Re: [gentoo-hardened] nvidia.ko with Grsecurity & PaX kernel

[Hinnerk van Bruinehsen]

On Sat, Sep 21, 2013 at 07:55:40PM +0300, Balint Szente wrote:
> Hello Anthony!
>
>
> pypaxctl itself works, but I found the way to reproduce the issue:
>
> 1. Set the PT flags for the nvidia GL library:
>
> # paxctl -c /usr/lib/opengl/nvidia/lib/libGL.so.325.15
> # paxctl-ng -em /usr/lib/opengl/nvidia/lib/libGL.so.325.15
> # paxctl-ng -v /usr/lib/opengl/nvidia/lib/libGL.so.325.15
> /usr/lib/opengl/nvidia/lib/libGL.so.325.15:
> 	PT_PAX    : -em--
> 	XATTR_PAX : -em--
>
> 2. Delete the XT_ATTR PAX flags (because I don't use XT):
>
> # pypaxctl -d /usr/lib/opengl/nvidia/lib/libGL.so.325.15
> # paxctl-ng -v /usr/lib/opengl/nvidia/lib/libGL.so.325.15
> /usr/lib/opengl/nvidia/lib/libGL.so.325.15:
> 	PT_PAX    : -em--
> 	XATTR_PAX : not found
>
> 3. Run revdep-pax:
>
> # paxctl-ng -v /usr/bin/glxgears
> /usr/bin/glxgears:
> 	PT_PAX    : -e---
> 	XATTR_PAX : not found
> # revdep-pax -m -l /usr/lib/libGL.so
> libGL.so.1 /usr/lib64/opengl/nvidia/lib/libGL.so.325.15 :X86_64 (-em--)
>
> 	/usr/bin/glxgears ( -e--- )
>         [...]
>
> 	Will mark elf with -em--
>
> 	Set flags for /usr/bin/glxgears (y/n): y
>
> 		/usr/bin/glxgears ( ----- )
> # paxctl-ng -v /usr/bin/glxgears
> /usr/bin/glxgears:
> 	PT_PAX    : -----
> 	XATTR_PAX : -----
>
> Step 2. is the trigger for the problem. If I don't delete the XT_ATTR
> PAX flags from the GL library, then the revdep-pax script works well.
>
> So as a conclusion, I think the issue appears when the library has only
> PT marks.
>
Why would you remove XT-pax flags anyways? It's just xattr (shouldn't cause
much overhead) and since PT-pax is going to be deprecated (iirc soon), you have
a backup with the  XT-pax flags (so you don't have breakage when the switch
occurs).


WKR
Hinnerk