1 |
If I paxctl -PS the ioquake3 binary it crashes on startup with the error: |
2 |
|
3 |
PAX: execution attempt in: /dev/zero |
4 |
|
5 |
logged to the syslog. If I paxctl -ps ioquake3 it runs fine. Of course |
6 |
mprotect is disabled in both cases. Quake3 is really only an example though. |
7 |
I guess my larger question is: |
8 |
|
9 |
If I use the SSP-enabled toolchain, I'll loose my ability to toggle this |
10 |
protection off and on at will right? Am I correct that the only work arounds |
11 |
in this case would involve some kind of recompiling with per-package flags, |
12 |
etc.? |
13 |
|
14 |
Thank you for your help. |
15 |
|
16 |
On Saturday, January 27, 2007 18:59, John Schember wrote: |
17 |
> SSP is stack smashing protection. Unless an application your using for |
18 |
> some strange reason likes to over run the stack and execute code just |
19 |
> like a buffer overrun attack you won't have a problem. As far as Quake3 |
20 |
> goes you won't have a problem with the hardened tool chain. |
21 |
> |
22 |
> John Schember |
23 |
> |
24 |
> |
25 |
> On Sat, 2007-01-27 at 18:20 -0800, gentoo-hardened-ml-01@××××××.org |
26 |
> |
27 |
> wrote: |
28 |
> > I've had a "partially-hardened" workstation for awhile now. I use |
29 |
> > hardened-sources and enable many of the PaX/grsecurity options including |
30 |
> > stack smashing protection. This works great as I can disable SEGMEXEC, |
31 |
> > PAGEEXEC and mprotect for Quake3 (ioquake3) and get it to run. My |
32 |
> > question is if I take my workstation to a full hardened system with |
33 |
> > SSP+PIE toolchain, etc. will I still be able to run Quake3 and other |
34 |
> > programs like it? If I went to a full Hardened Gentoo system, even if I |
35 |
> > disabled PaX's SEGMEXEC, PAGEXEC and mprotect, which is sufficient to run |
36 |
> > Quake3 now, the toolchains' own SSP would then kick in and stop me, |
37 |
> > right? |
38 |
> > |
39 |
> > I'm normally a test and do-it-myself kind of person, but I really don't |
40 |
> > want to have to recompile the system to find out and then recompile again |
41 |
> > if gcc's SSP/ProPolice does stop me. |
42 |
> > |
43 |
> > Side note: I masked gcc-4* and >=glibc-2.4 when they were stabled in x86. |
44 |
> > I still run gcc-3.4.6-r2 and glibc-2.3.6-r5 so switching to the hardened |
45 |
> > profile will not present any of those types of problems for me. |
46 |
> > |
47 |
> > Thank you for your help. |
48 |
-- |
49 |
gentoo-hardened@g.o mailing list |