the Kernel 6.5.0-28.

But I still have the same error.

I've copied the 2 files in /lib/modules/6.5.0-28-generic/eset/efs from the good server to the bad and now it's work fine.

[derbärtigeFrytz 3]

OK, afaik the new Endpoint Antivirus Version 10.3., which hopefully will solve this issue, is scheduled for tomorrow,
I did not want to wait as I as well have some ESET Server Security installations out there.
So here is what I did on my Ubuntu 22.04.4 systems  (regardless, whether Endpoint Antivirus, or Server Security)
1. I poked around with some very new kernel versions, which led to dependency problems. If you did so as well, regard to
https://askubuntu.com/questions/1253247/how-to-fix-or-remove-a-broken-kernel-ubuntu-20-04
which works pretty well to repair this.
2. Get the 6.3 kernel with wget, which is known to work
3. Install it (sudo dpkg -i *.deb). It will work flawless for a well updated system.
4. the kernel is compiled with gcc-12, so gcc-12 is needed to sign it.

Quote

mkdir nukernel
cd nukernel
wget https://kernel.ubuntu.com/mainline/v6.3/amd64/linux-headers-6.3.0-060300-generic_6.3.0-060300.202304232030_amd64.deb
wget https://kernel.ubuntu.com/mainline/v6.3/amd64/linux-headers-6.3.0-060300_6.3.0-060300.202304232030_all.deb
wget https://kernel.ubuntu.com/mainline/v6.3/amd64/linux-image-unsigned-6.3.0-060300-generic_6.3.0-060300.202304232030_amd64.deb
wget https://kernel.ubuntu.com/mainline/v6.3/amd64/linux-modules-6.3.0-060300-generic_6.3.0-060300.202304232030_amd64.deb
sudo dpkg -i *.deb
sudo apt install --reinstall gcc-12
sudo reboot

After reboot, the eea (efs) service will take a wile to start.
Hope, this helps.

Edited May 14 by derbärtigeFrytz

[Gregecslo 8]

Well that 10.3 is not for servers I believe.....

Looks like some more waiting

I just updated Linux box, did not play around with experimental kernels and stuff...

[arusconi 5]

On 5/8/2024 at 5:20 AM, Jean-Paul said:

But work with Ubuntu 22.04.4 Kernel 6.5.0-28

Confirmed : work with 6.5.0-28 ( but NOT with 6.5.0-35 last released )

[Psyjo 0]

I can confirm efs-10.3.3.0 working with the recent and default kernel in debian-12 and ubuntu-22.04-lts.

[arusconi 5]

EEAV 10.3.4.0 work fine with 6.5.0-35 kernel

[arusconi 5]

11 minutes ago, arusconi said:

EEAV 10.3.4.0 work fine with 6.5.0-35 kernel

Sorry, 11.0.2044.0 work fine with 6.5.0-35.

[arusconi 5]

4 minutes ago, arusconi said:

Sorry, 11.0.2044.0 work fine with 6.5.0-35.

Nope, sorry again, release 11 not available. 10.3.4.0 its the correct EEAV version