Gentoo Archives: gentoo-hardened

From: "Anthony G. Basile" <basile@××××××××××××××.edu>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] denied RWX mmap by layman
Date: Tue, 10 Jun 2014 17:50:10
Message-Id: 5397454C.8000605@opensource.dyc.edu
In Reply to: Re: [gentoo-hardened] denied RWX mmap by layman by Michael Orlitzky
1 On 06/09/14 11:43, Michael Orlitzky wrote:
2 > On 06/07/2014 08:55 PM, Anthony G. Basile wrote:
3 >>
4 >> When running with a pax kernel, you must enable EMUTRAMP in your Kconfig
5 >> and you must paxmark your python exe's with E. Note: EMUTRAMP is on by
6 >> default and the ebuild automatically does the markings for you, so leave
7 >> the defaults alone.
8 >>
9 >
10 > Can linux-info.eclass be used to spit out a warning during a python emerge?
11 >
12 > This,
13 >
14 > use hardened && CONFIG_CHECK+=" ~CONFIG_PAX_EMUTRAMP"
15 >
16 > seems like a common pattern. With a little more ingenuity we can
17 > probably have it check the running/installed kernel and not the USE flag.
18 >
19
20 Yes and no. I could add that as a warning but .... There is no
21 guarantee that the kernel you are building under is the kernel you will
22 be running under. So there's no way to warn against future stupidity.
23 Or current stupidity if your running kernel and kernel sources are out
24 of sync.
25
26 So I'm not a fan of linux-info.eclass.
27
28 --
29 Anthony G. Basile, Ph. D.
30 Chair of Information Technology
31 D'Youville College
32 Buffalo, NY 14201
33 (716) 829-8197

Replies

Subject Author
Re: [gentoo-hardened] denied RWX mmap by layman Michael Orlitzky <mjo@g.o>