Index: pax-quickstart.xml =================================================================== RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/pax-quickstart.xml,v retrieving revision 1.12 diff -u -r1.12 pax-quickstart.xml --- pax-quickstart.xml 11 Nov 2007 17:08:51 -0000 1.12 +++ pax-quickstart.xml 20 Mar 2009 19:43:06 -0000 @@ -14,6 +14,9 @@ solar + + klondike + A quickstart covering PaX and Hardened Gentoo. @@ -23,8 +26,8 @@ -1.4 -2007-09-11 +1.5 +2009-14-03 What is Hardened Gentoo? @@ -48,20 +51,43 @@

-PaX is a patch to the Linux kernel that provides hardening in two ways. +PaX is a patch to the Linux kernel that provides hardening in three ways (four on +x86 32-bit machines).

The first, ASLR (Address Space Layout Randomization) provides a means to randomize the addressing scheme of all data loaded into memory. When an application is built as a PIE (Position Independent Executable), PaX is -able to also randomize the addresses of the application base in addition. +able to also randomize the addresses of the application base and kernel in addition. +ASLR prevents some exploits which rely on the knowledge of the address of the data +to be exploited.

The second protection provided by PaX is non-executable memory. This prevents a common form of attack where executable code is inserted into memory by an -attacker. More information on PaX can be found throughout this guide, but the +attacker. +

+ +

+The third, free memory sanitization, erases RAM memory pages when they are freed in +order to avoid sensible data to stay in memory for a long time. +

+ + +The free memory sanitization doesn't sanitizes swap pages so if the data is on swap it +will stay there for a long time before it is overwriten. + + +

+The fourth, which is only avaiable on 32 bit x86 builds, invalid userland pointer derefrence +prevention, adds a few checks to the kernel so it doesn't dereference userland (this is non-kernel) +addreses when it is expected to only dereference kernel addresses. +

+ +

+More information on PaX can be found throughout this guide, but the homepage can be found at http://pax.grsecurity.net.

@@ -84,7 +110,7 @@ SSP (Stack Smashing Protector) is a second complementary technology we introduce at executable build time. SSP was originally introduced by IBM under the name ProPolice. It modifies the C compiler to insert initialization -code into functions that create a buffer in memory. +code into functions that create a buffer in memory.

@@ -134,31 +160,36 @@ 

+PaX  --->
 [*] Enable various PaX features
 
-PaX Control ->
+PaX Control --->
 
  [ ] Support soft mode
- [*] Use legacy ELF header marking
+ [ ] Use legacy ELF header marking
  [*] Use ELF program header marking
      MAC system integration (none)  --->
 
-Non-executable page ->
+Non-executable page --->
 
  [*] Enforce non-executable pages
  [*]   Paging based non-executable pages
  [*]   Segmentation based non-executable pages
  [*] Emulate trampolines
  [*] Restrict mprotect()
- [ ]   Disallow ELF text relocations
+ [*]   Disallow ELF text relocations
+ [*] Enforce non-executable kernel pages
 
-Address Space Layout Randomization ->
+Address Space Layout Randomization --->
 
  [*] Address Space Layout Randomization
  [*]   Randomize kernel stack base
  [*]   Randomize user stack base
  [*]   Randomize mmap() base
- [*]     Randomize ET_EXEC base
+Miscellaneous hardening features  --->
+  [*] Sanitize all freed memory
+  [*] Prevent invalid userland pointer dereference
+  [*] Prevent various kernel object reference counter overflows

@@ -220,15 +251,15 @@

-The most notable of these applications are XFree/Xorg, mplayer and multimedia tools -based on xine-lib. The easiest way around these problems are to disable PaX +The most notable of these applications are XFree/Xorg, firefox, mplayer and multimedia +tools based on xine-lib. The easiest way around these problems are to disable PaX protections.

Luckily there is a utility to toggle protections on a per-executable basis, paxctl. As with any other package in Gentoo, install paxctl with the -command emerge paxctl. Usage is show by paxctl -h. +command emerge paxctl. Usage is shown by paxctl -h.

@@ -251,6 +282,8 @@ -v: view flags -z: restore default flags -q: suppress error messages -Q: report flags in short format flags + -c: convert PT_GNU_STACK into PT_PAX_FLAGS (see manpage!) + -C: create PT_PAX_FLAGS (see manpage!)