Re: [gentoo-hardened] Question WRT Grsecurity/PAx and AV Scanner

[Alexander Gabert]

hallo Martin,

sorry to interrupt your thoughts, but gcc trampolines are not used for
such things :-(

lets answer your questions:

On Wed, 2003-09-17 at 20:01, Martin Bene wrote:
> Hi,
>
> I'm trying to get kaspersky AV (4.0.3.1) to run on a gentoo box with active
> gr security Segmentation based exec protection.
that is good when grsecurity is active
>
> Problem:
> 	* The kaspersky scanner / scanner daemon processess triggers the pax
> protection
> 	* The executables are statically linked
no problem

> 	* The executables check for modification, i.e. after modifying with
> chpax they no longer run.
halflife counterstrike servers do that too

>
> I expect that the triggering code would be a gcc trampoline, so compiling
> with trampoline + automatic detection turned on might work - but it's not a
> very good solution since it affects all executables on the system.
>
> Is there any way of running an executable with modified grsecurity options
> without changing the on-disk file with chpax?
yes, there is
with an enabled grsec system, you have to put grsecurity acl PaX flags
for the kaspersky binary:

from grsecurity.net acl doc:

·          P  DISABLES the PAGEEXEC feature of PaX on this subject

·          S  DISABLES the SEGMEXEC feature of PaX on this subject

·          M  DISABLES the MPROTECT feature of PaX on this subject

·          R  DISABLES the RANDMMAP feature of PaX on this subject

·          G  ENABLES the EMUTRAMP feature of PaX on this subject

·          X  ENABLES the RANDEXEC feature of PaX on this subject

read the gracl doc on the grsecurity.net website and the forums, then go
to the section F:

F.             PaX flags and caveats

there you find more and more docs about setting the appropriate PaX
flags in the grsec acl.

you NEED to remember that this only prevents the binary from dying when
grsec is actually ACTIVE and RUNNING.
otherwise the local file chpax flags INSIDE the binary will trigger.
and the kaspersky scanner does not like it for a reason we all know:
tampering protection :-)

>
> Thanks, Martin

yo, keep on rolling!

bye,

Alex

>
> --
> gentoo-hardened@g.o mailing list
>
>



--
gentoo-hardened@g.o mailing list