Binaries brought in by app-emulation/virtualbox-bin don't have a PT_PAX_FLAGS header. These binaries also require relaxed permissions in order to run properly when PaX is in use. The pax-utils eclass created by the hardened guys can address this issue easily.
Created attachment 116661 [details, diff] patch to use the pax-utils.eclass Note that this will generate a few warnings because list-paxables also lists ELF relocatables and shared objects.
Created attachment 116662 [details, diff] list-paxables should only list ELF executables This is a trivial patch to filter out ELF objects that are not ELF executables from the list of files returned by list-paxables.
virtualbox fixed now, forwarding bug to pax-utils maintainer
your pax-utils patch is not good unfortunately because it'd also ignore PIEs which look like shared libs to 'file'.
Indeed. I had assumed that all ELF files would have a PT header; obviously that's not the case for 'ELF relocatable's. Are there any other ELF types that are not suitable?
(In reply to comment #5) > I had assumed that all ELF files would have a PT header; obviously that's not > the case for 'ELF relocatable's. Are there any other ELF types that are not > suitable? IIRC, ET_EXEC/ET_DYN and ET_CORE must have program headers, ET_REL must not. the PaX binutils patch will emit PT_PAX_FLAGS into both ET_EXEC and ET_DYN, regardless of what the target is (executable or library). this is because the method was based on GNU_STACK handling (which is emitted into both) and in part because i anticipated some future use of the PaX header in libs as well (nothing right now though). in any case, filtering out ET_REL should be good enough i think.
Reassigning due to retirement
Looks like this code already handles ET_DYN,ET_EXEC files. And this bug could be closed. Why there is the extra depend on "file+sed" I'm not sure. # list-paxables {<files>} list-paxables() { file "$@" 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//' } # I would suggest. scanelf -E ET_EXEC,ET_DYN -BF%F "$*"
