| Summary: | pax-utils.eclass from hardened-dev assumes that paxctl-ng supports pt_pax | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Amadeusz Sławiński <amade> |
| Component: | Hardened | Assignee: | The Gentoo Linux Hardened Team <hardened> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 431092 | ||
(In reply to comment #0) > eclass seems to just check if paxctl-ng is installed but not if it is usable > (ie build with pt_pax support) good point thanks. (In reply to comment #1) > (In reply to comment #0) > > eclass seems to just check if paxctl-ng is installed but not if it is usable > > (ie build with pt_pax support) > > good point thanks. Please test the eclass I just put on the hardened-dev overlay with =sys-apps/elfix-0.8.0 which is ~arch right now. Looks like it works # paxctl-ng -v /usr/lib64/valgrind/cachegrind-amd64-linux /usr/lib64/valgrind/cachegrind-amd64-linux: XATTR_PAX: -em-- # paxctl -v /usr/lib64/valgrind/cachegrind-amd64-linux PaX control v0.7 Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu> - PaX flags: -----m-x-e-- [/usr/lib64/valgrind/cachegrind-amd64-linux] MPROTECT is disabled RANDEXEC is disabled EMUTRAMP is disabled (In reply to comment #3) > Looks like it works > > # paxctl-ng -v /usr/lib64/valgrind/cachegrind-amd64-linux > /usr/lib64/valgrind/cachegrind-amd64-linux: > XATTR_PAX: -em-- > > # paxctl -v /usr/lib64/valgrind/cachegrind-amd64-linux > PaX control v0.7 > Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team > <pageexec@freemail.hu> > > - PaX flags: -----m-x-e-- [/usr/lib64/valgrind/cachegrind-amd64-linux] > MPROTECT is disabled > RANDEXEC is disabled > EMUTRAMP is disabled I've had to update the eclass for bug #445948. It works for me. If you have the chance, can you test again. Use elfix-0.8.1 and the eclass from the hardened-dev overlay at http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=blob;f=eclass/pax-utils.eclass;h=fdc7769e014e3e4de8ebd0ae8896a1a83dc47c03;hb=3a2cbaec20cf614ec0dfbf7a6c0d3cedff412b5b [ebuild R ] sys-apps/elfix-0.8.1 USE="xtpax -ptpax" 0 kB It still works fine # paxctl-ng -v /usr/lib64/valgrind/cachegrind-amd64-linux /usr/lib64/valgrind/cachegrind-amd64-linux: XATTR_PAX: -em-- # paxctl -v /usr/lib64/valgrind/cachegrind-amd64-linux PaX control v0.7 Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu> - PaX flags: -----m-x-e-- [/usr/lib64/valgrind/cachegrind-amd64-linux] MPROTECT is disabled RANDEXEC is disabled EMUTRAMP is disabled Thanks |
eclass seems to just check if paxctl-ng is installed but not if it is usable (ie build with pt_pax support) [ebuild R ] dev-python/pypax-0.7.0 USE="xtpax -ptpax" 0 kB [ebuild R ] sys-apps/elfix-0.7.0 USE="xtpax -ptpax {-test}" 0 kB For example with valgrind pt_pax flags are incorrect: * PT PaX marking -m * /var/tmp/portage/dev-util/valgrind-3.8.1/image//usr/lib64/valgrind/cachegrind-amd64-linux * /var/tmp/portage/dev-util/valgrind-3.8.1/image//usr/lib64/valgrind/callgrind-amd64-linux ... * XT PaX marking -m * /var/tmp/portage/dev-util/valgrind-3.8.1/image//usr/lib64/valgrind/cachegrind-amd64-linux * /var/tmp/portage/dev-util/valgrind-3.8.1/image//usr/lib64/valgrind/callgrind-amd64-linux ... # paxctl-ng -v /usr/lib64/valgrind/callgrind-amd64-linux /usr/lib64/valgrind/callgrind-amd64-linux: XT_PAX: -em-- # paxctl -v /usr/lib64/valgrind/callgrind-amd64-linux PaX control v0.7 Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu> - PaX flags: -------x-e-- [/usr/lib64/valgrind/callgrind-amd64-linux] RANDEXEC is disabled EMUTRAMP is disabled # paxctl-ng -v /usr/lib64/valgrind/cachegrind-amd64-linux /usr/lib64/valgrind/cachegrind-amd64-linux: XT_PAX: -em-- # paxctl -v /usr/lib64/valgrind/cachegrind-amd64-linux PaX control v0.7 Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu> - PaX flags: -------x-e-- [/usr/lib64/valgrind/cachegrind-amd64-linux] RANDEXEC is disabled EMUTRAMP is disabled Reproducible: Always