Re: [gentoo-hardened] GLX and PaX small problem

[Rumen Yotov]

On чт, 2004-10-21 at 21:27 +0200, pageexec@××××××××.hu wrote:
> > The problem is that when running 'glxinfo' or 'glxgears' (as root) PaX
> > kills them (in dmesg output).
>
> can you send the logs (that should be an automatic reaction ;-)?
> my guess is that it's the GL API stubs that i've fixed for 4.3
> but haven't ported forward to 4.4/xorg yet. it could also be that
> your GL driver (userland) generates code at runtime, in that case
> you have to disable PaX on these apps.
>
>
> --
> gentoo-hardened@g.o mailing list
>
Hi,
OK saved the dmesg-s. There are two of them, first with nvidia-glx
compiled with hardened-gcc-3.4.2-r2-spec the second one with
vanilla-gcc-3.4.2-r2-spec (using gcc-config).
... BEGIN 1....
e100: eth0: e100_watchdog: link up, 100Mbps, full-duplex
Disabled Privacy Extensions on device c01502a0(lo)
e100: eth0: e100_watchdog: link up, 100Mbps, full-duplex
eth0: no IPv6 routers present
grsec: attempted resource overstep by requesting 1024 for RLIMIT_NOFILE
against limit 1024 by /usr/bin/postgres[postmaster:9569] uid/euid:70/70
gid/egid:70/70, parent $
device eth0 entered promiscuous mode
mtrr: 0xc0000000,0x4000000 overlaps existing 0xc0000000,0x200000
grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE
against limit 0 by /usr/X11R6/bin/glxinfo[glxinfo:12753]
uid/euid:1002/1002 gid/egid:100/100, par$
ReiserFS: hda2: warning: vs-8115: get_num_ver: not directory item
ReiserFS: hda2: warning: vs-8115: get_num_ver: not directory item
agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.
agpgart: Putting AGP V3 device at 0000:00:00.0 into 16x mode
agpgart: SiS delay workaround: giving bridge time to recover.
agpgart: Putting AGP V3 device at 0000:01:00.0 into 16x mode
agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.
agpgart: Putting AGP V3 device at 0000:00:00.0 into 16x mode
agpgart: SiS delay workaround: giving bridge time to recover.
agpgart: Putting AGP V3 device at 0000:01:00.0 into 16x mode
grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE
against limit 0 by /usr/X11R6/bin/glxinfo[glxinfo:19269]
uid/euid:1002/1002 gid/egid:100/100, par$
PAX: execution attempt in: /usr/lib/opengl/nvidia/lib/libGL.so.1.0.6111,
2349b000-234aa000 00058000
PAX: terminating task: /usr/X11R6/bin/glxinfo(glxinfo):19278, uid/euid:
0/0, PC: 234a4afc, SP: 595b9d2c
PAX: bytes at PC: 65 a1 f0 ff ff ff ff a0 18 04 00 00 cc cc cc cc cc cc
cc cc
PAX: bytes at SP: 23b5780a 00000000 00000000 00000064 00000064 16609948
1662e3f0 2418c040 1663d678 1663d678 1663d6a8 1663d6a8 00000025 00000025
235b5444 bda45739 00000$
grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE
against limit 0 by /usr/X11R6/bin/glxinfo[glxinfo:19278] uid/euid:0/0
gid/egid:0/0, parent /bin/b$
PAX: execution attempt in: /usr/lib/opengl/nvidia/lib/libGL.so.1.0.6111,
2150b000-2151a000 00058000
PAX: terminating task: /usr/X11R6/bin/glxgears(glxgears):19280,
uid/euid: 0/0, PC: 21514afc, SP: 5a7b5f8c
PAX: bytes at PC: 65 a1 f0 ff ff ff ff a0 18 04 00 00 cc cc cc cc cc cc
cc cc
PAX: bytes at SP: 21a8d80a 00000000 00000000 0000012c 0000012c 175f6be0
1761b688 220c2040 1762a938 1762a938 1762a968 1762a968 00000021 00000021
2162f444 662781bd 00000$
grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE
against limit 0 by /usr/X11R6/bin/glxgears[glxgears:19280] uid/euid:0/0
gid/egid:0/0, parent /bin$
...END 1 ...
And the second:
...BEGIN 2 ...
e100: eth0: e100_watchdog: link up, 100Mbps, full-duplex
Disabled Privacy Extensions on device c014f740(lo)
e100: eth0: e100_watchdog: link up, 100Mbps, full-duplex
agpgart: Detected SiS 746 chipset
agpgart: Maximum main memory to use for agp memory: 203M
agpgart: AGP aperture is 128M @ 0xd0000000
eth0: no IPv6 routers present
grsec: attempted resource overstep by requesting 1024 for RLIMIT_NOFILE
against limit 1024 by /usr/bin/postgres[postmaster:9625] uid/euid:70/70
gid/egid:70/70, parent $
device eth0 entered promiscuous mode
agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.
agpgart: Putting AGP V3 device at 0000:00:00.0 into 16x mode
agpgart: SiS delay workaround: giving bridge time to recover.
agpgart: Putting AGP V3 device at 0000:01:00.0 into 16x mode
agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.
agpgart: Putting AGP V3 device at 0000:00:00.0 into 16x mode
agpgart: SiS delay workaround: giving bridge time to recover.
agpgart: Putting AGP V3 device at 0000:01:00.0 into 16x mode
kjournald starting.  Commit interval 5 seconds
EXT3 FS on hda1, internal journal
EXT3-fs: mounted filesystem with ordered data mode.
PAX: execution attempt in: /usr/lib/opengl/nvidia/lib/libGL.so.1.0.6111,
2689c000-268ab000 00058000
PAX: terminating task: /usr/X11R6/bin/glxinfo(glxinfo):11814, uid/euid:
0/0, PC: 268a5afc, SP: 5c308b9c
PAX: bytes at PC: 65 a1 f0 ff ff ff ff a0 18 04 00 00 cc cc cc cc cc cc
cc cc
PAX: bytes at SP: 26f5880a 00000000 00000000 00000064 00000064 126314d0
12655f58 2758d040 126651e0 126651e0 12665210 12665210 00000025 00000025
269b6444 facc1702 00000$
grsec: attempted resource overstep by requesting 4096 for RLIMIT_CORE
against limit 0 by /usr/X11R6/bin/glxinfo[glxinfo:11814] uid/euid:0/0
gid/egid:0/0, parent /bin/b$
PAX: execution attempt in: /usr/lib/opengl/nvidia/lib/libGL.so.1.0.6111,
24464000-24473000 00058000
PAX: terminating task: /usr/X11R6/bin/glxgears(glxgears):11815,
uid/euid: 0/0, PC: 2446dafc, SP: 5f15e97c
PAX: bytes at PC: 65 a1 f0 ff ff ff ff a0 18 04 00 00 cc cc cc cc cc cc
cc cc
PAX: bytes at SP: 249e680a 00000000 00000000 0000012c 0000012c 12408b68
1242d5f0 2501b040 1243c8a0 1243c8a0 1243c8d0 1243c8d0 00000021 00000021
24588444 5cc35c54 00000$
...END 2 ...
Note that i've activated quite all of PaX as grsec2 (TPE also, see some
info about gid:100). The postgresql issue is known one.
Also remember that after emerging xorg-X11-6.8.0-r1 (couldn't start X)
so disabled all Pax flags on some binary (with the error) - maybe xinit,
tried checking the binaries now but they are too many out there.
Found it: /usr/X11R6/bin/Xorg (or at least keep an error on this).
Thanks.
-- 
Rumen Yotov <rumen_yotov@×××.bg>