| 1 |
Got a problem while setting up second hardened server (first one on |
| 2 |
hardened-sources 2.6.19 is fine). |
| 3 |
|
| 4 |
ls -l /etc/ | grep make.prof |
| 5 |
lrwxrwxrwx 1 root root 38 îÏÑ 9 08:47 make.profile -> |
| 6 |
/usr/portage/profiles/hardened/x86/2.6 |
| 7 |
|
| 8 |
|
| 9 |
hardened-sources of 2.6.20 and higher do not contain advised features as |
| 10 |
CONFIG_GRKERNSEC_PAX_NOEXEC or CONFIG_GRKERNSEC_PAX_PAGEEXEC |
| 11 |
no PAX features |
| 12 |
CONFIG_PAX_PAGEEXEC CONFIG_PAX_SEGMEXEC CONFIG_PAX_EMUTRAMP CONFIG_PAX_MPROTECT |
| 13 |
|
| 14 |
elcatenegro src # cat linux-2.6.20-hardened-r10/.config | grep |
| 15 |
CONFIG_GRKERNSEC_PAX |
| 16 |
elcatenegro src # |
| 17 |
|
| 18 |
All i can do is |
| 19 |
# cat .config | grep CONFIG_PAX |
| 20 |
CONFIG_PAX=y |
| 21 |
# CONFIG_PAX_SOFTMODE is not set |
| 22 |
CONFIG_PAX_EI_PAX=y |
| 23 |
CONFIG_PAX_PT_PAX_FLAGS=y |
| 24 |
CONFIG_PAX_NO_ACL_FLAGS=y |
| 25 |
# CONFIG_PAX_HAVE_ACL_FLAGS is not set |
| 26 |
# CONFIG_PAX_HOOK_ACL_FLAGS is not set |
| 27 |
CONFIG_PAX_NOEXEC=y |
| 28 |
CONFIG_PAX_ASLR=y |
| 29 |
CONFIG_PAX_RANDKSTACK=y |
| 30 |
CONFIG_PAX_RANDUSTACK=y |
| 31 |
CONFIG_PAX_RANDMMAP=y |
| 32 |
CONFIG_PAX_MEMORY_SANITIZE=y |
| 33 |
|
| 34 |
So as a result i've got "completely vulnerable" paxtest |
| 35 |
|
| 36 |
# cat paxtest.log |
| 37 |
PaXtest - Copyright(c) 2003,2004 by Peter Busser <peter@×××××××××.org> |
| 38 |
Released under the GNU Public Licence version 2 or later |
| 39 |
|
| 40 |
Mode: blackhat |
| 41 |
Linux elcatenegro 2.6.20-hardened-r10 #1 SMP Sat Nov 3 13:08:31 MSK |
| 42 |
2007 i686 Intel(R) Core(TM)2 Quad CPU @ 2.40GHz GenuineIntel GNU/Linux |
| 43 |
|
| 44 |
Executable anonymous mapping : Vulnerable |
| 45 |
Executable bss : Vulnerable |
| 46 |
Executable data : Vulnerable |
| 47 |
Executable heap : Vulnerable |
| 48 |
Executable stack : Vulnerable |
| 49 |
Executable anonymous mapping (mprotect) : Vulnerable |
| 50 |
Executable bss (mprotect) : Vulnerable |
| 51 |
Executable data (mprotect) : Vulnerable |
| 52 |
Executable heap (mprotect) : Vulnerable |
| 53 |
Executable stack (mprotect) : Vulnerable |
| 54 |
Executable shared library bss (mprotect) : Vulnerable |
| 55 |
Executable shared library data (mprotect): Vulnerable |
| 56 |
Writable text segments : Vulnerable |
| 57 |
Anonymous mapping randomisation test : 18 bits (guessed) |
| 58 |
Heap randomisation test (ET_EXEC) : 23 bits (guessed) |
| 59 |
Heap randomisation test (ET_DYN) : 23 bits (guessed) |
| 60 |
Main executable randomisation (ET_EXEC) : 18 bits (guessed) |
| 61 |
Main executable randomisation (ET_DYN) : 18 bits (guessed) |
| 62 |
Shared library randomisation test : 18 bits (guessed) |
| 63 |
Stack randomisation test (SEGMEXEC) : 24 bits (guessed) |
| 64 |
Stack randomisation test (PAGEEXEC) : 24 bits (guessed) |
| 65 |
Return to function (strcpy) : Vulnerable |
| 66 |
Return to function (memcpy) : Vulnerable |
| 67 |
Return to function (strcpy, RANDEXEC) : Vulnerable |
| 68 |
Return to function (memcpy, RANDEXEC) : Vulnerable |
| 69 |
Executable shared library bss : Vulnerable |
| 70 |
Executable shared library data : Killed |
| 71 |
|
| 72 |
It seems to me that the current gentoo don't do hardened on 2.6 kernels |
| 73 |
and a way out is to downgrade to hardened-x86 2.4-kernel and downgrade |
| 74 |
glibc (omg). Am I right? |
| 75 |
|
| 76 |
BTW how do you guys run 2.6.20 and higher kernels? There's a lot of |
| 77 |
such mails at the list. Do you check it with paxtest? |
Archives