Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel

[Balint Szente]

Hello Anthony!


pypaxctl itself works, but I found the way to reproduce the issue:

1. Set the PT flags for the nvidia GL library:

# paxctl -c /usr/lib/opengl/nvidia/lib/libGL.so.325.15
# paxctl-ng -em /usr/lib/opengl/nvidia/lib/libGL.so.325.15
# paxctl-ng -v /usr/lib/opengl/nvidia/lib/libGL.so.325.15 
/usr/lib/opengl/nvidia/lib/libGL.so.325.15:
	PT_PAX    : -em--
	XATTR_PAX : -em--

2. Delete the XT_ATTR PAX flags (because I don't use XT):

# pypaxctl -d /usr/lib/opengl/nvidia/lib/libGL.so.325.15
# paxctl-ng -v /usr/lib/opengl/nvidia/lib/libGL.so.325.15 
/usr/lib/opengl/nvidia/lib/libGL.so.325.15:
	PT_PAX    : -em--
	XATTR_PAX : not found

3. Run revdep-pax:

# paxctl-ng -v /usr/bin/glxgears 
/usr/bin/glxgears:
	PT_PAX    : -e---
	XATTR_PAX : not found
# revdep-pax -m -l /usr/lib/libGL.so
libGL.so.1 /usr/lib64/opengl/nvidia/lib/libGL.so.325.15 :X86_64 (-em--)

	/usr/bin/glxgears ( -e--- )
        [...]

	Will mark elf with -em--

	Set flags for /usr/bin/glxgears (y/n): y

		/usr/bin/glxgears ( ----- )
# paxctl-ng -v /usr/bin/glxgears 
/usr/bin/glxgears:
	PT_PAX    : -----
	XATTR_PAX : -----

Step 2. is the trigger for the problem. If I don't delete the XT_ATTR
PAX flags from the GL library, then the revdep-pax script works well.

So as a conclusion, I think the issue appears when the library has only
PT marks.

Regards,
Balint

On Fri, 20 Sep 2013 06:31:03 -0400
"Anthony G. Basile" <basile@××××××××××××××.edu> wrote:
>
> I wrote that script but I've never seen this before.  I suspect
> there's something wrong with the pypax python module.  Can you test
> using pypaxctl to set some pax flags on a non-critical elf binary and
> see if it works.
>