How do you Manual Compile Fedora 27/28/29 Talpa?

Hey Greg Smith 

Thanks for reaching out and my apologies regarding this inconvenience.

I'd advise to please raise a support case for this and provide me with your case ID so I can follow up accordingly.

For reference:

• Sophos Anti-Virus for Linux: Locally compiling Talpa Binary Packs for on-access scanning
• Sophos Anti-Virus for Linux and UNIX: Changes to supported platforms
  • "Talpa on-access scanning continues to be fully supported on Linux distributions and kernels for which Sophos provides a pre-compiled Talpa Binary Pack, and platforms on which local compilation of Talpa is possible. Customers using kernels for which Sophos does not provide a pre-compiled Talpa Binary Pack, and who cannot compile Talpa locally, can contact Sophos Support to discuss possible alternative approaches to enable on-access scanning."

Thanks,

I tried a ticket submitted by one of our Security Staff here, the reply from Sophos was as follows:

"Thank you for contacting Sophos Technical Support!

In regards to your query, Fedora Linux is not a supported distribution for Sophos AV. The following KB below will go over what distributions are supported:​"

And then they replied with the same KB articles you just posted in your reply.

We tried Fanotify, which also did not work, we tried Talpa compile, and that didn't work at first, but the GITHUB version seems to compile as it has recent patches in it for the 4.18+ Kernels, but that won't launch or load.

So, the TALPA modules work, but only if you disable SELINUX on Fedora. You want to help me out with the step I am obviously missing?

Hi Greg,

I've reached out to our team for this, and will reply back with any response I receive.

Regards,

Hi, 

I'm facing the same issue when trying to compile Fedora 29 Talpa modules. (kernel 4.19.15-300.fc29.x86_64)

The build error I get:

Building...
Traceback (most recent call last):
File "talpa_select.py", line 2035, in _action
File "talpa_select.py", line 898, in load
File "talpa_select.py", line 664, in select
File "talpa_select.py", line 1555, in select
File "talpa_select.py", line 1639, in build
File "talpa_select.py", line 1792, in __try_build
SelectException: exc-build-failed

Has this something to do with Python3?

Disabling SElinux doesn't solve the problem.

Kind regards,
GT

Hello,

perhaps DouglasLeeder has some advice.

Christian

The most obvious question: are you using github talpa, via the autodeploy.sh - https://gist.github.com/paperclip/7892031

The version of Talpa that is included with Sophos Anti-Virus for Linux doesn't support Kernel 4.19.

If you are using the github version of Talpa, then the build.log file should give more information about what has failed to build.

Hi Greg,

Looking at https://bugzilla.redhat.com/show_bug.cgi?id=1426741

It looks like selinux enforcing mode may prevent some module loading. I'm afraid, since Fedora isn't on our supported list, we can't look into this in any more detail, but it might be possible for you to create rules to allow talpa_select to load kernel modules.

As a first step it might be worth checking the selinux logs to see what is getting blocked.

Thanks,

Douglas.

I can confirm, if you use the github version of Talpa, it will compile on Fedora, BUT, it will not load the kernel modules as the newest profiles in SELinux do not allow the loading.

After you have compiled the module from github (https://github.com/sophos/talpa), and have tried to turn on the on-access scanning (# /opt/sophos-av/bin/savdctl enable), do the following:

 **** WARNING -- This is what I did on Fedora 27, 28, 29. It might not work on your system -- WARNING ****

This will look at your SELinux Audit logs parsing it for recent insmod failures and build the policy info to add to the default targeted policy.

# ausearch -c insmod -r | audit2allow -M talpainsmod -p /etc/selinux/targeted/policy/policy.31

Once you have that new policy file, you need to add it to existing policy on the system.

# semodule - talpainsmod.pp

Then you just need to reboot the system and the talpa modules compiled before from Github should compile and allow Sophos to run.

I can confirm, if you use the github version of Talpa, it will compile on Fedora, BUT, it will not load the kernel modules as the newest profiles in SELinux do not allow the loading.

After you have compiled the module from github (https://github.com/sophos/talpa), and have tried to turn on the on-access scanning (# /opt/sophos-av/bin/savdctl enable), do the following:

 **** WARNING -- This is what I did on Fedora 27, 28, 29. It might not work on your system -- WARNING ****

This will look at your SELinux Audit logs parsing it for recent insmod failures and build the policy info to add to the default targeted policy.

# ausearch -c insmod -r | audit2allow -M talpainsmod -p /etc/selinux/targeted/policy/policy.31

Once you have that new policy file, you need to add it to existing policy on the system.

# semodule - talpainsmod.pp

Then you just need to reboot the system and the talpa modules compiled before from Github should compile and allow Sophos to run.