Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel

[Tóth Attila]

2013.Szeptember 21.(Szo) 20:01 időpontban Hinnerk van Bruinehsen ezt írta:
> On Sat, Sep 21, 2013 at 07:55:40PM +0300, Balint Szente wrote:
>>
>> pypaxctl itself works, but I found the way to reproduce the issue:
>>
>> Step 2. is the trigger for the problem. If I don't delete the XT_ATTR
>> PAX flags from the GL library, then the revdep-pax script works well.
>>
>> So as a conclusion, I think the issue appears when the library has only
>> PT marks.
>>
> Why would you remove XT-pax flags anyways? It's just xattr (shouldn't
> cause
> much overhead) and since PT-pax is going to be deprecated (iirc soon), you
> have
> a backup with the  XT-pax flags (so you don't have breakage when the
> switch
> occurs).
>
>
> WKR
> Hinnerk
>

Dear Hinnerk,

I have both PT and XT support compiled into my kernel and I have both PT
and XT PAX flags defined in my make.conf. Using the latest hardened
overlay, it installs binaries with PT marking only. So the installed
binary is just like what Balint produced by erasing the XT attributes.
Now if I run revdep-pax, the situation remains the same.
Actually I've already put together some commands to look for XT-less
binaries and paxctl-ng them properly.

The issue is probably related to the fact, that previously an install
wrapper in portage turned out to slow down things significantly, so it was
removed. GNU install won't preserve XT pax markings. It was told on this
mailing list, that an updated solution will come, which makes install
preserve XT attributes for PAX.

We can expect more to come regarding XT support in the future and help
testing it.

Regards:
Dw.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057
Attila Toth MD, Radiologist, [phone]